---
title: Publicly assumable IAM role can escalate privileges to access sensitive data
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Publicly assumable IAM role can
  escalate privileges to access sensitive data
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Publicly assumable IAM role can escalate privileges to access sensitive data

## Description{% #description %}

A publicly assumable IAM role can escalate privileges to access sensitive data. This configuration allows any AWS principal, including those from external AWS accounts, to assume the role and then leverage privilege escalation permissions to gain elevated access to resources containing sensitive information such as S3 buckets, RDS databases, or DynamoDB tables. An attacker with any valid AWS credentials can exploit this misconfigured trust policy, escalate privileges, and gain unauthorized access to protected data.

## Remediation{% #remediation %}

1. [Review and manage IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) to restrict the trust policy and limit which principals can assume the role.
1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) to follow the principle of least privilege.