IAM user can use role chaining to access sensitive data

iam
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

An IAM user can use role chaining to access sensitive data. If an attacker compromises this user’s credentials, they can assume one or more IAM roles in sequence, following a chain of trust relationships to ultimately gain access to resources containing sensitive information such as S3 buckets, RDS databases, or DynamoDB tables. Each step in the chain grants additional permissions until the attacker reaches the target sensitive data.

Remediation

  1. Review and adjust IAM user permissions to limit role assumption capabilities.
  2. Review and manage IAM roles in the chain to ensure they follow the principle of least privilege.