- 필수 기능
- 시작하기
- Glossary
- 표준 속성
- Guides
- Agent
- 통합
- 개방형텔레메트리
- 개발자
- API
- Datadog Mobile App
- CoScreen
- Cloudcraft
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- APM
- Continuous Profiler
- 스팬 시각화
- 데이터 스트림 모니터링
- 데이터 작업 모니터링
- 디지털 경험
- 소프트웨어 제공
- 보안
- AI Observability
- 로그 관리
- 관리
In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given group can use sts:AssumeRole
to assume a role with administrative privileges. By assuming this more privileged role, an adversary can leverage their permissions for further access.
The identity which triggered this detection can assume a role with administrative privileges, giving them access to the privileges of that role.
Datadog recommends reducing the permissions attached to an IAM group to the minimum required for the group to fulfill its function. To remediate the issue, either remove the sts:AssumeRole
permission entirely, or modify the resource specified in the IAM policy.