AWS IAM role can assume multiple roles with administrative privileges cross-account

문서 > Datadog 보안 > OOTB Rules > AWS IAM role can assume multiple roles with administrative privileges cross-account

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another, more privileged identity. This rule identifies when a given role can use sts:AssumeRole to assume multiple IAM roles with administrative privileges in different accounts in your AWS environment. By assuming these more privileged roles, an adversary can leverage their permissions for further access.

Rationale

The identity which triggered this detection can assume multiple IAM roles with administrative privileges in different accounts in your AWS environment, giving them access to the privileges of that role.

Remediation

Datadog recommends reducing the permissions attached to an IAM role to the minimum required for the role to fulfill its function. To remediate the issue, either remove the sts:AssumeRole permission entirely, or modify the resources specified in the IAM policy.