AWS IAM role can create a login profile for an IAM user with administrative privileges

iam
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given role can use iam:CreateLoginProfile to create a new login profile for an IAM user with administrative privileges. By creating a new login profile for another user, an adversary could log in as that user and leverage their privileges.

Rationale

In this scenario, there exists at least one privileged IAM user in the account who does not have a login profile set. The identity which triggered this detection can create a login profile for that IAM user, giving them access to the privileges of the compromised user.

Remediation

Datadog recommends reducing the permissions attached to an IAM role to the minimum necessary for the role to fulfill its function. To remediate the issue, either remove the iam:CreateLoginProfile permission entirely or modify the resource the IAM policy specifies.