---
title: >-
  Production IAM role with read access to production S3 data can be assumed by a
  non-production role
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Production IAM role with read access to
  production S3 data can be assumed by a non-production role
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Production IAM role with read access to production S3 data can be assumed by a non-production role

## Description{% #description %}

A production IAM role with read access to production S3 data can be assumed by a non-production role through a chain of trust relationships. If an attacker compromises a non-production environment, they can assume one or more roles until reaching a production role that has read access to production S3 buckets, enabling exfiltration of sensitive production data. Non-production environments typically have weaker security controls, making them attractive entry points for attackers seeking to access production resources.

## Remediation{% #remediation %}

1. [Review and manage IAM role trust policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) to prevent non-production roles from assuming production roles.
1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) to enforce environment boundaries and follow the principle of least privilege.