VIEW RULE IN DATADOG

Description

A production IAM role with read access to production S3 data can be assumed by a non-production role through a chain of trust relationships. If an attacker compromises a non-production environment, they can assume one or more roles until reaching a production role that has read access to production S3 buckets, enabling exfiltration of sensitive production data. Non-production environments typically have weaker security controls, making them attractive entry points for attackers seeking to access production resources.

Remediation

1. Review and manage IAM role trust policies to prevent non-production roles from assuming production roles.
2. Apply IAM security best practices to enforce environment boundaries and follow the principle of least privilege.