VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

This rule identifies AWS IAM roles that do not have administrative access themselves but have a direct privilege-escalation path to an administrative principal. The detection traverses assumes and can_escalate relationships in Datadog’s security graph, surfacing both the non-administrative source role and the administrative principal it can reach.

Rationale

A non-administrative role with a direct path to an administrative principal represents a significant identity risk. Even though the role itself does not have administrator policies attached, an adversary with access to the role could assume or escalate into the administrative principal to acquire full administrative access to the account, bypassing principle-of-least-privilege controls. Surfacing the escalation edge explicitly helps responders understand exactly how the escalation is possible.

Remediation

Datadog recommends reducing the permissions attached to an IAM role to the minimum required for the role to fulfill its function. Review the privilege-escalation path Datadog has identified, then remove or restrict the specific permissions that allow the role to assume or escalate into the administrative principal.