---
title: >-
  AWS IAM role without administrative access has a direct privilege-escalation
  path to an administrative principal
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS IAM role without administrative
  access has a direct privilege-escalation path to an administrative principal
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS IAM role without administrative access has a direct privilege-escalation path to an administrative principal
 
## Description{% #description %}

This rule identifies AWS IAM roles that do not have administrative access themselves but have a direct privilege-escalation path to an administrative principal. The detection traverses `assumes` and `can_escalate` relationships in Datadog's security graph, surfacing both the non-administrative source role and the administrative principal it can reach.

## Rationale{% #rationale %}

A non-administrative role with a direct path to an administrative principal represents a significant identity risk. Even though the role itself does not have administrator policies attached, an adversary with access to the role could assume or escalate into the administrative principal to acquire full administrative access to the account, bypassing principle-of-least-privilege controls. Surfacing the escalation edge explicitly helps responders understand exactly how the escalation is possible.

## Remediation{% #remediation %}

Datadog recommends reducing the permissions attached to an IAM role to the minimum required for the role to fulfill its function. Review the privilege-escalation path Datadog has identified, then remove or restrict the specific permissions that allow the role to assume or escalate into the administrative principal.