---
title: >-
  IAM user with privilege-escalation capability has unused console access
  without MFA in an account with a weak password policy
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM user with privilege-escalation
  capability has unused console access without MFA in an account with a weak
  password policy
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM user with privilege-escalation capability has unused console access without MFA in an account with a weak password policy

## Description{% #description %}

An IAM user with privilege-escalation capability has unused console access enabled without MFA in an AWS account with a weak password policy. The console access has not been used in 45 days or more (per CIS AWS Foundations Benchmark), indicating potentially abandoned credentials. If an attacker gains access to this credential, they can authenticate to the console and leverage privilege escalation permissions to gain elevated access to AWS resources, including creating access keys, modifying IAM policies, or assuming roles with higher privileges.

## Remediation{% #remediation %}

1. Disable console access for users who do not need it, or enable MFA by following the [AWS MFA documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html) and enforce strong password policies using the [IAM password policy settings](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html).
1. Remove unnecessary privilege-escalation permissions such as CreateAccessKey, PutUserPolicy, AttachUserPolicy, or CreateRole, and apply permission boundaries to limit escalation paths.