---
title: >-
  IAM role with read access to production S3 data can be assumed by a third
  party
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM role with read access to production
  S3 data can be assumed by a third party
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM role with read access to production S3 data can be assumed by a third party

## Description{% #description %}

An IAM role with read access to production S3 data can be assumed by a third party. This configuration allows an external AWS account to assume a role that has read permissions on production S3 buckets. The third party, or an attacker who compromises the third-party account, can assume this role and exfiltrate sensitive production data including personally identifiable information, credentials, financial records, or proprietary business data.

## Remediation{% #remediation %}

1. [Review and manage IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) to ensure only trusted accounts can assume the role, and require external ID for third-party access.
1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) to follow the principle of least privilege and remove unnecessary S3 read permissions from third-party-assumable roles.