VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

This rule identifies AWS IAM users that do not have administrative access themselves but have a direct privilege-escalation path to an administrative principal. The detection traverses assumes and can_escalate relationships in Datadog’s security graph, surfacing both the non-administrative source user and the administrative principal it can reach.

Rationale

A non-administrative user with a direct path to an administrative principal represents a significant identity risk. Even though the user does not have administrator policies attached, an adversary who compromises the user’s credentials could assume or escalate into the administrative principal to acquire full administrative access to the account, bypassing principle-of-least-privilege controls. Surfacing the escalation edge explicitly helps responders understand exactly how the escalation is possible.

Remediation

Datadog recommends reducing the permissions attached to an IAM user to the minimum required for the user to fulfill its function. Review the privilege-escalation path Datadog has identified, then remove or restrict the specific permissions that allow the user to assume or escalate into the administrative principal.