---
title: >-
  AWS IAM user without administrative access has a direct privilege-escalation
  path to an administrative principal
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS IAM user without administrative
  access has a direct privilege-escalation path to an administrative principal
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS IAM user without administrative access has a direct privilege-escalation path to an administrative principal
 
## Description{% #description %}

This rule identifies AWS IAM users that do not have administrative access themselves but have a direct privilege-escalation path to an administrative principal. The detection traverses `assumes` and `can_escalate` relationships in Datadog's security graph, surfacing both the non-administrative source user and the administrative principal it can reach.

## Rationale{% #rationale %}

A non-administrative user with a direct path to an administrative principal represents a significant identity risk. Even though the user does not have administrator policies attached, an adversary who compromises the user's credentials could assume or escalate into the administrative principal to acquire full administrative access to the account, bypassing principle-of-least-privilege controls. Surfacing the escalation edge explicitly helps responders understand exactly how the escalation is possible.

## Remediation{% #remediation %}

Datadog recommends reducing the permissions attached to an IAM user to the minimum required for the user to fulfill its function. Review the privilege-escalation path Datadog has identified, then remove or restrict the specific permissions that allow the user to assume or escalate into the administrative principal.