---
title: >-
  IAM user with privilege-escalation capability has console access without MFA
  in an account with a weak password policy
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM user with privilege-escalation
  capability has console access without MFA in an account with a weak password
  policy
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM user with privilege-escalation capability has console access without MFA in an account with a weak password policy

## Description{% #description %}

An IAM user with privilege-escalation capability has console access enabled without MFA in an AWS account with a weak password policy. The weak password policy combined with the absence of MFA means an attacker who compromises the user's password can authenticate to the console and leverage privilege escalation permissions to gain elevated access to AWS resources. Common escalation paths include creating access keys, modifying IAM policies, or assuming roles with higher privileges.

## Remediation{% #remediation %}

1. Enable MFA for the IAM user by following the [AWS MFA documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html) and enforce strong password policies using the [IAM password policy settings](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html).
1. Remove unnecessary privilege-escalation permissions such as CreateAccessKey, PutUserPolicy, AttachUserPolicy, or CreateRole, and apply permission boundaries to limit escalation paths.