VIEW RULE IN DATADOG

Description

An IAM user with privilege-escalation capability has console access enabled without MFA in an AWS account with a weak password policy. The weak password policy combined with the absence of MFA means an attacker who compromises the user’s password can authenticate to the console and leverage privilege escalation permissions to gain elevated access to AWS resources. Common escalation paths include creating access keys, modifying IAM policies, or assuming roles with higher privileges.

Remediation

1. Enable MFA for the IAM user by following the AWS MFA documentation and enforce strong password policies using the IAM password policy settings.
2. Remove unnecessary privilege-escalation permissions such as CreateAccessKey, PutUserPolicy, AttachUserPolicy, or CreateRole, and apply permission boundaries to limit escalation paths.