---
title: >-
  IAM user with console access without MFA can assume administrator privileges
  in an account with a weak password policy
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM user with console access without
  MFA can assume administrator privileges in an account with a weak password
  policy
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM user with console access without MFA can assume administrator privileges in an account with a weak password policy

## Description{% #description %}

An IAM user with console access without MFA can assume administrator privileges in an AWS account with a weak password policy. The weak password policy combined with the absence of MFA means an attacker who compromises the user's credentials can authenticate to the console and reach administrator principals through role assumption or other trust relationships. This provides a path to full administrative control over the AWS account.

## Remediation{% #remediation %}

1. Enable MFA for the IAM user by following the [AWS MFA documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html) and enforce strong password policies using the [IAM password policy settings](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html).
1. Review and restrict trust relationships that allow the user to assume administrator roles, and apply permission boundaries to limit escalation paths.