VIEW RULE IN DATADOG

Description

An IAM user with console access without MFA can assume administrator privileges in an AWS account with a weak password policy. The weak password policy combined with the absence of MFA means an attacker who compromises the user’s credentials can authenticate to the console and reach administrator principals through role assumption or other trust relationships. This provides a path to full administrative control over the AWS account.

Remediation

1. Enable MFA for the IAM user by following the AWS MFA documentation and enforce strong password policies using the IAM password policy settings.
2. Review and restrict trust relationships that allow the user to assume administrator roles, and apply permission boundaries to limit escalation paths.