---
title: >-
  IAM user with console access without MFA can assume administrator privileges
  in an account with a weak password policy
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM user with console access without
  MFA can assume administrator privileges in an account with a weak password
  policy
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM user with console access without MFA can assume administrator privileges in an account with a weak password policy

## Description{% #description %}

An IAM user with console access without MFA can assume administrator privileges in an AWS account with a weak password policy. The weak password policy combined with the absence of MFA means an attacker who compromises the user's credentials can authenticate to the console and reach administrator principals through role assumption or other trust relationships. This provides a path to full administrative control over the AWS account.

## Remediation{% #remediation %}

1. Enable MFA for the IAM user by following the [AWS MFA documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html).
1. Update the account password policy in the [IAM password policy settings](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) to meet the criteria this detection evaluates, which follow [NIST SP 800-63B Revision 4](https://pages.nist.gov/800-63-4/sp800-63b.html):
   - Set a minimum length of at least 15 characters.
   - Don't require character composition (uppercase, lowercase, numbers, or symbols).
   - Don't require password expiration.
1. Review and restrict trust relationships that allow the user to assume administrator roles, and apply permission boundaries to limit escalation paths.