---
title: IAM role can use role chaining to access sensitive data
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM role can use role chaining to
  access sensitive data
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM role can use role chaining to access sensitive data

## Description{% #description %}

An IAM role can use role chaining to access sensitive data. If an attacker gains access to this role, they can assume one or more other IAM roles in sequence, following a chain of trust relationships to ultimately gain access to resources containing sensitive information such as S3 buckets, RDS databases, or DynamoDB tables. Each step in the chain grants additional permissions until the attacker reaches the target sensitive data.

## Remediation{% #remediation %}

1. [Review and manage IAM role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) to limit role assumption capabilities.
1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) to ensure role chains follow the principle of least privilege.