---
title: IAM role with privilege-escalation capability can be assumed by a third party
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM role with privilege-escalation
  capability can be assumed by a third party
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM role with privilege-escalation capability can be assumed by a third party

## Description{% #description %}

An IAM role with privilege-escalation capability can be assumed by a third party. This configuration allows an external AWS account to assume a role that can escalate its permissions to gain administrative access to your AWS environment. The third party, or an attacker who compromises the third-party account, can assume this role and leverage privilege escalation permissions to achieve full administrative control. Common escalation paths include creating access keys for privileged users, attaching administrator policies, or assuming administrator roles.

## Remediation{% #remediation %}

1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) to follow the principle of least privilege and remove unnecessary privilege-escalation permissions.
1. [Review and manage IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) to ensure only trusted accounts can assume the role, and require external ID for third-party access.