VIEW RULE IN DATADOG

Description

An IAM role with privilege-escalation capability can be assumed by a third party. This configuration allows an external AWS account to assume a role that can escalate its permissions to gain administrative access to your AWS environment. The third party, or an attacker who compromises the third-party account, can assume this role and leverage privilege escalation permissions to achieve full administrative control. Common escalation paths include creating access keys for privileged users, attaching administrator policies, or assuming administrator roles.

Remediation

1. Apply IAM security best practices to follow the principle of least privilege and remove unnecessary privilege-escalation permissions.
2. Review and manage IAM roles to ensure only trusted accounts can assume the role, and require external ID for third-party access.