AWS EC2 instance can create access keys for an IAM user with administrative privileges

문서 > Datadog 보안 > OOTB Rules > AWS EC2 instance can create access keys for an IAM user with administrative privileges

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when an EC2 instance has an IAM role that can use iam:CreateAccessKey to create new access keys for an IAM user with administrative privileges. By creating a new access key pair for another user, an adversary could use those credentials to operate as that user and leverage their privileges.

Rationale

The identity which triggered this detection can create an access key pair for an IAM user with administrative privileges, giving them access to the privileges of the compromised user.

Remediation

Datadog recommends reducing the permissions attached to an EC2 instance to the minimum required for it to fulfill its function. To remediate the issue, either remove the iam:CreateAccessKey permission entirely or modify the resource specified in the IAM policy.