AWS IAM group can update the trust policy for a role with administrative privileges

문서 > Datadog 보안 > OOTB Rules > AWS IAM group can update the trust policy for a role with administrative privileges

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given group can use iam:UpdateAssumeRolePolicy to modify an existing trust policy for an IAM role with administrative privileges. By modifying the role trust policy, an adversary could assume that role and leverage their privileges.

Rationale

The identity which triggered this detection can update the trust policy for a role with administrative privileges, giving them access to the privileges of that role.

Remediation

Datadog recommends reducing the permissions attached to an IAM group to the minimum required for the group to fulfill its function. To remediate the issue, either remove the iam:UpdateAssumeRolePolicy permission entirely, or modify the resource specified in the IAM policy.