VIEW RULE IN DATADOG VIEW IDENTITY RISKS

Description

In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given role can use sts:AssumeRole to assume a role with administrative privileges in the same account inside your AWS Organization. By assuming this more privileged role, an adversary can leverage their permissions for further access.

Rationale

The identity which triggered this detection can assume a role with administrative privileges, giving them access to the privileges of that role.

Remediation

Datadog recommends reducing the permissions attached to an IAM role to the minimum required for the role to fulfill its function. To remediate the issue, either remove the sts:AssumeRole permission entirely, or modify the resource specified in the IAM policy.