AWS IAM user can update the trust policy for a role with administrative privileges

Documentos > Datadog Security > OOTB Rules > AWS IAM user can update the trust policy for a role with administrative privileges

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given user can use iam:UpdateAssumeRolePolicy to modify an existing trust policy for an IAM role with administrative privileges. By modifying the role trust policy, an adversary could assume that role and leverage their privileges.

Rationale

The identity which triggered this detection can update the trust policy for a role with administrative privileges, giving them access to the privileges of that role.

Remediation

Datadog recommends reducing the permissions attached to an IAM user to the minimum required for the user to fulfill their function. To remediate the issue, either remove the iam:UpdateAssumeRolePolicy permission entirely, or modify the resource specified in the IAM policy.