AWS IAM user can assume a role with administrative privileges cross-account
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Description
In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given IAM user can use sts:AssumeRole to assume a role with administrative privileges in a different account inside your AWS Organization. By assuming this more privileged role, an adversary can leverage their permissions for further access.
Rationale
The identity which triggered this detection can assume a role with administrative privileges in a different account of your AWS Organization, giving them access to the privileges of that role.
Datadog recommends reducing the permissions attached to an IAM user to the minimum required for the user to fulfill its function. To remediate the issue, either remove the sts:AssumeRole permission entirely, or modify the resource specified in the IAM policy.
