- 필수 기능
- 시작하기
- Glossary
- 표준 속성
- Guides
- Agent
- 통합
- 개방형텔레메트리
- 개발자
- API
- Datadog Mobile App
- CoScreen
- Cloudcraft
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- APM
- Continuous Profiler
- 스팬 시각화
- 데이터 스트림 모니터링
- 데이터 작업 모니터링
- 디지털 경험
- 소프트웨어 제공
- 보안
- AI Observability
- 로그 관리
- 관리
In AWS environments, some IAM permissions can lead to privilege escalation, where an identity can gain access to another more privileged identity. This rule identifies when a given user can use iam:UpdateLoginProfile to modify an existing login profile for an IAM user with administrative privileges. By creating a new login profile for another user, an adversary could log in as that user and leverage their privileges.
In this scenario, there exists at least one privileged IAM user in the account who has a login profile set. The identity which triggered this detection can modify a login profile for that IAM user, giving them access to the privileges of the compromised user.
Datadog recommends reducing the permissions attached to an IAM user to the minimum necessary for the user to fulfill their function. To remediate the issue, either remove the iam:UpdateLoginProfile permission entirely or modify the resource the IAM policy specifies.
