Editor’s note: Datadog CIEM has been renamed Cloud Security Identity Risks to better reflect its expanded capabilities. All references have been updated accordingly.

Identity and access management (IAM) systems are necessary for authenticating and authorizing access to your environment. However, their mismanagement is one of the leading causes of breaches and insider threats today. Engineering teams must rapidly provision identities and permissions to keep pace with infrastructure growth—consequently, the ratio of non-human or machine identities to every human identity is also increasing at a substantial rate. This complexity makes it difficult to keep IAM configurations up to date and protect your environment against IAM-based attacks.

That’s why we’re excited to announce Datadog Cloud Security Identity Risks, a Cloud Infrastructure Entitlement Management (CIEM) solution that enables you to proactively identify and quickly remediate identity and access risks in your AWS environment (with support planned for other cloud providers) before a threat actor can exploit them. In this post, we’ll show you how Cloud Security Identity Risks enables you to secure your infrastructure from IAM-based attacks.

Surface identity risks based on best practices and research

Cloud Security Identity Risks enables you to identify and address identity risks in order to reduce their impact. It accomplishes this by leveraging your environment’s current IAM configuration and resource usage—along with the latest industry best practices and attack vectors—to automatically detect and prioritize identity risks for users, roles, groups, policies, EC2 instances, and Lambda functions. The types of risks that Cloud Security Identity Risks detects include:

• Administrative privileges
• Permissions gaps
• Large blast radius
• Privilege escalation
• Cross-account access

Datadog’s Security Research team routinely curates the list of identity risks that Cloud Security Identity Risks detects so that our users can remain proactive in their defenses as new identity-based risks are identified.

As you sort through your IAM risk findings, you can review individual at-risk resources or address one identity risk at a time by grouping all resources (e.g., users, roles, groups, policies) that carry that risk, as seen in the following screenshot.

Get deeper insights to efficiently mitigate identity risks

For every identified risk, Cloud Security Identity Risks provides a detailed description of the issue and suggested remediation steps. In the following screenshot, Cloud Security Identity Risks has identified several IAM roles with unused permissions, which a threat actor can leverage to gain access to your services and resources.

Cloud Security Identity Risks also provides advanced insights for each identified risk, providing you with additional context for understanding its scope. For example, the following screenshot shows a list of all provisioned permissions for an IAM role that Cloud Security Identity Risks has identified as unused.

In this example, you can see that several permissions have not been used in the recent past. In these cases, you may want to remove the permissions that are no longer necessary for that role. Roles should be assigned permissions based on the principle of least privilege, which recommends granting only the set of permissions that are needed to accomplish a specific task.

You can see AWS’ suggested remediation steps by clicking the “Fix in AWS” button to navigate to the console. Alternatively, you can click “Remediate” to get a suggested downsized policy based on the actual usage.

To create a case and assign the remediation to someone, click on “Create Jira Issue.” To ensure consistent and easy remediation, you can also leverage Workflow Automation to initiate a workflow, with or without human involvement, in response to any identity risk.

Datadog includes several out-of-the-box Workflow Blueprints related to IAM to help you respond to identity-related risks. For example, if you discover an inactive AWS IAM user with excessive privileges, you can initiate a workflow that disables or deletes that user.

Secure your environment with Datadog Cloud Security

Cloud Security Identity Risks is now generally available for organizations using AWS—check out our documentation to get started, or head to the Identity Risks Explorer. You can also check out the Cloud Security documentation for more information about getting started with Datadog Cloud Security. If you don’t already have a Datadog account, you can sign up for a 14-day free trial today.