Pathrunner Maps AWS IAM Paths to Other Identities’ Credentials

Datadog Security Labs released pathrunner on October 20 to test how credentials for one AWS IAM identity can lead to another identity’s credentials. Its demonstration starts with a held IAM user identity, selects a reachable target, captures the target’s credentials and validates access as that target. The framework has more than 80 modules. For an AWS team, exposure depends on the permissions reachable from a specific starting identity.

Inventory the workload and operator identities that can serve as starting points. Review the permissions and trust relationships leading to sensitive target identities; remove unnecessary grants, apply conditions or guardrails, and prefer temporary credentials as AWS recommends. In a sanctioned, scoped test, record the starting and target principals and the expected actions. Datadog’s workspace report lists CloudTrail events it predicts. Compare those entries with actual CloudTrail records by account, Region, principal, action and time; AWS Event history covers 90 days of management events per account and Region, so use configured trails or event data stores for other event types or longer retention. After changing policy, repeat the access test and verify the unwanted target is no longer reachable while legitimate work still succeeds. Remove resources created during the exercise.