The role that can do anything
and has done one thing since March.
Datadog Cloud Infrastructure Entitlement Management compares what every cloud identity was granted with what it has used, and shows the path from a leaked credential to an administrator. We implement it inside the Datadog you already run, decide with you which identities get narrowed first, and operate it every month so each permission gap closes in code rather than in a console.
Quick facts
Related
- Cloud Security, the group this belongs to
- Access Control, the same discipline applied to Datadog itself
- Secret Scanning, the credential before it leaks
What each identity can do, what it has done, and the distance between the two
A service role granted a wildcard during a migration is still carrying it two years later, and the only record of why is a commit message. Entitlement management reads every identity through the cloud integration, measures what it has used, and turns the difference into a finding with a proposed policy attached.
The permission gap, measured. Provisioned permissions against exercised permissions, over ninety days by default and longer with AWS IAM Access Analyzer connected. The role that uses a tenth of what it holds is a finding, with the unused tenth listed.
Lingering admin and the path to it. Identities that still hold administrative privilege, the escalation routes that reach it, and the blast radius of each. Access Insights answers the question an access review asks: who can reach this resource today, and through which identity.
The identities that are not people. Users, roles, groups and policies, and the compute identities attached to EC2 instances and Lambda functions. Cross-account access is listed, so the vendor role granted at onboarding is visible rather than assumed.
A fix that goes through the pipeline. A downsized policy based on actual usage, a pull request against the Terraform that defines the identity, a ticket to the owning team, or a Workflow Automation with an approval step. The console is for looking, not for changing.
A ninety-day window, a pipeline role nobody dares touch, and a fix applied in the console
How it bills. Identity risk detection is part of Datadog Cloud Security and is included in both plans, CSM Pro and CSM Enterprise, which are billed per host protected. It is agentless, so it adds no Agent hosts of its own. Two optional sources carry their own cost. CloudTrail logs forwarded to Datadog for permission analysis count on the log ingestion meter, and on the indexing meter if they are indexed. AWS IAM Access Analyzer, if enabled, bills on the AWS side and takes up to two hours before its findings appear in Datadog. Datadog publishes the meters and rates. We decide with you whether the optional sources earn their place before either is switched on.
The configuration traps. The default ninety-day usage window applied to every identity, including the ones that are exercised once a year on purpose. Findings routed to a security channel when the identity belongs to a platform team, so the owner never sees it. The downsized policy applied in the console rather than in the Terraform that created the role, so the next apply restores the original. Cross-account access from a partner labelled as such and read as approved, when nobody has reviewed it since the partnership began.
Field noteThe most common gap we see is the access key older than the team. It belongs to a user nobody can place, it is still exercised nightly by something, and the finding stays open because narrowing it means finding out what breaks.
Field noteThe disaster recovery role is exercised once a year, deliberately. Under a ninety-day window every permission it holds looks unused, the finding is dismissed as wrong, and the dismissal spreads to the rest of the list that was right.
Field noteThe pattern we keep finding is the fix applied in the console. The policy is narrowed by hand, the finding closes, and the next Terraform apply puts the wildcard back. The finding reopens a week later and is read as a tool error.
Field noteCross-account roles granted to a vendor during onboarding are the longest-lived findings. The contract was renewed, the scope of the role was not reviewed, and the role still carries what the first integration needed rather than what the current one does.
Usage data first. Windows per identity type. Fixes through the pipeline that built the role.
Entitlement management is delivered inside the Cloud Security Accelerator, four weeks and fixed scope, alongside the other Cloud Security capabilities you have chosen. If Datadog is new to the estate, LaunchPad runs the platform rollout first. The identity sequence is the same either way.
- Connect every account with resource collection on. AWS, Azure and Google Cloud, through the integration role, read-only. An account that is not connected is an account whose identities are not reviewed.
- Decide the usage sources. Whether CloudTrail logs are forwarded for permission analysis, and whether IAM Access Analyzer is connected. Weigh each against the log meters and the AWS bill.
- Classify the identities. Human users, pipeline roles, compute identities and vendor cross-account roles, each with an owner and a usage window that matches how it is used. The recovery role gets the long window.
- Route by owner, not by severity. A pipeline role's finding goes to the platform team. A vendor role's finding goes to whoever owns the contract. Findings on identities in the runtime we operate come to us.
- Narrow the first set, in code. The highest blast radius identities first. Downsized policies reviewed with the owner, raised as pull requests against the Terraform, applied through the pipeline, confirmed closed on the next scan.
- Hand over, in writing. Accounts in scope, usage sources enabled, identity classes and their windows, accepted exceptions with reasons and expiry, and the open findings on the day we finished.
Access is admin on the Datadog organisation and read-only on the cloud accounts. Narrowing a policy is a change to your identity configuration, so it goes through your pull request review and your pipeline, with your approval, every time.
Permissions widen for a reason and narrow only on purpose
A role is widened for a migration and the migration ends. A new vendor is given cross-account access. A compute identity inherits a policy meant for a person. Managed Observability is the monthly service that keeps the identity findings, the exceptions and the scope matching the estate as it is now.
Every month, the new identity risks are triaged. Lingering admin, new permission gaps and new cross-account access, each against the exceptions on file. Identities in the runtime we operate are narrowed by us, in code. The rest go to their owner with the usage evidence attached.
Scope follows the accounts and the vendors. New accounts are connected when they appear. New cross-account roles are reviewed when they are granted, not when the partnership is next renewed.
Exceptions are kept honest. Every accepted exception has a reason and an expiry, and is renewed or removed when it falls due. The usage windows per identity class are re-checked, so the recovery role is never reported as abandoned.
The access review writes itself. What each identity holds, what it used, what was narrowed and when, with the pull requests as the record. When the auditor asks for least privilege, the answer is a history rather than a policy.
We operate the stack. You own the product.
We are not a security company, and we do not pretend to be. We are a managed runtime operator. We run the identity risk tooling inside your Datadog and keep the usage data flowing from every account. We narrow the identities that sit in the runtime we operate, and route the rest with the proposed policy and the evidence attached. Who is allowed to do what remains your decision, made in your pipeline. We operate and evidence the runtime controls that support your compliance obligations.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog Cloud Infrastructure Entitlement Management, answered plainly
What does Datadog CIEM actually find?
Identity risks across AWS, Azure and Google Cloud: lingering administrative privileges, privilege escalation paths, permission gaps between what an identity was granted and what it has used, large blast radii, and cross-account access. It covers users, roles, groups and policies, and the compute identities attached to EC2 instances and Lambda functions. Each finding shows what the identity can reach and which principals can reach it, which is the view that turns a list of roles into a decision about which ones to narrow.
How is Datadog Cloud Infrastructure Entitlement Management billed?
Identity risk detection is part of Datadog Cloud Security and is included in both plans, CSM Pro and CSM Enterprise, which are billed per host protected. It is agentless, so it adds no Agent hosts of its own. Two optional sources add cost elsewhere: CloudTrail logs forwarded to Datadog for permission analysis count on the log ingestion meter, and on indexing if they are indexed, and AWS IAM Access Analyzer, if enabled, bills on the AWS side. Datadog publishes the meters and rates. We do not publish prices. We do decide with you which accounts are in scope and whether the optional sources earn their place.
How does Datadog know a permission is unused?
It compares the permissions an identity was provisioned with against the permissions it has exercised, over a ninety-day window by default. A role that uses a tenth of what it holds is a permission gap. With AWS IAM Access Analyzer connected, the window can be extended to a hundred and eighty or three hundred and sixty days. That matters for identities that are used rarely but legitimately, such as a disaster recovery role. The window is an implementation decision, and the wrong one produces findings that get dismissed along with the real ones.
Can Datadog fix an over-privileged role for us?
It proposes the fix. For each identity it shows a downsized policy based on actual usage, and for identities managed in Terraform it can locate the code, identify the owners and raise a pull request. It can also open a ticket or run a Workflow Automation, with or without a human approval step. The change itself is reviewed and applied by whoever owns the identity, through the same pipeline that created it, so the next apply does not put the old policy back. Where the identity sits in the runtime we operate, that is us.
What does Critical Cloud do with Cloud Infrastructure Entitlement Management every month?
Managed Observability reviews the new identity risks, confirms or expires each accepted exception, adds new accounts to scope, and checks that the permission usage data is still flowing from every account. Identities in the runtime we operate are narrowed by us, in code, with the downsized policy as the starting point. The rest go to a named owner with the usage evidence and the proposed policy attached, and we report what was found, narrowed and routed.
- Datadog products: every product, and how we implement and run each one
- Cloud Security: the group, with identity alongside posture, vulnerabilities, compliance and workload protection
- Access Control and Secret Scanning: least privilege inside Datadog, and the credential caught before it leaks
- Cloud Security Accelerator: scope, rules, routing and the first triage, in four weeks
Every identity measured. Every gap closed in code.
Tell us how many cloud accounts you have and when the next access review is due. We will show you what entitlement management would find, which identities to narrow first, and what it takes to keep them narrow.