Privilege escalation detected

Scenario

GuardDuty detected someone elevating their privileges

How do I investigate?

Team Discussion

  • What could be put in place to prevent someone from escalating their permissions?
  • Should all environments have the same permissions?

Resources