Datadog Cloud Security Identity Risks

What Datadog Cloud Security Identity Risks is

Datadog Cloud Security Identity Risks is a cloud entitlement management product that scans infrastructure for identity risks and helps mitigate IAM-based attacks. It covers AWS, Azure, and GCP, detecting issues such as lingering administrative privileges, privilege escalation, permission gaps, large blast radii, and cross-account access. Detection includes users, roles, groups, policies, EC2 instances, and Lambda functions. Access Insights shows what resources an entity can reach and which principals can reach it directly or indirectly. For remediation, it suggests narrower policies, links to cloud consoles, and supports Datadog Workflows. Teams can also use Terraform-generated GitHub pull requests or Jira issues. In AWS, IAM Access Analyzer can contribute unused-access findings for policy recommendations and permission-gap detections. The usual permissions-gap window is 90 days; AWS IAM Access Analyzer can be configured for longer periods such as 180 or 360 days. Scanning is agentless, and the product page says snapshots are not sent outside the customer environment. IAM Access Analyzer may add AWS cost when first enabled, and its findings can take up to two hours to appear in Datadog. Cloud Security Management Pro is listed at $10 a month per CSM host; Enterprise is $25 a month per CSM host. A 14-day trial covers Datadog's product suite.

Who it suits

It suits teams managing identity and permissions risks across AWS, Azure, or GCP environments. Teams using AWS IAM Access Analyzer or Datadog remediation workflows may find the listed integrations relevant.

Limits

The standard permissions-gap detection window is 90 days. AWS IAM Access Analyzer can be configured for longer periods such as 180 or 360 days, but enabling it for the first time has an additional AWS cost and insights can take up to two hours to appear in Datadog.

Getting started

1. Open the Datadog Cloud Security website.
2. Start the advertised 14-day free trial of the Datadog product suite.
3. Use the web product with AWS, Azure, or GCP cloud infrastructure.
4. For AWS unused-access findings, enable IAM Access Analyzer, accounting for its additional AWS cost.

Verdict

Identity Risks combines cross-cloud detection with visibility into access paths and several remediation routes. Consider its host-based pricing and the additional AWS cost and delay associated with IAM Access Analyzer.