🔑 Honey IAM Role

Decoy IAM roles with attractive names. Any AssumeRole = confirmed.

→ Explore in ATT&CK matrix (22 mappings) Deployment detail

What it is

A decoy IAM role that looks like it grants privileged access but is configured so it can never actually be assumed. The role name is the bait — something an attacker enumerating roles would prioritise, like a break-glass or deployment role. Because no legitimate workload or person has any reason to call AssumeRole on it, a single attempt is a confirmed intrusion signal with effectively no false-positive rate.

Implementation requirements

AWS: aws iam create-role with an attractive name and a trust policy that denies every principal, so the assume attempt fails but is still logged
Azure: custom RBAC role definition in Entra ID, assigned to no one but discoverable through role enumeration
GCP: gcloud iam roles create plus a service account that holds the role but has no keys and no bindings to real resources
The role must carry zero real permissions — a decoy that actually grants access is a liability, not a tripwire
Monitoring: CloudTrail AssumeRole and AssumeRoleWithSAML denied events, Entra ID audit logs, GCP Cloud Audit Logs. Alert on any hit, not on a threshold
OPSEC: name it using the same convention as your real roles. A role called honeypot-role teaches an attacker how to spot the rest of your decoys
Rollback: Delete the role and any instance profile or binding created for it. Remove its name from detection rules.
Upkeep: Keep its name in step with your real role naming. Quarterly proof-of-life: an assume-role attempt from a test principal.

Cost

Negligible. Roles, custom role definitions and service accounts are free on all three providers. The only ongoing cost is ingestion and retention of the audit logs you alert on.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

AWSAzureGCP

ATT&CK coverage 22

Technique	Tactic	Status	Confidence	Tier
T1110 Brute Force	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014 'Honeytoken authentication activity': any authentication activity by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1110 to Lures: brute force against artefacts that hold no valid credentials wastes the attacker's effort.
T1110.003 Password Spraying	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1110.003 Password Spraying as an adversary behaviour.
T1069.003 Cloud Groups	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1069.003 Cloud Groups as an adversary behaviour. Listing groups does not name the decoy; reading the decoy group itself does.
T1087 Account Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP' fires on reconnaissance against a honeytoken user; Microsoft maps it to T1087 and T1087.002. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1087 to its Lures activity.
T1087.004 Cloud Account	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1087.004 Cloud Account as an adversary behaviour. Listing users does not name the decoy; reading it does.
T1531 Account Access Removal	Impact	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — Procedure examples: Akira deletes administrator accounts; LockerGoga and MegaCortex change account passwords; LAPSUS$ removed global admins. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2427 fires on any attribute change to a honeytoken user, which a password reset or disable makes. Microsoft maps the alert to T1098; its use for T1531 is DOAR's inference. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1531 to its Lures activity.
T1078 Valid Accounts	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078.004 Cloud Accounts	Initial Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1078.004 Cloud Accounts as an adversary behaviour.
T1199 Trusted Relationship	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1199 Trusted Relationship as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1199 to its Lures activity. No study or product shows honey cross-account roles; the AssumeRole call on the decoy role is logged.
T1021 Remote Services	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — A widely used SSH/Telnet honeypot (6.6k GitHub stars) that logs every login attempt and session; deployed internally it records lateral SSH attempts. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1021 to its Lures activity.
T1021.007 Cloud Services	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1021.007 Cloud Services as an adversary behaviour.
T1078 Valid Accounts	Persistence	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1098 Account Manipulation	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.
T1098.001 Additional Cloud Credentials	Persistence	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. Microsoft Entra security operations for applications — Microsoft Entra audit logs record credentials added to existing applications. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.001 Additional Cloud Credentials as an adversary behaviour.
T1098.003 Additional Cloud Roles	Persistence	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.003 Additional Cloud Roles as an adversary behaviour.
T1136 Create Account	Persistence	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1136 Create Account as an adversary behaviour. The honey credential fires on its first API call; inside a honey cloud account, account creation is seen in-decoy.
T1136.003 Cloud Account	Persistence	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1136.003 Cloud Account as an adversary behaviour.
T1078 Valid Accounts	Privilege Escalation	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1098 Account Manipulation	Privilege Escalation	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.
T1484.002 Trust Modification	Privilege Escalation	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1484.002 Trust Modification as an adversary behaviour.
T1548.005 Temporary Elevated Cloud Access	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Tracebit for AWS — canary resources and credentials — Commercial canary IAM roles alert when assumed. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1548.005 Temporary Elevated Cloud Access as an adversary behaviour. Assuming a decoy role is closer to T1078.004; the T1548.005 fit is partial.
T1078 Valid Accounts	Stealth	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
Deceptive defense: best practices for identity-based honeytokens in Microsoft Defender for Identity — Microsoft 2023 industry
Logging management events — AWS CloudTrail User Guide — Amazon Web Services industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Tracebit for AWS — canary resources and credentials — Tracebit industry

Research basis: MITRE D3FEND D3-DUC (Decoy User Credential). Microsoft's identity-honeytoken guidance for Defender for Identity (2024) and the Azure-Sentinel HoneyTokens solution both document this pattern in production form.