🎫 Honeytoken Access Key

Fake IAM access keys/SAS tokens seeded in repos, CI/CD, SSM.

→ Explore in ATT&CK matrix (19 mappings) Deployment detail

What it is

A real cloud access key for an identity that holds no permissions, planted where real keys leak: environment files, credential files on build hosts, CI/CD variables and parameter stores. Attackers harvest keys because one valid key can open a whole account. The key grants nothing, but every call made with it, including a denied one, is logged under its key ID, so any use at all is the alert.

Implementation requirements

AWS: create an IAM user with no policies attached, then aws iam create-access-key. Azure: a client secret for an app registration with no role assignments. GCP: a key for a service account with no IAM bindings
Seed where real keys leak: .env files, ~/.aws/credentials on build hosts, CI/CD variables, Parameter Store, internal repositories. Use one key per location, so the alert says which location was read
Monitoring: every AWS call signed with the key, including denied calls, is recorded in CloudTrail with the key's access key ID. Alert on any event for that ID, not on a threshold. Azure: service principal sign-in logs for the app. GCP: Cloud Audit Logs naming the service account; enable Data Access logs so reads are recorded too
Known limit: anyone holding the key ID can learn its AWS account ID with sts:GetAccessKeyInfo without ever using the key. The owning account must look like one of yours
Do not publish these keys on public sites: AWS can attach AWSCompromisedKeyQuarantineV3 to exposed keys and open a support case. Public lures belong to D055
Safety: the identity grants nothing. OPSEC: rotate decoy keys on the same schedule as real ones, because a key years older than all others stands out
Rollback: Deactivate, then delete the access key and the decoy IAM user (or the service-account key or app secret). Remove every planted copy, using the per-location record kept at deployment.
Upkeep: Rotate on the same schedule as real keys and re-plant. Monthly proof-of-life: one call with the key from a test host.

Technologies

AWSCI/CDAzureGCP

ATT&CK coverage 19

Technique	Tactic	Status	Confidence	Tier
T1213.003 Code Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.003 Code Repositories as an adversary behaviour.
T1040 Network Sniffing	Credential Access	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Automating the Injection of Believable Decoys to Detect Snooping — Peer-reviewed prototype that injects believable bait traffic (credentials) into a campus wireless network to expose eavesdroppers; believability confirmed by a user study. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1040 Network Sniffing as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1040 to its Lures activity.
T1110 Brute Force	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014 'Honeytoken authentication activity': any authentication activity by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1110 to Lures: brute force against artefacts that hold no valid credentials wastes the attacker's effort.
T1552 Unsecured Credentials	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted in public GitHub repositories were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in nine kinds of cloud resource were found and used; GitHub keys within 2 minutes, S3 within 8 hours. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1552 to its Lures activity.
T1552.001 Credentials In Files	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.001 Credentials In Files as an adversary behaviour.
T1552.004 Private Keys	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.004 Private Keys as an adversary behaviour. A decoy private key fires when used to log in to a honeypot; no source covers decoy keys specifically.
T1552.005 Cloud Instance Metadata API	Credential Access	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Tracebit for AWS — canary resources and credentials — Deploys canary credentials on EC2 instances. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.005 Cloud Instance Metadata API as an adversary behaviour. Not specifically through the metadata service.
T1649 Steal or Forge Authentication Certificates	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Azure login certificate token: a fake certificate and config that alert if anyone uses them to log in to Azure. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1649 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1649 Steal or Forge Authentication Certificates as an adversary behaviour.
T1496 Resource Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero (474 miners tracked). Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On the Kubernetes honeypot, nearly all attacks aimed solely to run XMRig. MITRE ATT&CK Enterprise v20.0 — T1496.001: TeamTNT, Kinsing and Hildegard mine cryptocurrency on Docker and Kubernetes.
T1496.001 Compute Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1496.001 Compute Hijacking as an adversary behaviour.
T1078 Valid Accounts	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078.001 Default Accounts	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1078.001 Default Accounts as an adversary behaviour. No source covers decoy default accounts specifically.
T1078.004 Cloud Accounts	Initial Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1078.004 Cloud Accounts as an adversary behaviour.
T1550 Use Alternate Authentication Material	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550 Use Alternate Authentication Material as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1550 to its Lures activity.
T1078 Valid Accounts	Persistence	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1098.001 Additional Cloud Credentials	Persistence	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. Microsoft Entra security operations for applications — Microsoft Entra audit logs record credentials added to existing applications. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.001 Additional Cloud Credentials as an adversary behaviour.
T1098.004 SSH Authorized Keys	Persistence	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the container honeypot generated SSH keys and added them to the host's authorized_keys for persistence. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.004 SSH Authorized Keys as an adversary behaviour.
T1078 Valid Accounts	Privilege Escalation	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078 Valid Accounts	Stealth	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Palo Alto Networks Unit 42 2023 industry
AWS API Keys token — Canarytokens documentation — Thinkst Applied Research industry
2023 Honeypotting in the Cloud Report — Orca Security 2023 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
GitGuardian Honeytoken — core concepts — GitGuardian industry
Tracebit for AWS — canary resources and credentials — Tracebit industry