🏗️ Honey CloudFormation Stack

Decoy IaC stacks for infra recon detection.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

An infrastructure-as-code stack named like core infrastructure that deploys only decoy resources. Attackers read stack templates to learn how an environment is built and where its secrets live. Reading the decoy template, or changing or deleting the stack, are logged events that name it.

Implementation requirements

AWS: a CloudFormation stack (or an equivalent Terraform state or Azure deployment) named like core infrastructure, deploying only decoy resources (D015, D020)
Monitoring: GetTemplate and GetTemplateSummary on the decoy stack are read events that name it. UpdateStack, DeleteStack and drift operations on it are logged writes. DescribeStacks lists every stack and does not single out the decoy
Template parameters and outputs can point to honeytokens, so the template becomes a breadcrumb (D040)
Safety: the stack's service role can only manage the decoy resources. OPSEC: tags, stack policy and update history like real stacks
Rollback: Delete the stack, which removes its decoy resources. Delete the stack's service role.
Upkeep: Update the template occasionally, so its history looks alive. Quarterly proof-of-life GetTemplate.

Technologies

AWSAzure

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.
T1580 Cloud Infrastructure Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: creates decoy S3 buckets, SQS queues, SSM parameters, Secrets Manager secrets and DynamoDB tables, and alerts when an attacker interacts with them. Logging management events — AWS CloudTrail User Guide — Describe and Get calls are read management events, logged when read events are enabled. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1580 to its Lures activity. Moderate: a plain List call does not name the decoy. The alert fires when the attacker queries the decoy resource itself, which the token documentation does not break down by API call.
T1651 Cloud Administration Command	Execution	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1651 as feasible (medium) for infrastructure deception. Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1651 Cloud Administration Command as an adversary behaviour.
T1490 Inhibit System Recovery	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — In cloud environments adversaries delete snapshots, database backups and machine images. Logging management events — AWS CloudTrail User Guide — Delete operations are write management events, logged by trails by default, so deleting a decoy snapshot leaves a record naming it. Moderate: behaviour and log signal are documented; no study or product shows honey snapshots specifically.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard