🔑 Honey Cloud Account

Entire decoy cloud account in organization for deep engagement.

→ Explore in ATT&CK matrix (7 mappings) Deployment detail

What it is

An entire decoy account, subscription or project inside your real cloud organisation — the highest-fidelity form of cloud deception and the most expensive to run. Because it is a genuine member of the organisation, it is reachable through the same trust relationships an attacker would use to move laterally, and everything inside it is instrumented. It is built for deep engagement: you let an intruder operate and you watch, rather than tripping one alert and evicting them.

Implementation requirements

AWS: dedicated member account in AWS Organizations, in its own OU, with service control policies bounding the blast radius
Azure: separate subscription under a dedicated management group with its own policy assignments
GCP: separate project in the organisation, under a folder with its own constraints
Full audit capture routed out of the account to log storage the decoy account itself cannot write to or delete
Populate it with enough plausible resources to survive inspection — an empty account is obviously a trap
Isolate identity and networking completely: no trust path from the decoy back into production, and no shared credentials
OPSEC and legal: deep engagement means an intruder operates inside your estate under observation. Agree containment and eviction criteria with legal and incident response before deploying, not during an incident
Rollback: Take evidence snapshots, then close the account, subscription or project through your organisation's normal process; providers can keep a closed account recoverable for a period. Remove the trust links that made it reachable.
Upkeep: Keep resources, activity and cost looking alive, and rotate any credentials inside. Monthly proof-of-life touch of one decoy resource.

Cost

The highest of any technique in the framework, and the only one where compute and storage dominate rather than logging. Budget for the decoy resources you deploy, full audit-log capture, and any threat-detection services you enable in the account. Size it deliberately: an F5 environment can cost more than the rest of a deception estate combined.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

AWSAzureGCP

ATT&CK coverage 7

Technique	Tactic	Status	Confidence	Tier
T1482 Domain Trust Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) 4662(S, F) An operation was performed on an object — Event 4662 records operations on an Active Directory object that carries a SACL. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1482 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1482 Domain Trust Discovery as an adversary behaviour.
↳ As T1207 — industry-plausible, no dedicated paper.
T1199 Trusted Relationship	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1199 Trusted Relationship as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1199 to its Lures activity. No study or product shows honey cross-account roles; the AssumeRole call on the decoy role is logged.
T1021.007 Cloud Services	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1021.007 Cloud Services as an adversary behaviour.
T1136 Create Account	Persistence	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1136 Create Account as an adversary behaviour. The honey credential fires on its first API call; inside a honey cloud account, account creation is seen in-decoy.
T1136.003 Cloud Account	Persistence	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1136.003 Cloud Account as an adversary behaviour.
T1556.007 Hybrid Identity	Persistence	theoretical	weak	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556.007 Hybrid Identity as an adversary behaviour. No audit signal sourced for hybrid-identity tampering on a decoy.
T1484 Domain or Tenant Policy Modification	Privilege Escalation	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1484 Domain or Tenant Policy Modification as an adversary behaviour.

Evidence

Decoy Environment (D3-DE) — MITRE D3FEND standard
Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation — Manivannan, M.; Alharthi, D., arXiv:2607.24006 2026 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Palo Alto Networks Unit 42 2023 industry

Research basis: MITRE D3FEND D3-DE (Decoy Environment). "Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation" (arXiv, 2026) covers the automated-investigation form of this pattern.