Stolen AWS keys are a common path into cloud accounts. They show up in Git history, laptop disk images, CI logs, and leaked .env files. An AWS IAM honeytoken is a decoy access key that should never be used by your team. First use is the detection.
HorasEye hosts the IAM user and keys. You copy a profile into ~/.aws/credentials, an AMI, a runbook, or a "break glass" note. There is no agent and no change to your own AWS accounts beyond planting the decoy where attackers look.
Where to plant it
- Decoy profile on staging jump hosts and golden AMIs
- Backup copies of credential files in shared drives
- Internal wikis that describe "legacy AWS access"
- Next to supply-chain secrets in a fake .env so a scraper takes both
Related cloud decoys
On Pro you can also create a decoy S3 bucket with a name you choose. Team adds AWS Bedrock API keys and Azure login certificates. DNS and HTTP honeytoken tripwires remain useful when you want a callback without a live cloud principal.