AWS HONEY TOKENS: THE GOOD, THE BAD, AND THE UGLY

Summary from the TLDR InfoSec newsletter

AWS honey tokens are AWS Access Keys strategically placed across a system and used as a digital tripwire to determine when an attack has breached the system. The Canarytokens project by Thinkst is an open-source implementation that utilizes two Lambda functions to create a honey token system that notifies users via CloudWatch of any token usage. This project has two drawbacks: it uses an easily identifiable naming scheme for generating tokens, and it only appends a timestamp when the event is received by CloudWatch, which will have a delay that can hamper event correlation.