IAM Credential Canaries: Catch Leaked Laptop Keys Before Prod Blast Radius

Laptop .env files, copied AWS profiles, and “temporary” access keys still show up in git history and chat pastebacks. By the time CloudTrail shows a strange AssumeRole from an unexpected ASN, the blast radius may already include S3 dumps and IAM mutations. Credential canaries flip the economics: you plant keys that should never be used, then page hard on first touch.

⚡ TL;DR: Create dedicated canary IAM users/keys with zero production permissions, tagged and monitored via CloudTrail Lake + EventBridge. Alert on any GetCallerIdentity, ListBuckets, or STS call from those principals. Rotate and re-plant quarterly. Pair with CloudTrail Lake With AI, Secret-Aware Context Filters, and IAM Access Analyzer.

Why canaries beat hope-based scanning

Secret scanners catch many commits; they miss clipboard leaks, zip uploads to personal drives, and keys sitting in old CI runners. A canary key is a tripwire: if anyone authenticates with it, you know material left your control—even when scanners stayed quiet.

Plant canary AKIA... in:
  - decoy .env.example variants (never real prod)
  - unused AWS_PROFILE blocks on gold images
  - honeytoken files in shared drives (policy-approved)

On first CloudTrail event for canary principal:
  -> EventBridge rule -> SNS/PagerDuty sev-2
  -> auto-disable key + open incident ticket

✅ Canary principal has Deny * on everything except optional no-op logging.
❌ Never reuse a canary key as a “real” break-glass credential.

Minimal canary IAM shape

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAllByDefault",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

Attach an inline deny-all policy, disable console login, and tag the user:

aws iam create-user --user-name canary-laptop-env-2026q3 \
  --tags Key=Purpose,Value=credential-canary Key=Owner,Value=security-platform

aws iam put-user-policy --user-name canary-laptop-env-2026q3 \
  --policy-name DenyAll --policy-document file://deny-all.json

aws iam create-access-key --user-name canary-laptop-env-2026q3
# store secret ONLY in the plant locations + sealed vault for rotation metadata

Even with deny-all, authentication attempts still emit CloudTrail events—that is the signal.

Detection: EventBridge on CloudTrail

# EventBridge rule pattern (illustrative)
source: [aws.cloudtrail]
detail-type: [AWS API Call via CloudTrail]
detail:
  userIdentity:
    userName: [canary-laptop-env-2026q3, canary-ci-runner-2026q3]
  eventName:
    - - prefix: ""   # any API call

Prefer an allowlist of canary ARNs rather than event-name filters alone—attackers may probe with GetCallerIdentity first.

// GOOD: Lambda destination that disables the key and pages
import { IAMClient, UpdateAccessKeyCommand } from "@aws-sdk/client-iam";

export async function handler(evt: { detail: any }) {
  const user = evt.detail.userIdentity?.userName;
  const keyId = evt.detail.userIdentity?.accessKeyId;
  if (!user?.startsWith("canary-")) return;
  const iam = new IAMClient({});
  await iam.send(new UpdateAccessKeyCommand({
    UserName: user,
    AccessKeyId: keyId,
    Status: "Inactive",
  }));
  // emit pager + ticket with CloudTrail eventID, sourceIP, userAgent
}

Plant discipline and false positives

Document every plant location in a sealed inventory (not in the same repo as the decoy files). Engineers must never “test” canary keys locally. Exclude canary principals from break-glass runbooks. For AI coding tools, ensure canary material never enters model context—see Secret-Aware Context Filters.

Rotate quarterly: create new keys, update plants, deactivate old keys after a soak. Track plant coverage like any other control: % of gold images and template repos with an active canary.

Closing checklist

• [ ] Canary users exist with deny-all + no console password
• [ ] EventBridge alerts on any CloudTrail auth for canary ARNs
• [ ] First-touch automation disables the key and opens a ticket
• [ ] Plant inventory is sealed; plants are never used for real work
• [ ] Quarterly rotation with coverage metrics
• [ ] AI/IDE secret filters treat canary patterns as secrets

Related reading

• CloudTrail Lake With AI: Detect Risky Console Clicks Immediately
• Secret-Aware Context Filters: Stop AI Editors From Shipping Keys
• IAM Access Analyzer: Verify AI-Generated Policies Before Attach
• Chaos for IAM Boundaries: Prove Apps Fail Closed on Denied Actions

Last updated on September 11, 2026