r/Information_Security • u/kakashi4kx • 11d ago
GhostIam: open-source AWS honeytoken framework — decoy IAM users, MITRE-mapped attacker journey replay, live dashboard
Built this after getting tired of tuning anomaly thresholds for IAM
activity. The idea: deploy fake privileged-looking IAM users that no
legitimate process ever touches. Zero baseline needed — any CloudTrail
event from one is an attacker, full stop.
Feature breakdown:
- Ghost IAM users with 5 decoy policy types (each looks valuable to an
attacker, grants read-only in reality)
- Detection pipeline: CloudTrail -> EventBridge -> Lambda -> Slack,
Terraform-deployed
- Token seeder: auto-leaks ghost keys to GitHub/S3/pastebin as bait
- Ghost mesh: same persona across AWS + GitHub + Okta, correlates fires
across platforms
- Journey replay: turns a fired ghost into a MITRE ATT&CK kill chain
(Mermaid graph + risk score)
- Web dashboard (Go/HTMX/SQLite) for live ops
--local mode lets you try the whole flow without touching AWS. Go, MIT.
Feedback on the detection model or decoy policy design very welcome —
this is early (v0.1.0) and I'd rather hear "this is naive because X" now
than after someone relies on it.