Cloud Decoy Deployment
Plant decoy cloud credentials and storage that alert the SOC the moment someone touches them
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
This skill guides an AI agent through setting up fake cloud resources on AWS, Azure, and GCP, such as dummy access keys, unused user accounts, empty storage buckets, and fake secrets. Nobody legitimate should ever use these decoys, so any access to them is a strong signal of an attacker and triggers an alert to the security team. It also includes a Python script that checks an inventory of decoys for required safety controls and produces a deployment record.
Great for
- Cloud security engineers who want tripwires in AWS, Azure, or GCP accounts
- Security teams that only run on-prem honeypots and need cloud coverage
- Blue teams preparing detection and incident response playbooks for cloud breaches
Skip it if
- Teams without audit logging (CloudTrail, Azure Activity logs, GCP Cloud Audit Logs) enabled, since the alerts depend on them; enabling them first is required
- Anyone expecting a turnkey product: the commands are examples that must be reviewed and adapted to the account before running, and running them creates real cloud resources and costs
- Environments where decoy credentials could be mistaken for live ones by automated tools or staff, which can cause outages or confusion if not clearly labelled
Try asking
- “Set up a canary AWS access key on a permission-less IAM user with an EventBridge alert to SNS”
- “Create a honey S3 bucket with object-level logging and an alert on reads”
- “Plant a decoy GCP service account key and a Cloud Monitoring alert for its use”
- “Check my decoy inventory JSON for missing detection wiring or deny-all policies”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
deploying-cloud-deception-with-decoy-resources.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip deploying-cloud-deception-with-decoy-resources.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip deploying-cloud-deception-with-decoy-resources.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review every CLI command before running it: they create real IAM principals, buckets, secrets, and keys in your cloud account, and planting keys in code or CI variables should be done deliberately.
- Keep decoys permission-less (explicit deny-all) and tag them internally with deception=true, but keep those tags out of attacker-visible metadata.
- Run the validator script on a decoy inventory file and test alert latency with a red-team exercise before relying on the detections.
What's inside
- assets/template.md
- references/standards.md
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.