A canary credential, or AWS honeytoken, is a real AWS access key that can do nothing and that nobody legitimate will ever use. You plant it where an attacker looks for credentials. When someone uses it, CloudTrail records the call and you get an alert that carries very little doubt, and that points at exactly one place: wherever you planted that key. This guide builds one from scratch in Terraform, explains the AWS details that most write-ups get wrong, and compares the free and commercial alternatives honestly.

The short version

Create an IAM user with no console access, an explicit deny-all policy and one access key.

Alert on any CloudTrail event from that user. If you use EventBridge, the rule needs state = "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS" (AWS provider 5.27.0 or later).…