# Tutorial: catch a stolen cloud key

> **Status: Partial / not production-wired.** All six cloud/identity audit
> Plugins currently use stub clients. **TestConnection cannot succeed** in
> production, and hits do not yet reach Investigate. Use this tutorial for the
> intended Ops workflow and for **unit-test fixture** paths. See
> [cloud-identity-canary-plugins.md](../how-to/cloud-identity-canary-plugins.md).

Lab walkthrough (intended): issue a decoy AWS key → enable CloudTrail Plugin →
simulate validation → Investigate. Use disposable cloud/lab credentials for the
**Ops** Plugin only.

## 1. Prerequisites

- Ops GUI with Plugins catalog
- Lab AWS account **or** fixture mode in unit tests (required today)
- Read [cloud-identity-canary-plugins.md](../how-to/cloud-identity-canary-plugins.md)

## 2. Issue a decoy key

In Ops, plant kind `decoy_cred_aws` at a unique location (e.g.
`ci/secrets/LAB_AWS_KEY`). Copy the one-time AKIA-shaped token. It is
non-authorizing and must not be a real deploy key from `engine/cloud`.

## 3. Enable CloudTrail Plugin

1. Ops → Plugins → **AWS CloudTrail Decoy Watcher** (`cloudtrail-audit`)
2. Store lab `access_key_id` / `secret_access_key` / `region` in the Ops secret
   store (never on the sensor compose)
3. **TestConnection**: fails closed today (stub client). Do not treat a
   successful arming as “live CloudTrail watch is online” until a real client
   is injected.

## 4. Simulate validation

Today: exercise the catalog fixture parser in unit tests (same normalization
path). Live `GetCallerIdentity` → CloudTrail → Plugin → Investigate is not
end-to-end wired yet.

## 5. Investigate (future)

When live clients and hit linkage ship, expect an `intel.alert.v2` hit with:

- `decoy_key_id` matching the issued AKIA
- `asset_criticality: CRITICAL_SHARED_INFRASTRUCTURE`
- advisory `recommended_containment` (not executed by CHN)

Confirm SOAR consumers treat containment as advisory and refuse auto
`ISOLATE_HOST` for critical shared infrastructure.

## 6. Tear down

Revoke the decoy (tombstone), disable the Plugin if the lab is finished, and
rotate Ops audit credentials.