Talk · DevOpsDays Barcelona 2026 · Ignite

One Fake Password Is Worth More Than 10,000 Alerts

Five minutes, twenty slides, two weekends. One where the alerts fire and nobody acts for four days. One where a fake credential trips, an agent stops the compromised task, and nothing leaves the building.

When: Sat 14 Nov 2026, 13:15–13:20
Where: BAU, Pujades Track, Barcelona
Format: Ignite: 20 slides × 15 s
Speaker: Ilia Dubovskii

Talk on DevOpsDays Barcelona Speaker profile Download slides + transcript (PDF)

The talk in four lines

An alert is a maybe.

CPU, traffic and cost all have innocent explanations. Ten thousand of them a month teach people to wait.

A canary is a certainty.

Nobody legitimate uses a fake key. When it's used, you know it's an attacker, and exactly which task leaked it.

Automate on certainty.

AI acting on maybes is dangerous. AI acting on certainty, with an action you can undo, is good engineering.

Keep the alerts.

Use them as context. The canary decides; the alerts explain.

Slides and transcript

All 20 slides with what is said on each.

Try it on Monday

A canary AWS key in plain Terraform: a deny-all IAM user that looks like a real workload, its key, and an EventBridge rule that fires on any use of it, read-only calls included. Plant the key where an attacker would look: container environments, CI variables, a wiki page.

resource "aws_iam_user" "decoy" {
  name = "svc-backup-reporting"   # looks like a real workload
  path = "/service/"
}

resource "aws_iam_user_policy" "deny_all" {
  user   = aws_iam_user.decoy.name
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{ Effect = "Deny", Action = "*", Resource = "*" }]
  })
}

resource "aws_iam_access_key" "decoy" {
  user = aws_iam_user.decoy.name   # plant this key where attackers look
}

resource "aws_cloudwatch_event_rule" "decoy_used" {
  name  = "backup-reporting-activity"
  state = "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS"   # include read-only calls
  event_pattern = jsonencode({
    "detail-type" = ["AWS API Call via CloudTrail"]
    detail        = { userIdentity = { userName = [aws_iam_user.decoy.name] } }
  })
}
# + an aws_cloudwatch_event_target to your alerting / response (SNS, SQS, Lambda…)

Want this planted, correlated to the exact workload and acted on automatically? That's what Compass honeypots do.

Saw the talk?

This is the page the QR code on the last slide points to. Questions are welcome.

Book 30 minutes with Ilia →