DOI: 10.11118/ecos2026_004

OPEN-SOURCE DECEPTION SECURITY FOR AWS CLOUD ENVIRONMENTS: A COST-CONSCIOUS ARCHITECTURE FOR SMES

Matěj Cajthaml¹, Tomáš Pitner¹

¹ Department of Informatics, Faculty of Business and Economics, Mendel University in Brno, Zemědělská 1, 613 00 Brno, Czech Republic

This paper presents the design and verification of an open-source deception security solution for Amazon Web Services cloud environments with a focus on small and medium-sized businesses and other budget-constrained organizational units. The study starts from the practical problem that commercial deception platforms provide centralized management, automated deployment, alerting, and visualization, yet their licensing and operational costs are often difficult to justify for smaller organizations. At the same time, cloud adoption continues to grow and expands the attack surface exposed through identities, storage services, virtual machines, and application interfaces. The proposed approach combines infrastructure as code, deceptive assets, and a lightweight monitoring pipeline to provide early warning signals without requiring a costly proprietary stack. The architecture integrates decoy cloud resources, identity-based honeytokens, event filtering, message queuing, log forwarding, and visualization components. The implementation was validated through a simulated insider-oriented attack path mapped to selected MITRE ATT&CK techniques. The results indicate that a reproducible and operationally realistic deception layer can be built from open-source tools and native cloud services while preserving constrained permissions and manageable running costs. The paper concludes that open-source deception can serve as a practical complementary layer in defense-in-depth strategies for cloud environments used by smaller organizations.

Klíčová slova: deception security, cloud security, Amazon Web Services, honeytokens, honeypots, open-source security, threat detection, SME

stránky: 5-5, online: 2026