Identity Ecosystem Creation

# Create-DecoyADAccounts.ps1
# Creates decoy accounts in Active Directory that blend with real accounts.
# These accounts serve as traps - any authentication attempt triggers an alert.

Import-Module ActiveDirectory

$Domain = (Get-ADDomain).DNSRoot
$UsersOU = "OU=Users,OU=Corporate,DC=corp,DC=internal"
$SvcOU   = "OU=Service Accounts,OU=Corporate,DC=corp,DC=internal"

# Decoy user accounts - names match organizational naming conventions
$DecoyUsers = @(
    @{
        Name        = "r.nakamura"
        DisplayName = "Reiko Nakamura"
        Title       = "Senior Database Administrator"
        Department  = "IT Operations"
        Description = "DBA - Production Databases"
        Password    = "W1nter_Seas0n!2026"
    },
    @{
        Name        = "d.okafor"
        DisplayName = "David Okafor"
        Title       = "Infrastructure Architect"
        Department  = "Platform Engineering"
        Description = "Cloud infrastructure and networking"
        Password    = "Cl0ud#Arch2026!"
    }
)

# Decoy service accounts - high-value targets for adversaries
$DecoySvcAccounts = @(
    @{
        Name        = "svc_sql_backup"
        DisplayName = "SQL Backup Service"
        Description = "Automated SQL backup service account"
        Password    = "SqlB4ckup#Pr0d!"
        SPNs        = @("MSSQLSvc/prod-sql-03.corp.internal:1433")
    },
    @{
        Name        = "svc_deploy_prod"
        DisplayName = "Production Deploy Service"
        Description = "CI/CD deployment service - production"
        Password    = "D3pl0y_Pr0d#2026"
        SPNs        = @("HTTP/deploy.corp.internal")
    }
)

foreach ($user in $DecoyUsers) {
    $securePass = ConvertTo-SecureString $user.Password -AsPlainText -Force

    New-ADUser `
        -SamAccountName $user.Name `
        -UserPrincipalName "$($user.Name)@$Domain" `
        -Name $user.DisplayName `
        -GivenName ($user.DisplayName.Split(" ")[0]) `
        -Surname ($user.DisplayName.Split(" ")[1]) `
        -DisplayName $user.DisplayName `
        -Title $user.Title `
        -Department $user.Department `
        -Description $user.Description `
        -Path $UsersOU `
        -AccountPassword $securePass `
        -Enabled $true `
        -PasswordNeverExpires $true `
        -CannotChangePassword $true

    # Add to groups that make the account look privileged
    Add-ADGroupMember -Identity "Remote Desktop Users" `
        -Members $user.Name
    Add-ADGroupMember -Identity "Backup Operators" `
        -Members $user.Name

    # Set last logon to a recent date (makes account look active)
    Write-Host "[+] Created decoy user: $($user.Name)" -Fore Green
}

foreach ($svc in $DecoySvcAccounts) {
    $securePass = ConvertTo-SecureString $svc.Password -AsPlainText -Force

    New-ADUser `
        -SamAccountName $svc.Name `
        -UserPrincipalName "$($svc.Name)@$Domain" `
        -Name $svc.DisplayName `
        -DisplayName $svc.DisplayName `
        -Description $svc.Description `
        -Path $SvcOU `
        -AccountPassword $securePass `
        -Enabled $true `
        -PasswordNeverExpires $true `
        -ServicePrincipalNames $svc.SPNs

    Write-Host "[+] Created decoy SVC account: $($svc.Name)" -Fore Green
    Write-Host "    SPNs: $($svc.SPNs -join ', ')" -Fore Yellow
}

Write-Host ""
Write-Host "IMPORTANT: Configure SIEM alerts for ANY authentication" `
    "attempt using these accounts." -Fore Red
Write-Host "Account names to monitor:" -Fore Red
($DecoyUsers + $DecoySvcAccounts) | ForEach-Object {
    Write-Host "  - $($_.Name)" -Fore Yellow
}

# modules/decoy-iam/main.tf
# Decoy IAM users with honey access keys.
# Any use of these keys indicates credential compromise.

resource "aws_iam_user" "decoy_admin" {
  name = "svc-deploy-admin"
  path = "/service-accounts/"
  tags = {
    Department = "Platform Engineering"
    ShadowCDF  = "true"
  }
}

# Create access keys that look real but have NO permissions
resource "aws_iam_access_key" "decoy_key" {
  user = aws_iam_user.decoy_admin.name
}

# Attach a policy that DENIES everything - the key is useless
resource "aws_iam_user_policy" "deny_all" {
  name = "deny-all-actions"
  user = aws_iam_user.decoy_admin.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Deny"
      Action   = "*"
      Resource = "*"
    }]
  })
}

# CloudTrail metric filter: alert on ANY API call with decoy keys
resource "aws_cloudwatch_log_metric_filter" "decoy_key_usage" {
  name           = "shadow-cdf-decoy-key-usage"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ $.userIdentity.accessKeyId = \"${aws_iam_access_key.decoy_key.id}\" }"

  metric_transformation {
    name          = "DecoyKeyUsage"
    namespace     = "ShadowCDF"
    value         = "1"
    default_value = "0"
  }
}

resource "aws_cloudwatch_metric_alarm" "decoy_key_alarm" {
  alarm_name          = "CRITICAL-DecoyCredentialUsed"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "DecoyKeyUsage"
  namespace           = "ShadowCDF"
  period              = 60
  statistic           = "Sum"
  threshold           = 0
  alarm_description   = "Decoy IAM credentials used - likely credential compromise"
  alarm_actions       = [var.security_sns_topic_arn]
  treat_missing_data  = "notBreaching"
}

# Output: these values get planted in decoy config files (SDF-DP03)
output "decoy_access_key_id" {
  value     = aws_iam_access_key.decoy_key.id
  sensitive = true
}
output "decoy_secret_key" {
  value     = aws_iam_access_key.decoy_key.secret
  sensitive = true
}