CloudPot: AWS SSH Honeypot

Stack: AWS EC2 · VPC · IAM · CloudWatch Logs · S3 · Athena · Terraform · Cowrie
Code: github.com/Aditiicodes/CloudPot

What it is#

A single-instance SSH honeypot running Cowrie on Ubuntu 22.04, deployed into an isolated AWS VPC and left exposed on port 22 to live internet traffic for seven days in March 2026. Every session was logged as JSON, shipped through the CloudWatch agent to S3, and queried with Athena.

Design decisions#

Egress containment. Inbound is deliberately open; outbound is not. The network ACL permits only DNS and HTTPS to AWS endpoints, so a honeypot that gets fully compromised still can’t be used as a pivot or a scanning host. This is the part of the build that mattered most.

Downloads blocked. Cowrie can retrieve the payloads attackers try to fetch. This deployment doesn’t; it logs the URLs and stops there. That trades away payload hashes in exchange for not storing malware in an S3 bucket, and removes an entire class of handling and legal questions from a student project.

Least-privilege IAM. The instance role can write to one log group and one S3 prefix. No wildcards on action or resource.

Real SSH relocated first. Administrative access moved to a non-standard port, restricted by source CIDR, before Cowrie bound port 22.

Limitations#

A seven-day window is enough to characterize background internet scanning, not enough to say anything about targeted activity or weekly periodicity. Nothing observed here is confirmed malicious intent; it’s automated traffic against an unremarkable IP.