---
title: "AWS Security Specialty Hands-On Labs | Cybr"
description: "Prepare for the AWS Security Specialty with hands-on labs for threat detection, logging, infrastructure, IAM, data protection, and governance."
url: https://cybr.com/hands-on-labs/aws-security-specialty/
---

Prepare with practical AWS security work

# AWS Certified Security Specialty Hands-On Labs

Prepare for the certification and build practical AWS security skills. Work through threat detection, logging, infrastructure, identity, data protection, and governance scenarios.

[Start a Security Specialty lab →](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/)

Premium membership required

![AWS Certified Security Specialty training and hands-on labs](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)

![Johnny Endrihs](https://media.cybr.com/2025/12/johnny-endrihs.jpg)![Christopher](https://media.cybr.com/2023/09/christopher-krisnd.jpeg)![Rafael Martinez](https://media.cybr.com/2024/02/rafael-martinez.jpeg)![Lixin Zhang](https://media.cybr.com/2023/07/lixin-zhang.jpeg)![Karan Thakkar](https://media.cybr.com/2025/11/karan-thakkar.png)

**80,000+** people learn with Cybr

- Real AWS environments
- Skills across exam areas
- No cloud bill

![Cisco](https://cybr.comhttps//media.cybr.com/2026/08/cisco-light-360.png)![Verizon](https://cybr.comhttps//media.cybr.com/2026/08/verizon-light-360.png)![Toyota](https://cybr.comhttps//media.cybr.com/2026/08/toyota-light-360.png)![Check Point](https://cybr.comhttps//media.cybr.com/2026/08/checkpoint-light-360.png)![Moody’s](https://cybr.comhttps//media.cybr.com/2026/08/moodys-light-360.png)![AT&T](https://cybr.comhttps//media.cybr.com/2026/08/att-light-360.png)![Virginia Tech](https://cybr.comhttps//media.cybr.com/2026/08/virginiatech-light-360.png)

Choose a featured certification lab

## Prepare for the certification with practical AWS security work

Work through threat detection, incident response, security monitoring, network controls, identity, and encryption in real AWS environments.

1.

   Premium

   Threat detection

   ### Amazon GuardDuty Sandbox

   Explore Amazon GuardDuty findings in a safe AWS environment.

   Open lab

   [Amazon GuardDuty Sandbox](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/)

2.

   Premium

   Incident response

   ### Automated Security Response with EventBridge and Lambda

   Detect suspicious IAM activity and automate containment with AWS services.

   Open lab

   [Automated Security Response with EventBridge and Lambda](https://cybr.com/hands-on-labs/lab/automated-security-response-with-eventbridge-and-lambda/)

3.

   Premium

   Logging and monitoring

   ### Security Observability with CloudWatch Dashboards

   Turn CloudTrail activity into a CloudWatch security dashboard.

   Open lab

   [Security Observability with CloudWatch Dashboards](https://cybr.com/hands-on-labs/lab/security-observability-with-cloudwatch-dashboards/)

4.

   Premium

   Infrastructure security

   ### Configure Security Groups (SGs) and NACLs

   Control network traffic with security groups and network access control lists.

   Open lab

   [Configure Security Groups (SGs) and NACLs](https://cybr.com/hands-on-labs/lab/configure-security-groups-sgs-and-nacls/)

5.

   Premium

   Data protection

   ### Encrypt and Decrypt Data with KMS and Data Keys

   Encrypt data with AWS KMS, customer-managed keys, and data keys.

   Open lab

   [Encrypt and Decrypt Data with KMS and Data Keys](https://cybr.com/hands-on-labs/lab/encrypt-and-decrypt-data-with-kms-and-data-keys/)

[Browse the complete lab catalog](https://cybr.com/hands-on-labs/)

AWS Security Specialty skill areas

## Build practical AWS security skills

Build skills in detection, response, logging, monitoring, infrastructure protection, access control, encryption, and security governance.

### Detect threats and respond to incidents

Review managed findings, investigate vulnerable workloads, and connect security events to automatic containment.

- [Amazon GuardDuty Sandbox](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/)
- [Automated Security Response with EventBridge and Lambda](https://cybr.com/hands-on-labs/lab/automated-security-response-with-eventbridge-and-lambda/)
- [Find Vulnerable Lambda Functions with Amazon Inspector](https://cybr.com/hands-on-labs/lab/amazon-inspector-sandbox/)

### Build security logging and monitoring

Collect host and network activity, then turn AWS records into dashboards and useful security signals.

- [Security Observability with CloudWatch Dashboards](https://cybr.com/hands-on-labs/lab/security-observability-with-cloudwatch-dashboards/)
- [Detect Suspicious Network Traffic with VPC Flow Logs](https://cybr.com/hands-on-labs/lab/detect-suspicious-network-traffic-with-vpc-flow-logs/)
- [Install and Configure the Amazon CloudWatch Unified Agent on EC2](https://cybr.com/hands-on-labs/lab/install-and-configure-the-amazon-cloudwatch-unified-agent-on-ec2/)

### Protect AWS infrastructure

Control network paths, protect web workloads, and find exposed services before attackers do.

- [Configure Security Groups (SGs) and NACLs](https://cybr.com/hands-on-labs/lab/configure-security-groups-sgs-and-nacls/)
- [Deploy AWS WAF ACL for Application Load Balancer](https://cybr.com/hands-on-labs/lab/deploy-aws-waf-acl-for-application-load-balancer/)
- [Reduce Your AWS Attack Surface with Port Scanning](https://cybr.com/hands-on-labs/lab/reduce-aws-attack-surface-with-port-scanning/)

### Manage identity and access

Review credential status, create controlled service access, and assess policy changes before deployment.

- [Generate IAM Credentials Reports](https://cybr.com/hands-on-labs/lab/generate-iam-credentials-reports/)
- [Create an IAM Role for Secure S3 Access](https://cybr.com/hands-on-labs/lab/create-an-iam-role-for-secure-s3-access/)
- [Check Policies for New Access Before Deployment with IAM Access Analyzer](https://cybr.com/hands-on-labs/lab/check-policies-for-new-access-before-deployment-with-iam-access-analyzer/)

### Protect data with encryption

Use AWS key management and service controls to protect application, database, and object-storage data.

- [Encrypt and Decrypt Data with KMS and Data Keys](https://cybr.com/hands-on-labs/lab/encrypt-and-decrypt-data-with-kms-and-data-keys/)
- [Encrypting an Unencrypted RDS Database](https://cybr.com/hands-on-labs/lab/encrypting-an-unencrypted-rds-database/)
- [Securing S3 Against Ransomware with YES3](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/)

### Apply security governance

Set policy checks, enforce access rules, and automate fixes for unsafe cloud settings.

- [Policy as Code with CloudFormation Guard](https://cybr.com/hands-on-labs/lab/policy-as-code-with-cloudformation-guard/)
- [Check IAM Policies Against a Deny List with IAM Access Analyzer](https://cybr.com/hands-on-labs/lab/check-iam-policies-against-a-deny-list-with-iam-access-analyzer/)
- [Automated S3 Remediation to Enforce Block Public Access](https://cybr.com/hands-on-labs/lab/automated-s3-remediation-to-enforce-block-public-access/)

Free cheat sheets

## AWS Security Specialty cheat sheets and study references

Review SCS-C03 exam topics and key concepts in AWS identity, network security, logging, and encryption.

- [AWS Security Specialty SCS-C03 exam reference](https://cybr.com/cheat-sheets/aws-security-specialty-exam/)

  In-scope AWS services, features, concepts, and tools for the SCS-C03 exam.

- [AWS native security services cheat sheet](https://cybr.com/cheat-sheets/aws-security-services/)

  Compare the roles of services used for identity, threat detection, infrastructure protection, and data security.

- [AWS IAM policy anatomy cheat sheet](https://cybr.com/cheat-sheets/iam-policy-anatomy/)

  Policy syntax, role trust relationships, and cross-account access explained with annotated JSON examples.

- [Security groups vs. NACLs cheat sheet](https://cybr.com/cheat-sheets/nacl-vs-sgs/)

  Compare statefulness, rule behavior, and scope for the two types of VPC network controls.

- [KMS encryption and data keys cheat sheet](https://cybr.com/cheat-sheets/kms-encryption-data-keys/)

  Encryption and decryption workflows using KMS keys and data keys.

- [AWS CloudTrail security controls checklist](https://cybr.com/cheat-sheets/cloudtrail-security-controls/)

  Logging coverage, encryption, log file validation, and monitoring controls for protecting CloudTrail evidence.

[Browse all cloud security cheat sheets](https://cybr.com/cheat-sheets/)

How the labs work

## Prepare with real AWS security tasks

Cybr prepares the AWS environment for each lab. You can focus on practical security work instead of account setup, billing, and cleanup.

1. Step 01

   ### Choose a skill area

   Choose a lab that matches the next part of your study plan.

2. Step 02

   ### Launch the environment

   Get the AWS resources, access, tools, and instructions that the scenario requires.

3. Step 03

   ### Complete the security task

   Apply the control, investigate the activity, and review why the result matters.

**Isolated AWS training environments**

Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs.

Follow a complete study plan

## Connect hands-on labs to certification preparation

Use the Security Specialty path to organize your study. Use the Blue Team path to deepen practical detection, response, and governance skills.

- [AWS Certified Security Specialty](https://cybr.com/learning-path/aws-certified-security-specialty/)

  Follow a structured plan through AWS security lessons, labs, quizzes, and practice exams.

- [AWS Blue Team](https://cybr.com/learning-path/aws-blue-team-learning-path/)

  Build practical skills in monitoring, detection, incident response, security automation, and governance.

Complete your certification training

## Pair practical labs with the AWS Security Specialty course

Use the free course for video lessons, then add the Premium edition for labs, quizzes, scenarios, and practice exams.

[View the free Security Specialty course →](https://cybr.com/courses/aws-certified-security-specialty-course/) [View the Premium course](https://cybr.com/courses/aws-certified-security-specialty-premium-edition/)

Before you start

## AWS Security Specialty hands-on lab FAQ

Do I need a Premium membership?

Yes. The featured certification labs require Premium membership. Access requirements appear on each featured lab.

Do I need my own AWS account?

No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate.

Does this page depend on one exam version?

No. The page focuses on durable AWS security skills instead of a version number. Review the current AWS exam guide before scheduling your exam.

What certification skills can I practice?

Labs cover threat detection, incident response, security logging, monitoring, infrastructure protection, IAM, encryption, and governance.

How much AWS experience do I need?

Start with AWS and security foundations if these services are new to you. The labs then build practical experience across major security tasks.

Will AWS charge me for the lab resources?

No. Cybr provides the AWS environment, covers its cloud costs, and removes the resources after your session.

## Start practicing AWS Security Specialty skills

Investigate GuardDuty findings in a guided AWS environment, then continue through response, monitoring, infrastructure, identity, encryption, and governance scenarios.

[Start the GuardDuty lab →](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/) [Explore the certification path](https://cybr.com/learning-path/aws-certified-security-specialty/)

Premium membership required