--- title: "Amazon S3 Hands-On Labs for Cloud Security | Cybr" description: "Practice Amazon S3 security with hands-on AWS labs. Create buckets, manage access, protect data, assess settings, and study attack paths." url: https://cybr.com/hands-on-labs/s3/ --- Practice data security on AWS # Amazon S3 Hands-On Labs Learn Amazon S3 by working with real AWS resources. Practice bucket operations, secure access, encryption, assessment, attack simulation, and recovery. [Start a free S3 lab →](https://cybr.com/hands-on-labs/lab/introduction-to-s3-enumeration/) No credit card required ![Securing Amazon S3 course and hands-on labs](https://media.cybr.com/2024/06/Securing-Amazon-S3-Course.png) ![Johnny Endrihs](https://media.cybr.com/2025/12/johnny-endrihs.jpg)![Christopher](https://media.cybr.com/2023/09/christopher-krisnd.jpeg)![Rafael Martinez](https://media.cybr.com/2024/02/rafael-martinez.jpeg)![Lixin Zhang](https://media.cybr.com/2023/07/lixin-zhang.jpeg)![Karan Thakkar](https://media.cybr.com/2025/11/karan-thakkar.png) **80,000+** people learn with Cybr - Real S3 resources - Guided and CTF labs - No cloud bill ![Cisco](https://cybr.comhttps//media.cybr.com/2026/08/cisco-light-360.png)![Verizon](https://cybr.comhttps//media.cybr.com/2026/08/verizon-light-360.png)![Toyota](https://cybr.comhttps//media.cybr.com/2026/08/toyota-light-360.png)![Check Point](https://cybr.comhttps//media.cybr.com/2026/08/checkpoint-light-360.png)![Moody’s](https://cybr.comhttps//media.cybr.com/2026/08/moodys-light-360.png)![AT&T](https://cybr.comhttps//media.cybr.com/2026/08/att-light-360.png)![Virginia Tech](https://cybr.comhttps//media.cybr.com/2026/08/virginiatech-light-360.png) Choose a featured S3 lab ## Build, secure, and test Amazon S3 environments Start with bucket discovery or core operations. Then build secure access, assess risky settings, and protect data from ransomware. 1. Free Free beginner lab ### Introduction to S3 Enumeration Find S3 buckets and inspect the data and access that they expose. Open lab [Introduction to S3 Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-s3-enumeration/) 2. Free Free foundation lab ### Creating Buckets & Uploading Objects In S3 (CLI) Create a bucket and manage objects with the AWS command line. Open lab [Creating Buckets & Uploading Objects In S3 (CLI)](https://cybr.com/hands-on-labs/lab/creating-buckets-uploading-objects-in-s3-cli/) 3. Premium Secure access ### Create an IAM Role for Secure S3 Access Create and assume an IAM role with controlled access to Amazon S3. Open lab [Create an IAM Role for Secure S3 Access](https://cybr.com/hands-on-labs/lab/create-an-iam-role-for-secure-s3-access/) 4. Premium Security assessment ### Find S3 Security Misconfigurations with Prowler Use Prowler to find risky S3 settings across an AWS account. Open lab [Find S3 Security Misconfigurations with Prowler](https://cybr.com/hands-on-labs/lab/find-s3-security-misconfigurations-with-prowler/) 5. Free Free defense lab ### Securing S3 Against Ransomware with YES3 Assess an S3 bucket and apply controls that reduce ransomware risk. Open lab [Securing S3 Against Ransomware with YES3](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/) [Browse the complete lab catalog](https://cybr.com/hands-on-labs/) Amazon S3 security topics ## Build practical S3 security skills The S3 collection covers bucket operations, access, encryption, records, security checks, automated fixes, data theft, and ransomware scenarios. ### Create buckets and manage objects Learn core S3 operations with the AWS Console, command line, roles, and presigned URLs. - [Creating Buckets and Uploading Objects in S3 (CLI)](https://cybr.com/hands-on-labs/lab/creating-buckets-uploading-objects-in-s3-cli/) - [Creating Buckets and Uploading Objects in S3 (Role)](https://cybr.com/hands-on-labs/lab/creating-buckets-uploading-objects-in-s3-role/) - [Creating Buckets and Uploading Objects in S3 (AWS Console)](https://cybr.com/hands-on-labs/lab/creating-buckets-uploading-objects-in-s3-aws-console/) - [S3 Presigned URLs](https://cybr.com/hands-on-labs/lab/s3-presigned-urls/) ### Build secure S3 infrastructure Connect IAM and Terraform to S3, then practice importing and controlling existing resources. - [Create an IAM Role for Secure S3 Access](https://cybr.com/hands-on-labs/lab/create-an-iam-role-for-secure-s3-access/) - [Create a Static S3 Website Using Terraform](https://cybr.com/hands-on-labs/lab/create-a-static-s3-website-using-terraform/) - [Creating an S3 Bucket with Terraform](https://cybr.com/hands-on-labs/lab/creating-an-s3-bucket-with-terraform/) - [Import an Existing Amazon S3 Bucket Challenge](https://cybr.com/hands-on-labs/lab/import-an-existing-amazon-s3-bucket-challenge/) - [Remote Terraform State](https://cybr.com/hands-on-labs/lab/remote-terraform-state/) - [Managing Terraform State and Drift](https://cybr.com/hands-on-labs/lab/managing-terraform-state-and-drift/) ### Discover buckets and account details Use limited S3 access to find buckets, exposed data, AWS account IDs, and organization IDs. - [Introduction to S3 Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-s3-enumeration/) - [Discover AWS Account ID via S3 Bucket](https://cybr.com/hands-on-labs/lab/discover-aws-account-id-via-s3-bucket/) - [Discover AWS Organization ID via S3 Bucket](https://cybr.com/hands-on-labs/lab/discover-aws-organization-id-via-s3-bucket/) ### Protect data and record activity Use versioning, access logs, and encryption to protect S3 objects and support investigations. - [S3 Versioning (AWS Console)](https://cybr.com/hands-on-labs/lab/s3-versioning-aws-console/) - [S3 Versioning (CLI)](https://cybr.com/hands-on-labs/lab/s3-versioning-cli/) - [S3 Server Access Logs (AWS Console)](https://cybr.com/hands-on-labs/lab/s3-server-access-logs-aws-console/) - [S3 Server Access Logs (CLI)](https://cybr.com/hands-on-labs/lab/s3-server-access-logs-cli/) - [Encrypting S3 Data with SSE-KMS (AWS Console)](https://cybr.com/hands-on-labs/lab/encrypting-s3-data-with-sse-kms-aws-console/) - [Encrypting S3 Data with SSE-KMS (CLI)](https://cybr.com/hands-on-labs/lab/encrypting-s3-data-with-sse-kms-cli/) - [Encrypting S3 Data with SSE-C via the CLI](https://cybr.com/hands-on-labs/lab/encrypting-s3-data-with-sse-c-via-the-cli/) ### Assess and fix S3 settings Find unsafe settings with security tools, apply policy checks, and automate protection against public access and ransomware. - [Find S3 Security Misconfigurations with Prowler](https://cybr.com/hands-on-labs/lab/find-s3-security-misconfigurations-with-prowler/) - [Query AWS Accounts for S3 Security Issues Using Steampipe](https://cybr.com/hands-on-labs/lab/query-aws-accounts-for-s3-security-issues-using-steampipe/) - [Automated S3 Remediation to Enforce Block Public Access](https://cybr.com/hands-on-labs/lab/automated-s3-remediation-to-enforce-block-public-access/) - [Securing S3 Against Ransomware with YES3](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/) - [Policy as Code with CloudFormation Guard](https://cybr.com/hands-on-labs/lab/policy-as-code-with-cloudformation-guard/) ### Simulate data theft and ransomware Study how attackers reach S3 data through compute services, bucket policies, and destructive ransomware methods. - [S3 Data Exfiltration via EC2 IMDSv1](https://cybr.com/hands-on-labs/lab/s3-data-exfiltration-via-ec2-imdsv1/) - [Compromising EC2 IMDSv2 with RCE to Access Sensitive S3 Data](https://cybr.com/hands-on-labs/lab/compromising-ec2-imdsv2-with-rce-to-access-sensitive-s3-data/) - [Exploiting Lambda SSRF to Access S3 Buckets](https://cybr.com/hands-on-labs/lab/exploiting-lambda-ssrf-to-access-s3-buckets/) - [Backdoor an S3 Bucket via Its Bucket Policy](https://cybr.com/hands-on-labs/lab/backdoor-an-s3-bucket-via-its-bucket-policy/) - [S3 Ransomware Simulation Through Batch File Deletion](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-batch-file-deletion/) - [S3 Ransomware Simulation Through Client-Side Encryption](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-client-side-encryption/) Free cheat sheets ## Amazon S3 cheat sheets for access and data protection Policy examples and security references for controlling S3 access, protecting objects, managing encryption, and defending against ransomware. - [Amazon S3 security controls cheat sheet](https://cybr.com/cheat-sheets/amazon-s3-security-controls/) Bucket access restrictions, object protection, encryption, and logging and monitoring controls. - [S3 bucket policies vs. ACLs vs. IAM policies](https://cybr.com/cheat-sheets/s3-access-control/) Compare the scope, syntax, and permissions of S3 bucket policies, ACLs, and IAM policies. - [Least-privilege S3 bucket policy cheat sheet](https://cybr.com/cheat-sheets/s3-least-privilege/) Restrictive bucket-policy examples and guidance for identifying excessive access and policy weaknesses. - [Amazon S3 ransomware defenses cheat sheet](https://cybr.com/cheat-sheets/amazon-s3-ransomware-defenses/) Prevention, detection, recovery, and security testing controls for defending S3 data against ransomware. - [KMS encryption and data keys cheat sheet](https://cybr.com/cheat-sheets/kms-encryption-data-keys/) Direct KMS encryption and envelope encryption with data keys, including encryption and decryption workflows. - [Prowler cloud security assessment cheat sheet](https://cybr.com/cheat-sheets/prowler/) Installation, check selection, and reporting commands for assessing cloud security configurations with Prowler. [Browse all cloud security cheat sheets](https://cybr.com/cheat-sheets/) How the labs work ## Practice S3 security without using your AWS account Cybr prepares the AWS environment for each lab. You can focus on S3 security instead of account setup, billing, and cleanup. 1. Step 01 ### Choose an S3 lab Start free or choose a premium lab that matches your experience. 2. Step 02 ### Launch the environment Get the S3 buckets, AWS resources, access, and instructions that the lab requires. 3. Step 03 ### Complete the scenario Build, inspect, attack, or defend the S3 environment and review the result. **Isolated AWS training environments** Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs. Continue with a structured path ## Connect S3 security to AWS defense and attack skills Use the Blue Team path for protection and response. Use the Red Team path to study discovery, access, and data theft. - [AWS Blue Team](https://cybr.com/learning-path/aws-blue-team-learning-path/) Build defensive skills in data protection, security assessment, monitoring, response, and automation. - [AWS Red Team](https://cybr.com/learning-path/aws-red-team-learning-path/) Practice discovery, exposed-resource analysis, attack paths, and data access in AWS environments. Go deeper with S3 training ## Connect individual labs with complete Amazon S3 training The S3 course covers bucket operations, access, encryption, assessment, attacks, and defenses. Use the security controls guide as a practical reference. [View the Securing Amazon S3 Data course →](https://cybr.com/courses/securing-amazon-s3/) [Read the S3 security controls guide](https://cybr.com/cheat-sheets/amazon-s3-security-controls/) Before you start ## Amazon S3 hands-on lab FAQ Can I try an Amazon S3 lab for free? Yes. Selected S3 labs are free. Create a free account and start without a credit card. [Start a free S3 lab](https://cybr.com/hands-on-labs/lab/introduction-to-s3-enumeration/) Do I need my own AWS account? No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate. How much Amazon S3 experience do I need? Beginners can start with bucket operations or enumeration. Later labs cover encryption, assessment, automated fixes, attack paths, and ransomware. What S3 security skills can I practice? Labs cover buckets, objects, roles, policies, presigned URLs, versioning, access logs, encryption, security checks, automated fixes, data theft, and ransomware. Can I safely practice S3 attacks and ransomware? Yes. Attack labs run in isolated training environments. You can study destructive methods without using company resources. Will AWS charge me for S3 lab resources? No. Cybr provides the AWS environment, covers its cloud costs, and removes the lab resources after your session. ## Start an Amazon S3 security lab for free Discover S3 buckets in a guided AWS environment, then continue through access, protection, assessment, and attack scenarios. [Start a free S3 lab →](https://cybr.com/hands-on-labs/lab/introduction-to-s3-enumeration/) [Explore all AWS hands-on labs](https://cybr.com/hands-on-labs/aws/) No credit card required