title: "SCS-C03 Guided Labs"
summary: "A set of review-gated AWS security labs with validation, teardown, cost, evidence, and safe-operation requirements."
Safe lab operating rules
Use a dedicated non-production AWS account, synthetic data, least privilege, budget alerts, and a written teardown owner. Record the active account and Region before creating anything. Never weaken production controls to make a lab easier.
Each lab has two modes:
Architecture mode — complete the requirements, data flow, policies, failure analysis, and validation plan without creating resources.Sandbox mode — implement only after confirming pricing, permissions, Region support, and cleanup dependencies.
Validation is not “the console shows enabled.” Generate a harmless known event, prove the expected path, introduce one controlled failure, observe the failure evidence, restore the control, and prove recovery. Preserve only sanitized evidence without account IDs, credentials, secrets, or customer information.
Publication boundary
The procedures on this branch are complete curriculum drafts, but they remain in technical review. Their status becomes published only after execution against the current service behavior, successful cleanup, validation metadata, and named technical review.
scs-l01 · technical-review
Build an organization logging control plane 90 min Centralize protected activity and configuration evidence while separating log administration from workload administration.
Objectives 1.1, 1.2, 6.1, 6.3
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Member accounts → organization trail/configuration sources → dedicated log archive → monitored security account.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Write the account, Region, retention, and access requirements. Create or inspect a dedicated encrypted log destination with restrictive resource and key policies. Enable organization-aware collection and delegated security administration where available. Create alerts for disabled collection, policy change, delivery failure, and unauthorized access. Validate Generate a test event in a member context and locate it centrally. Demonstrate that a workload administrator cannot alter retained evidence. Record the exact policy path that permits delivery and denies tampering. Teardown or closeout Disable test alerts. Delete test member resources, trails, delivery channels, and temporary keys in dependency order. Retain only sanitized notes and screenshots without account identifiers. Mark application complete on this device scs-l02 · technical-review
Route and validate security findings 90 min Normalize, prioritize, enrich, and route a representative finding without losing source context.
Objectives 1.1, 1.3
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Finding source → normalization/aggregation → event routing → responder target with ownership and retry behavior.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Define severity, account, resource, and ownership fields required by responders. Create a test finding or use an approved sample event. Route it through an event rule to a non-production target. Add failure handling and document suppression boundaries. Validate Confirm one input produces one expected routed record. Break one permission deliberately and trace the failure through logs and metrics. Restore the permission and verify recovery. Teardown or closeout Remove the rule, target, test finding, queue/topic, and temporary role. Mark application complete on this device scs-l03 · technical-review
Contain an incident while preserving evidence 90 min Use reversible isolation, evidence capture, and a documented decision log before recovery.
Objectives 2.1, 2.2
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Simulated compromised workload → evidence snapshot/log export → quarantine control → clean recovery path.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Define incident commander, evidence owner, and stop conditions. Create a harmless workload and generate known activity. Capture time, identity, configuration, and storage evidence before containment. Apply a reversible quarantine and document every action. Validate Prove the workload is isolated without destroying evidence. Reconstruct the action timeline from retained records. Recover from a known-good state and verify monitoring. Teardown or closeout Delete the simulated workload, snapshots, temporary forensic role, isolation controls, and exported test data. Mark application complete on this device scs-l04 · technical-review
Investigate effective AWS permissions 90 min Explain an authorization result across identity, resource, boundary, session, organization, and key-policy layers.
Objectives 4.1, 4.2
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Federated test role → session policy and boundary → resource and KMS policies → organization guardrail.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Create a permission matrix with expected allows and denies. Implement a test role, resource policy, and permissions boundary in a sandbox. Test allowed, implicitly denied, and explicitly denied operations. Use policy simulation and activity records to explain each result. Validate For every test, identify the controlling policy statement and evaluation layer. Confirm an explicit deny remains effective when another layer allows. Teardown or closeout Delete the role, boundary, policies, sessions, resource, and test key. Mark application complete on this device scs-l05 · technical-review
Compare cross-account guardrails 90 min Choose the correct combination of role trust, resource policy, SCP/RCP, and delegated administration.
Objectives 4.2, 6.1
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Organization root/OUs → policy guardrails → delegated administrator → cross-account role and protected resource.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Write four cross-account access requirements and ownership boundaries. Model the effective permissions path for each requirement. Implement one minimal cross-account pattern in sandbox accounts if available. Document how an SCP or RCP changes the result. Validate Demonstrate intended access and one intentional deny. Explain why a permissions boundary cannot replace an organization policy. Teardown or closeout Remove cross-account trust, policies, test resources, and delegated test configuration. Mark application complete on this device scs-l06 · technical-review
Design and test a KMS-backed protection model 90 min Select key ownership, policy, rotation, grants, encryption context, and recovery behavior for a sensitive data flow.
Objectives 5.1, 5.2, 5.3
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Producer → encrypted data service using customer-managed KMS key → approved consumer with audited decrypt path.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Classify the data and identify producer, custodian, and consumer roles. Create a customer-managed test key and least-privilege key policy. Encrypt representative non-sensitive data and test authorized access. Test an unauthorized principal and inspect the evidence. Validate Show the authorized and denied decrypt events. Explain imported versus AWS-generated material and when multi-Region keys are justified. Teardown or closeout Schedule key deletion only after deleting encrypted test resources and confirming no dependency remains. Delete temporary roles and logs not required for the exercise. Mark application complete on this device scs-l07 · technical-review
Rotate a workload secret safely 90 min Separate human and workload access, rotate without exposing plaintext, and verify rollback behavior.
Objectives 5.3
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Test workload identity → managed secret → rotation function/workflow → audit and failure alerts.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Create a non-sensitive test credential and managed secret. Grant one workload identity scoped read access without console-user access. Configure or simulate rotation stages and failure handling. Observe access and rotation evidence. Validate Confirm old and new stages behave as designed. Demonstrate that logs do not contain the secret value. Teardown or closeout Delete the secret without recovery only after the test consumer is removed; delete rotation resources and roles. Mark application complete on this device scs-l08 · technical-review
Secure a private workload and remediate drift 90 min Combine segmentation, private service access, IaC controls, drift detection, and reversible remediation.
Objectives 2.2, 3.1, 3.2, 3.3, 6.2, 6.3
Cost Usually under USD $3 when completed in one sitting; verify current AWS pricing and remove all resources.
Validation not-run: Procedure is source-aligned but must be executed in the target sandbox before publication. Architecture or scenario Private workload subnets → endpoints/inspection → configuration evaluation → event-driven remediation with approval boundary.
Prerequisites Use an isolated non-production AWS account with budget alerts. Start with least-privilege credentials and record the active Region. Procedure Diagram trust boundaries and permitted traffic. Deploy a minimal private workload and service endpoint through IaC. Create a harmless noncompliant change and detect it. Run a reversible remediation or produce an approval request. Validate Verify no unintended public route or address exists. Show drift evidence, remediation evidence, and the rollback path. Teardown or closeout Destroy the IaC stack, endpoints, logs, roles, network resources, and temporary state bucket if created. Mark application complete on this device 