SCS-C03 Domain 6 - Audit Manager automated evidence collection, AWS Artifact compliance reports, Config conformance packs, Security Hub CSPM, and Well-Architected Tool

A hands-on lab demonstrating how an attacker with an over-privileged "on-call" role disables CloudTrail, suspends GuardDuty, and deletes CloudWatch log groups to operate undetected and how organization trails, delegated GuardDuty administration, S3 Object Lock, and SCPs make logging survive even a fully compromised member account.

SCS-C03 Domain 6 - Firewall Manager policies for WAF, Shield Advanced, and Security Groups; AWS RAM for resource sharing; Service Catalog for secure deployment

A hands-on lab demonstrating how a command injection flaw in a Lambda function behind API Gateway leaks execution role credentials and environment-variable secrets, then how the over-privileged execution role is abused to pivot into DynamoDB and a second, "internal-only" Lambda function - with GuardDuty Lambda Protection detection and least-privilege fixes.

SCS-C03 Domain 6 - AWS Organizations OU structure, SCPs, RCPs, delegated administrators, Control Tower landing zone, Account Factory, guardrails, and root user management

A hands-on lab demonstrating how a single compromised AWS account becomes a pivot point into an entire organization - using misconfigured trust policies, resource-based policy wildcards, and role chaining to move laterally across accounts - then stopped with SCPs, RCPs, and Access Analyzer.

SCS-C03 Domain 4 - Cognito user pools vs identity pools, JWT validation, federated identities, Cognito hosted UI, Amazon Verified Permissions for app-level authorization

A hands-on lab covering five S3 and storage misconfiguration attack paths - public buckets, presigned URL abuse, Terraform state file pillaging, public EBS snapshots, and RDS snapshot sharing - with detection via Macie and GuardDuty and fixes for each.

SCS-C03 Domain 4 - IAM Access Analyzer findings, unused access, AssumeRole and session policies, permission boundaries, IAM Roles Anywhere, policy simulation, and ABAC/RBAC

A hands-on lab demonstrating how to escape a Kubernetes pod, steal the service account token, abuse IRSA to call AWS APIs, and escalate from a container to full AWS account access - then harden with RBAC, network policy, and scoped IRSA roles.