SANS Institute is the top pick for AWS security training when there is a budget, with an AWS-only course (SEC480) and two multicloud courses that lead to GIAC certifications. For the AWS Certified Security Specialty, AWS’s own Skill Builder prep plan and classroom course are the most direct route. For offensive skill, HackTricks Training’s AWS Red Team Expert path stands out, with more than 50 labs across more than 20 AWS services.
Our list of the top AWS security training courses and bootcamps mixes red team bootcamps, defensive engineering courses, certification prep and free practice targets, because most people need a bit of each. If you want a wider view across Azure and Google Cloud, see our guide to the top cloud security training providers, and if your goal is a credential that proves you can attack cloud environments, compare the top cloud penetration testing certifications.
We checked every provider’s own site for course content, format and pricing in October 2026.
AWS Security Training Courses And Bootcamps At A Glance
Provider
Format
Best For
Key Course Or Cert
SANS Institute
Live, in person or OnDemand
Teams with training budgets
SEC480, SEC510, SEC541
AWS Training And Certification
Skill Builder, classroom, exam
Official certification route
Security Engineering on AWS, SCS-C03
HackTricks Training
Video course with labs and exam
Advanced AWS red teaming
ARTE (AWS Red Team Expert)
Cybr
Membership with lab library
Many short AWS labs
AWS Security Specialty Premium Edition
TryHackMe
Browser-based guided learning path
Guided attack and defense rooms
Attacking and Defending AWS path
Adrian Cantrill
Self-paced video course
Deep exam theory and demos
AWS Certified Security Specialty
Redfox Security
Live online bootcamp
Structured live pentest class
AWS Pentesting Bootcamp, CAPT exam
Tutorials Dojo
Practice exams and video course
Final exam readiness
SCS-C03 Practice Exams
Rhino Security Labs CloudGoat
Free, self-hosted scenarios
Practice in your own account
25 vulnerable AWS scenarios
flAWS and flAWS 2
Free browser challenges
First steps in AWS attacks
Attacker and defender paths
Best AWS Security Training Courses And Bootcamps In 2026
1. SANS Institute — AWS Secure Builder Plus Two GIAC Multicloud Courses
SANS has three courses that matter for AWS work. SEC480: AWS Secure Builder is the AWS-only option: 16 hours, self-paced, nine hands-on labs and four months of access. It covers shared responsibility, workload hardening, CI/CD pipeline security, IAM, logging and monitoring, attack surface reduction, incident response and AI services in AWS, and includes one attempt at the GIAC AWS Secure Builder Micro-Credential. As listed on its site in October 2026, it costs $1,300.
For deeper engineering, SEC510: Cloud Security Engineering and Controls covers AWS alongside Azure and Google Cloud with 52 labs, five days live or 38 hours OnDemand, and leads to the GIAC Public Cloud Security (GPCS) certification. SEC541: Cloud Security Threat Detection covers AWS, Azure and Microsoft 365 with 22 labs and a capture the flag capstone, leading to GIAC Cloud Threat Detection (GCTD). OnDemand prices were $8,780 for SEC510 and $8,260 for SEC541 as listed in October 2026.
Best for: security and cloud teams whose employers pay for training and value GIAC certifications.
AWS’s own training is the reference point for the AWS Certified Security Specialty. The current exam, SCS-C03, replaced SCS-C02 in December 2025. It runs 170 minutes with 65 multiple choice or multiple response questions and costs $300 as listed on the AWS site in October 2026. Skill Builder lays out a four-step exam prep plan with exam-style questions, the official practice question set, digital courses, AWS Builder Labs, AWS Cloud Quest, AWS Jam, AWS SimuLearn and an Official Pretest.
The instructor-led option is Security Engineering on AWS, a three-day course delivered by AWS and its authorized training partners. Its 15 modules cover IAM and Access Analyzer, data protection with KMS and CloudHSM, VPC and network security, centralized logging with CloudWatch, Config and Macie, log analysis with Athena, DDoS protection with WAF and Shield, serverless security, threat detection with GuardDuty, Security Hub and Detective, and governance with Organizations and Control Tower. This is defensive, architecture-focused training rather than offensive work.
Best for: engineers who want the certification and training straight from the platform vendor.
3. HackTricks Training — AWS Red Team Expert Path With 50+ Labs Across 20+ Services
HackTricks Training is the course arm of the team behind the HackTricks and HackTricks Cloud knowledge bases that many pentesters already use as a reference. Its ARTE (AWS Red Team Expert) path combines more than 20 hours of video, more than 50 hands-on labs and a final exam. Lab access lasts 60 days, with extensions available at checkout.
The content is split into an introduction to AWS, exploitation of AWS services, red team and whitebox methodologies, and common detection mechanisms. You learn to find, exploit and chain misconfigurations across more than 20 AWS services, with time spent on IAM, encryption and advanced networking protections. As listed on its site in October 2026, ARTE costs €1,099. HackTricks Training S.L. is based in Madrid, Spain.
Best for: experienced testers who want breadth across many AWS services and a red team methodology.
4. Cybr — 93 AWS Hands-On Labs With 33 Free Labs In The Library
Cybr is a training platform built mostly around AWS. Its lab library listed 121 labs in October 2026, 93 of them tagged AWS, with a near even split of red team and blue team labs and 33 labs available free. Collections focus on IAM, Amazon S3, AWS Lambda, monitoring and detection, and Security Specialty practice. Labs deploy with one click, so you do not need your own sandbox account.
For certification, the AWS Certified Security Specialty Premium Edition targets SCS-C03 with 46 lessons, 24 quizzes and 17 labs on GuardDuty, Inspector, KMS, S3 presigned URLs, CloudFormation Guard, SSM Session Manager and VPC Flow Logs. Premium content comes with a membership listed at $20 per month in October 2026, and single courses such as Introduction to AWS Security sell separately ($25.99 as listed), though labs require membership.
Best for: learners who want many short, focused AWS labs on a monthly budget.
5. TryHackMe — Attacking And Defending AWS Path With 17 Hands-On Labs
TryHackMe, a London-based training platform, runs a dedicated Attacking and Defending AWS learning path. It is rated intermediate and is split into five modules with 17 hands-on labs: an introduction to AWS, IAM basics, attacking and defending core services such as EC2, S3, VPC and KMS, serverless security covering Lambda and API Gateway, and IAM privilege escalation. Rooms include IAM enumeration, IAM initial access and Lambda data exfiltration.
Each room runs in the browser against a sandboxed AWS environment that TryHackMe manages, so you practice on real AWS services without opening your own account or worrying about a bill. The guided, step-by-step room format suits people moving from general security into cloud work. TryHackMe has sold the path as a separate purchase with time-limited access, so check the current price and access period on its site before you buy.
Best for: security learners who want guided attack and defense rooms in a managed AWS sandbox.
6. Adrian Cantrill — Security Specialty Course With About 200 Lessons And Console Demos
Adrian Cantrill’s courses are known for explaining how AWS services work underneath, not just what to memorize. His AWS Certified Security Specialty course runs to roughly 200 lessons, with dozens of console demos and a multi-part web identity federation mini project. It walks through each exam domain in order, from threat detection and incident response to identity, data protection and governance.
As listed on its site in October 2026, enrollment costs $80, with an installment option. One thing to know: the course page still labels its content as updated for SCS-C02, while the live exam is now SCS-C03, so pair it with a C03 resource such as current practice exams to cover new topics. The depth of the theory still transfers well to real AWS security work.
Best for: learners who want to understand AWS security services in depth before sitting the exam.
7. Redfox Security — Four Live Saturday Sessions On AWS Penetration Testing
Redfox Security’s academy runs a live AWS Pentesting Bootcamp for people who learn better with an instructor and a schedule. The November 2026 cohort meets on Zoom over four consecutive Saturdays (November 7, 14, 21 and 28, 2 pm to 8 pm IST), about six hours per session, led by principal security consultant Shashi Kant Prasad. Recordings are shared after each class, and students join a private Discord.
The AWS penetration testing syllabus moves from AWS foundations and IAM exploitation to EC2 and S3 attacks, including metadata SSRF and credential theft, then serverless and federation (Lambda, API Gateway, Cognito), KMS and Secrets Manager abuse, infrastructure as code attacks, detection evasion and report writing. You get more than 30 practical exercises, 30 days of lab access and one attempt at the CAPT exam within 30 days. As listed on its site in October 2026, the bootcamp costs $249.
Best for: learners who want a live, time-boxed AWS security bootcamp with report writing practice.
8. Tutorials Dojo — 140 SCS-C03 Practice Questions In Four Test Modes
Tutorials Dojo, based in the Philippines, is one of the most used sources of AWS certification practice exams. Its AWS Certified Security Specialty SCS-C03 Practice Exams include 140 questions with four modes: Timed, Review, Section-Based Tests and a Final Test that draws 65 random questions, matching the real exam length. Bonus flashcards are included, and access lasts one year.
As listed on its site in October 2026, the practice exams cost $17.99. A separate SCS-C03 video course ($12.99 as listed) adds console demos and scenario-based Exam Labs with guided walkthroughs. Tutorials Dojo does not replace a full course, but it is a cheap, reliable way to find weak domains in the final weeks before your exam date.
Best for: candidates who have studied the material and need realistic timed practice.
CloudGoat is Rhino Security Labs’ open source “vulnerable by design” tool. It deploys capture the flag style scenarios into your own cloud account, and the repository listed 25 scenarios in October 2026: 8 easy, 12 medium and 5 hard. Rhino has published walkthroughs for several of them, including EC2 SSRF and a re-creation of the Capital One style S3 breach.
It is free under a BSD 3-Clause license, but it is not a course. You need Linux or macOS, Python 3.9 or later, Terraform 1.5 or later, the AWS CLI and an AWS account with rights to create and destroy resources. The project warns that it creates intentionally vulnerable resources, so use a dedicated sandbox account, never production, and tear scenarios down when you finish.
Best for: self-directed learners who want free, repeatable attack practice in a real AWS account.
10. flAWS And flAWS 2 — Free Browser Challenges With Separate Attacker And Defender Paths
flAWS.cloud and its sequel flAWS 2 are free web-based challenges built by Scott Piper, with the original credited to Summit Route. They focus on AWS-specific mistakes rather than general web bugs, and for years they have been the first stop for people learning how S3 buckets, IAM credentials and metadata endpoints get abused.
flAWS 2 adds two tracks. The Attacker path has you exploit misconfigurations in a serverless (Lambda) and container (ECS Fargate) application. The Defender path puts you in the incident responder’s seat, analyzing logs from a previous attack on the same app with jq and setting up Athena in your own environment. The author recommends playing the Attacker path first. There are no labs to deploy and no certificate, just a quick, practical introduction.
Best for: beginners who want a free first look at how AWS environments get breached and investigated.
How To Choose The Right AWS Security Training
Do You Need Offensive Or Defensive Skills?
Start with your job. Pentesters and red teamers get the most from HackTricks Training, Redfox Security, TryHackMe and CloudGoat, which teach enumeration, IAM privilege escalation and lateral movement. Cloud security engineers and SOC analysts get more from SANS SEC480, SEC510 and SEC541 and from Security Engineering on AWS, which focus on hardening, logging and detection. Courses that cover both sides, like the TryHackMe path and SANS SEC541, are a good middle ground.
Is A Certification Part Of The Goal?
If you need a credential that recruiters filter for, the AWS Certified Security Specialty is the obvious one, and the cheapest path is Skill Builder plus Cybr or Adrian Cantrill and Tutorials Dojo practice exams. If you want proof of hands-on attack skill, look for courses that end in a practical exam, such as HackTricks Training’s ARTE or the Redfox CAPT exam. GIAC certifications through SANS carry weight in enterprise and government hiring.
How Much Lab Time Will You Actually Get?
Count the labs and check how long access lasts. Lab windows range from 30 days (Redfox) and 60 days (HackTricks) to four months (SANS OnDemand) or ongoing with a membership (Cybr). Hosted labs save you from building your own environment and from surprise AWS bills, while CloudGoat gives unlimited practice if you are comfortable managing a sandbox account. If you mainly want lab volume, our list of cyber ranges and hands-on security training platforms compares broader lab libraries.
Do You Learn Better Live Or Self-Paced?
Self-paced courses are cheaper and fit around work, but completion rates drop without deadlines. Live formats such as SANS events, AWS classroom training and the Redfox Saturday cohort give you an instructor to question and a fixed schedule. If you choose self-paced, block study time in your calendar and book the exam date early.
Frequently Asked Questions
Is The AWS Certified Security Specialty Worth It In 2026?
For cloud security engineers and architects, yes. It is the vendor’s own security credential, it was refreshed as SCS-C03 in December 2025, and it costs $300 per attempt. It proves you understand AWS security services and design, but it is a multiple choice exam, so pair it with hands-on labs if you also want practical skill.
Can I Learn AWS Penetration Testing For Free?
Yes, to a point. flAWS and flAWS 2 run in the browser for free, CloudGoat provides 25 free scenarios you deploy into your own account, and Cybr offers 33 free labs. Free resources cover the core attack paths well. Paid bootcamps add structure, support, detection content and a certification.
Do I Need My Own AWS Account For These Labs?
Only for self-hosted tools such as CloudGoat and parts of the flAWS 2 defender path. Hosted platforms like Cybr, TryHackMe, HackTricks Training and SANS provide the lab environments. If you use your own account, keep it separate from anything real, set a billing alert and destroy resources after each session.
Conclusion
The best AWS security training depends on whether you want to break AWS environments, defend them or pass the Security Specialty exam. HackTricks Training and TryHackMe lead for offensive skill, SANS and AWS’s own courses lead for defensive engineering, and Cybr, Adrian Cantrill and Tutorials Dojo cover the certification route at low cost. Free tools like CloudGoat and flAWS are worth doing whichever path you pick.
