Security Specialty Hands-On Labs
A build-it-yourself lab track for the Security – Specialty (SCS-C03) material in The Exam Room. The Specialty exam rewards knowing exactly which control does what and where it belongs; the fastest way to know is to build it. Each lab gives you a working base (CloudFormation plus a couple of scripts) and asks you to build the control that carries the security decision. You deploy real AWS resources, prove the behaviour, and tear it down.
The idea: scaffolding that fades
Same shape as the other tracks. Early labs are almost finished and you fill one
clearly-marked gap; later labs hand you less. Every lab ships a solution/ you
can deploy at any point (SRC=solution), so you are never stuck.
| Scaffold | What you’re given | What you do |
|---|---|---|
| 5/5 | Everything but one value or function body | Fill the gap, deploy, prove it |
| 3/5 | Infra and data, no wiring | Connect the pieces |
| 1/5 | A requirement and a skeleton | Design and build most of it |
| 0/5 | A requirement | Build it from scratch |
Before your first lab
Do the one-time, once-per-account setup: run preflight.sh (it ships in every
lab zip) to confirm your account is ready, then deploy the
lab reaper once. The reaper
auto-deletes any lab you forget to tear down after 24 hours, so a forgotten stack
becomes a deleted stack instead of a running bill. Every Security lab’s deploy.sh
tags its stack for the reaper automatically.
The arc
The track walks the six SCS-C03 domains. It grows over time; the table marks what is built and what is on the bench.
| # | Lab | Domain | Scaffold | Status |
|---|---|---|---|---|
| 01 | Grant KMS access with a key policy, not just IAM | D5 Data protection | 3/5 | built |
| 02 | Auto-quarantine an instance on a GuardDuty finding | D1 Detection/IR | 3/5 | built |
| 03 | Alarm on root-account console login | D2 Logging | 3/5 | built |
| 04 | Cap a role with a permission boundary | D4 IAM | 3/5 | built |
| 05 | Enforce TLS-only and default encryption on a bucket | D3 Infrastructure | 2/5 | planned |
| 06 | Make a log archive immutable with Object Lock | D2 Logging | 1/5 | planned |
Each built lab has a walk-through post you can read alongside it, and is downloadable as a zip if you would rather not clone the repository.
The zips are built by scripts/build-lab-zips (also make lab-zips) into
zips/labs/ and committed, so they publish with the site. Re-run it whenever a
lab changes.