Unit 01 · 1 h 33 min
How a cloud account is laid out
Find out who you are in the account, map what it contains and learn which parts are yours to secure.
Cloud Security Foundations
Audit a real-looking AWS account and the SaaS around it, replay real breaches and lock down every path they used.
- Time
- 20 h 59 min
- Lessons
- 67
- Machine
- Ubuntu 24.04 LTS
What you earn
RootCertificateCloud Security Foundations, certificate of completion AWSSecurity SpecialtyAWS Certified Security, Specialty ISC2CCSPCertified Cloud Security Professional
*Comparable to AWS Certified Security, Specialty and Certified Cloud Security Professional.
You will be able to
- Predict any IAM decision, including guardrails that override admins
- Find public data, open ports and forgotten regions across an organisation
- Trace and contain leaked keys, and replace CI keys with OIDC roles
- Audit SaaS logins and OAuth grants, not just AWS
- Recover from deletions and outages with tested restores
Units and lessons
Unit 02 · 1 h 52 min
IAM fundamentals and policy evaluation
Read policies the way AWS does: explicit deny first, then allow, and deny by default.
- 1The anatomy of a policy18 min · virtual lab
- 2Explicit deny always wins16 min · virtual lab
- 3Implicit deny and what is missing16 min · virtual lab
- 4Resource policies and Principal18 min · virtual lab
- 5Find who holds the keys to the kingdom22 min · machine
- 6Case file: one phone call to admin22 min · virtual lab
Unit 03 · 1 h 56 min
Identities, roles and keys
Tell users from roles, prefer temporary credentials, and find, trace and rotate a leaked key.
Unit 04 · 1 h 50 min
Storage security
Find public buckets, close them safely, encrypt what matters and share files without making them public.
Unit 05 · 1 h 50 min
Network security in a VPC
Read a VPC, find admin ports open to the internet, close them, require IMDSv2 and turn on flow logs.
Unit 06 · 1 h 50 min
Investigating with CloudTrail
Pull the audit trail, read events, and rebuild exactly what a leaked key did in your account.
Unit 07 · 1 h 30 min
Secrets management
Find passwords hiding in function settings and plain parameters, move them into a secret store and limit who reads them.
Unit 08 · 1 h 34 min
From CI to cloud without stored keys
Replace the pipeline's long-term AWS key with short-lived OIDC credentials, pin what runs and plan rotation after a CI compromise.
Unit 09 · 1 h 40 min
SaaS platforms and integrations
Audit the data platforms and app connections that sit outside your AWS account but hold the same data.
Unit 10 · 1 h 42 min
Serverless, containers and AI services
Close a public function, harden image registries and map what the AI tutor can call and read.
Unit 11 · 1 h 54 min
Guardrails, central logs and resilience
Set rules no account can break, keep logs where attackers cannot reach them, and survive a regional outage.
- 1Accounts, units and where rules attach18 min · machine
- 2Rules even admins cannot break16 min · virtual lab
- 3Case file: intruders who silenced the alerts22 min · machine
- 4Logs the intruder cannot touch18 min · machine
- 5What breaks when a region goes down16 min · virtual lab
- 6Case file: the day us-east-1 went dark24 min · machine
Unit 12 · 1 h 48 min
Capstone: audit the account
Snapshot the account, automate every check from this course, add a Python check and hand over a ranked report.
You join the security team at Brightwell, an online language school with an AI tutor, and audit its AWS organisation, pipelines and SaaS platforms from a shell. Every unit replays a real breach on a simulated account and ends with the fix verified.
* Root is not affiliated with these issuers. See our terms.