AWS Hardening Lab: SCPs, S3 and KMS Decisions
Your company grew up in one AWS account. You are moving it to an organization with guardrails: protect the root user, sign people in with temporary access, set service control policies, block public buckets, write a safe KMS key policy and keep logs out of an attacker's reach. For the response side, play the AWS Account Compromise Lab. For the reference design, read Secure AWS architecture.
You are Alex Morgan, the new head of cloud security at Quillstack Software. The company grew up in one AWS account and is now moving to a governed organization. Across 10 decisions you choose preventive controls: the root user, workforce access, service control policies, S3 Block Public Access, KMS key policy, the log archive, resource control policies, instance access, network paths and the baseline. Everything is fictional and no commands appear. Each call is scored 0 to 10 with the AWS documentation behind the rationale. The reactive side is in the AWS Account Compromise Lab.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
4 points
- A scenario lab for the preventive side of AWS security. You are the new head of cloud security moving a company from one account to a governed organization, and you make 10 scored decisions.
- Decisions cover the root user, workforce sign-in with IAM Identity Center, account structure, service control policies, S3 Block Public Access, a KMS key policy, an immutable log archive, resource control policies, instance access and network paths, and the baseline you measure against.
- Each decision is scored 0 to 10 with the AWS documentation behind it, read on 4 November 2026. Wording is ours; nothing is copied from AWS.
- Free to play. Fictional company, documentation account ids, no commands or policy code. The debrief can be downloaded through the usual download gate.
Frequently asked questions
What does the AWS Hardening Lab teach?
How to choose preventive controls when moving from one AWS account to a governed organization: protecting the root user, using IAM Identity Center, structuring accounts, writing safe service control policies, blocking public S3 access, setting a KMS key policy, building an immutable log archive, limiting external access with resource control policies, closing inbound ports and measuring against a baseline.
Do SCPs grant permissions?
No. A service control policy sets the maximum permissions for IAM users and roles in member accounts. Something else, such as an identity-based or resource-based policy, must still grant access. SCPs also do not affect the management account or service-linked roles.
How is S3 Block Public Access applied?
It has four settings that can be applied to an access point, a bucket or an account. At the organization level all four are applied together as one policy. When levels differ, S3 applies the most restrictive combination.
Why does the KMS key policy matter?
The key policy is the primary way to control access to a KMS key. Nobody, including the root user or the key creator, has permission unless a key policy, IAM policy or grant allows it, and IAM policies only work if the key policy allows that. Key policies are Regional.
How is this different from the AWS Security Checklist and the CIS AWS Benchmark Checklist?
This is a scenario you play, with branching feedback. The AWS Security Checklist is a weighted self-assessment you tick through, and the CIS AWS Benchmark Checklist follows the CIS control list.
Is it free?
Yes, you can play it free. Downloading the debrief as a document goes through the site download gate.
Sources
AWS documentation pages read on 4 November 2026. The scenario is fictional; the controls and finding names are from these pages.
- AWS IAM: Root user best practices for your AWS account
- AWS IAM: Security best practices in IAM
- AWS IAM Identity Center: What is IAM Identity Center?
- AWS IAM Identity Center: Permission sets
- AWS Well-Architected Framework, Security Pillar: Security foundations (design principles, seven areas)
- Security Pillar: AWS account management and separation
- AWS Security Reference Architecture (AWS SRA): core architecture, introduction
- AWS SRA: Org Management account
- AWS SRA: Security OU, Log Archive account
- AWS SRA: Workloads OU, Application account
- AWS Control Tower: What is AWS Control Tower?
- AWS Organizations: Service control policies (SCPs)
- AWS Organizations: Service control policy examples
- AWS Organizations: Resource control policies (RCPs)
- Amazon S3: Blocking public access to your Amazon S3 storage
- AWS IAM: What is IAM Access Analyzer?
- AWS KMS: Key policies in AWS KMS
- AWS KMS: Deleting AWS KMS keys
- AWS CloudTrail: Creating a trail for an organization
- AWS CloudTrail: Validating CloudTrail log file integrity
- AWS CloudTrail: Logging data events
- AWS Systems Manager: Session Manager
- AWS WAF: What is AWS WAF?
- AWS Config: What is AWS Config?
- AWS Security Hub: CIS AWS Foundations Benchmark in Security Hub CSPM
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.