Unit 01 · 1 h 33 min
How a cloud account is laid out
Find out who you are in the account, map what it contains and learn which parts are yours to secure.
Cloud Security Foundations
Audit a real-looking AWS account and the SaaS around it, replay real breaches and lock down every path they used.
- Time
- 20 h 59 min
- Lessons
- 67
- Machine
- Ubuntu 24.04 LTS
What you earn
RootCertificateCloud Security Foundations, certificate of completion AWSSecurity SpecialtyAWS Certified Security, Specialty ISC2CCSPCertified Cloud Security Professional
Prepares you for AWS Certified Security, Specialty and Certified Cloud Security Professional. Root is not affiliated with these issuers.
You will be able to
- Predict any IAM decision, including guardrails that override admins
- Find public data, open ports and forgotten regions across an organisation
- Trace and contain leaked keys, and replace CI keys with OIDC roles
- Audit SaaS logins and OAuth grants, not just AWS
- Recover from deletions and outages with tested restores
Units and lessons
Unit 02 · 1 h 52 min
IAM fundamentals and policy evaluation
Read policies the way AWS does: explicit deny first, then allow, and deny by default.
- 1The anatomy of a policy18 min · virtual lab
- 2Explicit deny always wins16 min · virtual lab
- 3Implicit deny and what is missing16 min · virtual lab
- 4Resource policies and Principal18 min · virtual lab
- 5Find who holds the keys to the kingdom22 min · machine
- 6Case file: one phone call to admin22 min · virtual lab
Unit 03 · 1 h 56 min
Identities, roles and keys
Tell users from roles, prefer temporary credentials, and find, trace and rotate a leaked key.
Unit 04 · 1 h 50 min
Storage security
Find public buckets, close them safely, encrypt what matters and share files without making them public.
Unit 05 · 1 h 50 min
Network security in a VPC
Read a VPC, find admin ports open to the internet, close them, require IMDSv2 and turn on flow logs.
Unit 06 · 1 h 50 min
Investigating with CloudTrail
Pull the audit trail, read events, and rebuild exactly what a leaked key did in your account.
Unit 07 · 1 h 30 min
Secrets management
Find passwords hiding in function settings and plain parameters, move them into a secret store and limit who reads them.
Unit 08 · 1 h 34 min
From CI to cloud without stored keys
Replace the pipeline's long-term AWS key with short-lived OIDC credentials, pin what runs and plan rotation after a CI compromise.
Unit 09 · 1 h 40 min
SaaS platforms and integrations
Audit the data platforms and app connections that sit outside your AWS account but hold the same data.
Unit 10 · 1 h 42 min
Serverless, containers and AI services
Close a public function, harden image registries and map what the AI tutor can call and read.
Unit 11 · 1 h 54 min
Guardrails, central logs and resilience
Set rules no account can break, keep logs where attackers cannot reach them, and survive a regional outage.
- 1Accounts, units and where rules attach18 min · machine
- 2Rules even admins cannot break16 min · virtual lab
- 3Case file: intruders who silenced the alerts22 min · machine
- 4Logs the intruder cannot touch18 min · machine
- 5What breaks when a region goes down16 min · virtual lab
- 6Case file: the day us-east-1 went dark24 min · machine
Unit 12 · 1 h 48 min
Capstone: audit the account
Snapshot the account, automate every check from this course, add a Python check and hand over a ranked report.
You join the security team at Brightwell, an online language school with an AI tutor, and audit its AWS organisation, pipelines and SaaS platforms from a shell. Every unit replays a real breach on a simulated account and ends with the fix verified.