Skip to content
CertGPS
Career path

AWS Security Certification Path: Choose the Next Exam by the Work You Can Do

Choose an AWS security certification route by your experience: when Cloud Practitioner helps, when to skip it, and how to prepare for Security Specialty.

MC
Michael Chen
Cloud Security Architect
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

AWS Security Certification Path: Choose the Next Exam by the Work You Can Do

An AWS security engineer needs to explain a failed authorization request, recover evidence from an account and keep a workload running while its controls change. Collecting every AWS badge is an expensive way to approach that job. Start at the first skill you cannot yet demonstrate: cloud vocabulary, workload design or security operations across accounts. AWS does not require earlier certifications before Security Specialty.

Start with the work you want to own

For an administrator moving into cloud security, the first useful assignment might be reviewing a role's permissions or fixing a storage policy. An experienced security engineer moving from a data center needs a different foundation: how AWS divides responsibility, how accounts fit together and which services supply evidence. Someone already doing those tasks can start much further along.

Use NIST's NICE Workforce Framework to describe the target work before choosing an exam. NICE organizes cybersecurity work through tasks, knowledge and skills; it does not prescribe an AWS badge ladder. Take a job description you would apply for and turn its responsibilities into a short practice list. If it says incident response, include collecting evidence and explaining containment. If it says architecture, include a design decision and its operational consequences.

Our cloud security engineer path covers the broader role. This route focuses on the AWS knowledge you would add to it. A portfolio should show what you configured, why you chose it and how you checked the result, with credentials and customer data removed.

Cloud Practitioner is useful when the vocabulary is new

AWS describes Cloud Practitioner as foundational cloud literacy, suitable for people without an IT or cloud background and for business roles. AWS lists a US$100 exam, with 65 questions in 90 minutes. That scope can help a career changer connect cloud billing, service names and the shared responsibility model before taking on administration.

We would skip the paid exam if you already administer AWS and can explain those basics to a colleague. You can study the material without buying the credential. For someone in procurement or project management, the foundational credential may be the right destination for now; a specialist security exam would test work they do not perform.

A useful readiness exercise is to describe a small application's components and identify who owns the operating system, access configuration and data protection for each. Then explain which costs continue when the application is idle. If those explanations are still vague, use the foundational training before buying a more technical exam.

Learn workload design before specializing

AWS recommends at least a year of hands-on solution design for Solutions Architect - Associate. Its published exam is US$150, with 65 questions in 130 minutes. AWS also identifies candidates with strong on-premises IT experience as a possible audience. Cloud Practitioner is a helpful starting point for some candidates, not a prerequisite for this route.

The associate stage is worth taking seriously because security decisions affect availability and operations. Practise drawing an application across network boundaries, explaining how it authenticates and identifying what happens when a component fails. Compare two possible designs against the same requirements. Save the decision record with the deployment instructions so another person can review your reasoning.

We would take this exam before Security Specialty when service selection and architecture are still the main gaps. A developer who already deploys AWS applications may prefer to study the missing architecture objectives and go directly to the security material. Passing an associate exam does not establish that you have operated the design under incident conditions.

Move to Security Specialty when you can troubleshoot controls

The current AWS Certified Security - Specialty exam is SCS-C03. AWS lists US$300, 65 questions and 170 minutes. Its recommended experience is substantial: five years in IT security and at least two years securing AWS workloads. Those are recommendations, not an application experience requirement like CISSP's.

AWS's SCS-C03 guide divides the assessment into detection, incident response, infrastructure security, identity and access management, data protection, and security foundations and governance. Use that scope to find missing experience. Working only on network controls can leave a gap in key management or organization-wide logging even if your daily work is demanding.

The IAM domain asks candidates to design and troubleshoot access across identity policies, resource policies and other controls. In a sandbox, make an authorization request fail for a known reason, then document how you identified the relevant policy. Change the configuration and repeat the check. The evidence should show that the access now matches the intended permissions.

Governance adds work across accounts. Read the domain's objectives on centralized access and policy controls before assuming that experience in a single account is enough. A good practice review explains which team can change a guardrail and how an exception would be approved. Use the Security Specialty study guide for the detailed exam and lab plan.

Budget for a route you will actually use

At AWS's published undiscounted US prices, the three exams total US$550 before tax, training, retakes or lab usage. That is arithmetic from the listed prices, not a recommended minimum investment. Taking only the specialist exam has a different cost, and an experienced practitioner may have no reason to buy the foundational tests.

AWS gives certified people a discount benefit for a subsequent exam. Check your Certification Account before paying and keep that benefit separate from promotional offers. Avoid booking the next test simply to use a voucher: the preparation and account usage can cost more than the saving.

Decide who will pay for lab resources and how you will remove them. For employer sponsorship, propose a specific deliverable such as an access review, an incident exercise or a logging design that your team can assess. Do not promise a salary increase or a promotion in return for the exam; AWS's assessment cannot decide those outcomes.

Renewal and the next useful step

AWS certifications last three years, but renewal options differ by credential. Its recertification page lets Security Specialty holders renew through the current exam for a three-year extension or use paid Skill Builder maintenance for a one-year extension. The maintenance route opens within 90 days of expiry. Check the exact credential row instead of assuming any higher-level exam renews everything below it.

After Security Specialty, choose the next gap in your work. CCSP can add a broader cloud perspective; CKS fits someone responsible for Kubernetes security. Neither should be an automatic next purchase. We'd spend the next learning budget on the control or investigation you cannot yet handle, then choose a credential only if its objectives test that work.

Sources