What you can configure and practice
Customers often ask, “Can I practice X on a cloud range?” This page answers that question topic by topic, using two terms with fixed meanings:
- Configure means you can build it in the region, then view and explore it with the AWS CLI, SDKs, or console.
- Practice means a learner can complete the exercise end to end. The data is seeded, and the allow and deny behavior is real.
A topic can be easy to configure but not yet ready to practice. The sections below mark which is which.
Services you can configure
Section titled “Services you can configure”The region is an offline copy of AWS that runs inside your range. It covers the main AWS services. The table and list below show what is included and what isn’t.
| Service | Note |
|---|---|
| IAM, STS | Users, groups, roles, policies and access keys. Policies are enforced, including explicit denies, permission boundaries, session policies and role trust policies. Roles can be assumed with web identity (OIDC) and SAML. Some condition keys aren’t set yet (see what the region doesn’t check yet). |
| Organizations | A seed can create an organization and member accounts. Service control policies apply to callers in member accounts. The management account is exempt, as on AWS. |
| S3 | Buckets, objects, versioning, Object Lock, encryption, website hosting and bucket policies. Bucket policies and ACL grants are enforced. |
| KMS | Keys, aliases, rotation and key policies. Key policies are not enforced yet. |
| Secrets Manager, SSM Parameter Store | Secrets and parameters, including encrypted ones. Resource policies on secrets are not enforced yet. |
| EC2, VPC | Subnets, security groups, network ACLs, peering and endpoints are records you can inspect. A range VM shows up as an instance when you give it the register-as-instance plugin. Traffic between VMs is not filtered by these records. |
| Route 53 | Private hosted zones and records. Public name resolution is not copied. |
| DynamoDB | Tables, indexes, streams and seeded items. |
| RDS, ElastiCache | Coming soon on built ranges. The samples need container images that the offline region cannot download yet. |
| Lambda | Roles and settings are available. The current samples do not include working functions. |
| API Gateway, Cognito | API shells, usage plans, user pools, groups and users. |
| SNS, SQS, EventBridge, Kinesis, Firehose, Step Functions | Topics, queues, rules, streams and workflows. SNS topic policies are enforced. SQS queue policies are not enforced yet. |
| CloudTrail, CloudWatch | Trails, log groups, alarms and dashboards. CloudTrail records only S3 data events today. |
| ECS, Athena, Glue | Task definitions, workgroups and catalogs. |
Not emulated:
- Managed detection services: GuardDuty, Security Hub and Detective.
- WAF and Shield. Web ACLs and DDoS protection are not available.
- Macie, Identity Center and Access Analyzer findings.
- Windows instances inside the region. Use your range VMs for Windows work.
- Real network filtering. Security group and network ACL rules are visible, but they do not block traffic yet.
- ECR image registries. They can be created, but deleting them fails.
- EBS and RDS snapshots. They cannot be created.
Techniques and topics
Section titled “Techniques and topics”The “Start from” column links to the sample list. You can combine samples in one VPC.
| Topic | AWS services | Configure | Practice | Start from |
|---|---|---|---|---|
| Identity and IAM | ||||
| Users, groups, roles, policies and enumeration | IAM | Yes | Yes | IAM users in groups with managed policies |
| Least privilege and permission boundaries | IAM, S3 | Yes | Yes | Permission boundary capping a developer role |
| Over-privileged admin user | IAM | Yes | Yes | Security lab: IAM user with wildcard admin policy |
| Privilege escalation by editing policies or trust | IAM | Yes | Yes | None |
| PassRole escalation | IAM, Lambda | Partial | Partial | Security lab: iam:PassRole privilege escalation path |
| AssumeRole, cross-account access and role chains | IAM, STS | Yes | Yes | Cross-account style assume-role with external ID |
| Access key and login profile abuse | IAM | Partial | Partial | None |
| MFA, break-glass roles and password policy | IAM | Yes | Partial* | Group policy that denies everything without MFA |
| OIDC and web identity federation | IAM, STS | Partial | Partial | OIDC provider and role for GitHub Actions |
| Cognito user pools | Cognito | Partial | Partial | Cognito user pool with app client and groups |
| Tag-based access control | IAM, S3 | Partial | Partial | Consistent tagging baseline across S3, DynamoDB, SNS and IAM |
| Identity Center and Access Analyzer | IAM | Not yet | Not yet | None |
| Organizations, service control policies and multi-account | Organizations | Yes | Partial | None |
| Storage exposure | ||||
| Public buckets, ACLs and bucket enumeration | S3 | Yes | Partial* | Security lab: publicly exposed S3 bucket |
| Sensitive data in unencrypted buckets | S3 | Yes | Yes | Security lab: unencrypted bucket of fake PII |
| Writable bucket abuse | S3 | Partial | Partial | None |
| Data exfiltration from object storage | S3, IAM | Partial | Partial | Source and destination S3 buckets for replication |
| Versioning and Object Lock | S3 | Yes | Partial | S3 bucket with Object Lock retention |
| Cloud database access and exfiltration | DynamoDB, RDS | Partial | Partial | DynamoDB product catalog seeded with items |
| Encryption at rest and in transit | S3, KMS, EBS | Yes | Partial* | S3 bucket policy: TLS only and no unencrypted writes |
| KMS keys, policies and ransomware scenarios | KMS, S3 | Yes | Partial* | Security lab: KMS key whose policy trusts any principal |
| Exposed snapshots | EC2, RDS | Not yet | Not yet | None |
| DNS takeover | Route 53 | Partial | Not yet | Route 53 private hosted zone with internal records |
| Secrets | ||||
| Secrets Manager and Parameter Store extraction | SecretsManager, SSM | Yes | Partial* | Security lab: Secrets Manager secret readable by any principal |
| Leaked keys and hardcoded secrets | SSM, S3, EC2 | Partial | Partial | Security lab: fake access keys leaked in SSM parameters |
| Compute and metadata | ||||
| Instance metadata (IMDS) credential theft | EC2, IAM | Yes | Yes | Give a VM an instance role |
| Container task metadata | ECS | Partial | Not yet | None |
| Remote command execution and Session Manager | SSM, EC2 | Partial | Not yet | None |
| Instance hardening baselines | EC2 | Yes | Partial | Hardened EC2 launch template with IMDSv2 and encrypted disk |
| Creating, stopping and deleting instances | EC2 | Yes | Yes | Web and app instances in separate subnets |
| Cryptojacking and cost abuse | EC2, CloudWatch | Partial | Not yet | None |
| Networking | ||||
| VPC design and segmentation | VPC, EC2 | Yes | Yes | VPC with public and private subnets |
| Open security groups | VPC, EC2 | Yes | Partial† | Security lab: SSH and RDP open to the whole internet |
| Egress control and VPC endpoints | VPC, S3 | Partial | Partial* | Isolated VPC with no internet path |
| WAF and rate limiting | WAF | Not yet | Not yet | None |
| Flow logs | VPC, CloudWatch | Partial | Not yet | VPC flow logs delivered to CloudWatch Logs |
| Logging and detection | ||||
| Audit logging with CloudTrail | CloudTrail, S3 | Partial | Partial | Security lab: CloudTrail trail with logging switched off |
| Alarms and alert routing | CloudWatch, SNS | Partial | Not yet | Metric math error-rate alarm and traffic-drop alarm |
| Log analysis and threat hunting | Athena, Glue, S3 | Partial | Not yet | Athena workgroup with an encrypted results bucket |
| Serverless | ||||
| Lambda code overwrite and persistence | Lambda, IAM | Partial | Not yet | None |
| API security and JWT authorizers | API Gateway, Cognito | Partial | Partial | HTTP API with CORS, routes and an auto-deploy stage |
| Open SNS topics and SQS queues | SNS, SQS | Yes | Partial* | Security lab: SQS queue open to any principal |
| IaC and CSPM | ||||
| Cloud posture scanning | IAM, S3, VPC | Yes | Partial† | Security lab: publicly exposed S3 bucket |
| IaC security scanning | Terraform files | Yes | Partial† | Security lab: unencrypted bucket of fake PII |
| Drift detection | CloudFormation | Not yet | Not yet | None |
| CI/CD pipeline compromise | IAM, S3 | Partial | Not yet | CI artifact bucket encrypted with KMS |
| Container registry and supply chain | ECR | Not yet | Not yet | None |
* Part of what this topic needs isn’t checked yet (see the next section). You can still see and explore the misconfiguration.
† The seeded misconfigurations are there for learners to find. Network rules are not enforced, and scanning tools such as Prowler or Checkov are not on the range image yet.
Some samples also depend on the container-image fix mentioned above. The RDS and ElastiCache samples won’t run on a built range until that fix ships.
What the region doesn’t check yet
Section titled “What the region doesn’t check yet”The region checks IAM policies, service control policies, S3 bucket policies, S3 ACL grants and SNS topic policies. It doesn’t check these yet:
- Resource policies on KMS keys, SQS queues and Secrets Manager secrets.
- VPC endpoint policies. They are stored but not applied.
- S3 Block Public Access, and object ownership for ACLs.
- The condition keys
aws:MultiFactorAuthPresent,aws:SecureTransport,aws:SourceIpands3:x-amz-server-side-encryption. The region never sets them, so a policy sees them as missing. A policy that denies access without MFA denies every request, and a deny for requests without TLS never fires. - Some other condition keys. Request and resource tag, account, region and principal keys work, as do
sts:ExternalId, role session names and some S3, EC2 and DynamoDB keys.aws:PrincipalTagis never set. - A bucket’s default encryption. It is recorded but not applied to uploads.
- A role’s maximum session duration. AssumeRole ignores it.
- A request the region can’t match to an IAM action is allowed.
- On EKS, any key in the account is a cluster admin.
- The range’s container registry (ECR) doesn’t check credentials.
Azure and Google Cloud
Section titled “Azure and Google Cloud”Coming soon. The region technology already has Azure and Google Cloud engines, and support for both is planned. Kubernetes labs run on real clusters in your range and are not part of the cloud region.
What’s next
Section titled “What’s next”- Enforcement for key, queue and secret policies, and for the MFA, TLS and source IP condition keys.
- Lambda-based escalation and persistence labs.
- Seeded log trails for detection and hunting exercises.
- A sample that sets up an organization with service control policies.
- RDS and ElastiCache on built ranges.
- Network rules that filter traffic, and snapshot support.