Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
This guide covers the AWS Certified Security Specialty as of October 2026: the SCS-C03 exam that replaced SCS-C02 in December 2025, the six domains and their weights, the format and the 750 passing score, DoD 8140 status, the cloud security roles it fits, and where it sits on the AWS path.
The AWS Certified Security - Specialty is Amazon Web Services’ certification for people whose job is securing workloads on AWS. It sits in AWS’s Specialty tier, outside the Associate and Professional ladder.
AWS says it validates expertise in creating and implementing security solutions in the AWS Cloud, including data classification, encryption methods and secure internet protocols, along with the AWS mechanisms behind each. In practice the exam hands you a scenario and asks for the control that fits, weighing cost, security and deployment complexity against each other. That is the call a cloud security engineer makes all the time, and it is why memorizing service names gets you only part of the way.
There are no formal prerequisites, but AWS recommends five years of IT security experience and two years securing AWS workloads. The certification is issued and maintained by Amazon Web Services, and the current exam is SCS-C03, in use since December 2, 2025. The Specialty tier lists only two exams today, and the other one, Advanced Networking, has its last exam day on December 31, 2026.
Monitoring, alerting and logging for an account or a whole organization. 16%.
Response plans, forensic capture, containment and root cause analysis. 14%.
Edge, compute and network controls, plus generative AI guardrails. 18%.
Authentication and least-privilege authorization. The largest domain at 20%.
Encryption in transit and at rest, secrets, and key material. 18%.
Multi-account strategy, secure deployment and compliance checks. 14%.
Four things that set the Security Specialty apart from the other AWS certifications and from vendor-neutral cloud security credentials in 2026.
Security is one domain among several on the Solutions Architect and CloudOps Associate exams. SCS-C03 spends all 65 questions on it, from GuardDuty and Security Hub findings to KMS key policies, service control policies, AWS WAF rules and IAM troubleshooting. That depth is what makes it read differently from an Associate certification on a résumé.
AWS’s exam guide says SCS-C03 tests decisions that weigh cost, security and deployment complexity against each other. Expect scenarios where more than one answer would stop the threat and only one meets every requirement in the question.
SCS-C03 added a task on guardrails for generative AI applications, with the OWASP Top 10 for LLM Applications as the reference, plus data masking and multi-Region key management. Our rundown of what changed in AWS certifications in 2026 covers the wider rebuild.
The Security Specialty is not a DoD 8140 credential. It isn’t an approved option for any work role in the Qualification Matrix V2.1, so on its own it will not satisfy a cyber-coded position requirement. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the platform instead. AWS writes it against its own security services and revises it as they change, and once Advanced Networking retires at the end of 2026 it will be the only Specialty exam left on AWS’s list. Domain 6 even includes reviewing architectures against the security guidance in the AWS Well-Architected Framework.
The certification, the SCS-C03 exam, and how to keep it current, as of October 2026.
From here the path runs further into AWS automation, or out to a vendor-neutral credential that covers what an AWS-only certification can’t, including DoD 8140. The three paths below are the common next moves.
AWS names the DevOps Engineer Professional (DOP-C02) as a next step for people heading into DevSecOps roles. It is a Professional-level exam, 75 questions in 180 minutes, built around automating the testing and deployment of AWS infrastructure and applications, which is where security controls end up living in a mature AWS shop.
ISC2’s Certified Cloud Security Professional covers cloud security across providers and is approved on the DoD 8140 matrix, the gap the Security Specialty leaves open. It requires five years of IT experience, three of them in security. Read the CCSP guide.
ISC2’s broad security credential, approved at the Advanced level for 11 DCWF work roles, with a five-year experience requirement across two or more of its eight domains. It suits a cloud security engineer moving toward architecture or security management. Read the CISSP guide.
The Security Specialty sits in AWS’s Specialty tier. AWS says candidates commonly earn a Solutions Architect certification first, and from here the path goes deeper into AWS or out to vendor-neutral security credentials.
The AWS groundwork
Security on AWS
Two questions to answer before you commit: can you sit it, and should you pursue the Security Specialty specifically. Here’s a straight answer to both.
No prerequisite certification.
AWS doesn’t require an Associate certification or any other credential before the Security Specialty. You can register for SCS-C03 directly and test at a Pearson VUE center or through online proctoring, in English, Japanese or Korean, plus three more languages until the end of 2026.
This is rarely a good first AWS exam.
AWS recommends five years of IT security work and two years securing AWS workloads, far more than the one year it suggests for the Solutions Architect Associate. Without that background, the Associate first is the more realistic order, and it is the route AWS describes. Spend the time in a real account with IAM, KMS and AWS Organizations, because the scenarios assume you have.
The Security Specialty maps to cloud security roles in organizations that run on AWS. These six titles line up with it most directly.
Builds and runs the security controls in an AWS environment day to day: GuardDuty and Security Hub findings, KMS keys, IAM policies and WAF rules. Of the six roles here, this is the one the exam tracks most closely.
Designs the security model a multi-account AWS organization runs on, from account structure and service control policies to encryption and network segmentation. AWS notes that candidates commonly hold a Solutions Architect certification before this one.
Puts security checks into the pipeline and the infrastructure code, with tools such as CloudFormation Guard, Amazon Inspector image scanning and Patch Manager automation. AWS names DevSecOps among the job roles the certification supports.
Investigates and contains incidents in AWS, working from CloudTrail, VPC Flow Logs and Amazon Detective rather than disk images. The Detection and Incident Response domains together are 30 percent of SCS-C03.
Owns federation, permission sets, least-privilege policies and cross-account access. Identity and Access Management is the largest SCS-C03 domain at 20 percent, so this role gets a lot out of the study time.
Assesses and hardens client AWS environments and gets them ready for audits. The governance domain, with AWS Config rules, Audit Manager and AWS Artifact, covers the evidence side of that work.
The Solutions Architect Associate is the AWS exam candidates commonly earn first, and CCSP is the vendor-neutral alternative. Here’s how the three line up.
| AWS Security Specialty | Solutions Architect Associate | CCSP | |
|---|---|---|---|
| Issuer | AWS | AWS | ISC2 |
| Level | Specialty | Associate | Professional |
| Focus | Securing AWS workloads | Designing AWS architectures | Cloud security across providers |
| Prerequisites | None (rec. 5 yrs security, 2 on AWS) | None (rec. 1 year) | 5 yrs IT (3 security, 1 in domain) |
| Exam | 65 items, 170 min | 65 items, 130 min | Adaptive, 100 to 150 items, 3 hrs |
| Passing Score | 750 of 1000 | 720 of 1000 | 700 of 1000 |
| Exam Cost | $300 | $150 | ~$599 |
| Renewal | Pass latest exam every 3 years | Recertify every 3 years | 90 CPEs over 3 years |
| DoD 8140 Matrix | Not listed | Not listed | Approved (Int. to Advanced) |
| Best For | Cloud security engineers on AWS | Cloud architects and engineers | Multi-cloud security professionals |
Pricing varies by region. AWS prices are as of October 2026. Solutions Architect Associate and CCSP details come from the Training Camp guides for the Solutions Architect Associate and CCSP.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our AWS Security Specialty boot camp covers the six SCS-C03 domains in three days of live, instructor-led training, in person or online. It uses official AWS courseware with hands-on labs in a provided environment, and practice questions, mock exams, your $300 exam voucher, and a free retake are all included.
The SCS-C03 changes, hands-on AWS controls, cloud incident response, and the Azure and vendor-neutral alternatives.
Where the Security Specialty sits in the 2026 AWS lineup: the SCS-C03 rebuild and its AI and machine learning security coverage, the retired Machine Learning Specialty, and which exams to plan around now.
MFA, least-privilege access, CloudTrail, S3 bucket protection and AWS Config rules, each set up in 15 minutes or less. A hands-on start on controls the exam covers in far more depth.
Why on-premises incident response habits break down in the cloud: the shared responsibility model, identity as the new perimeter, and evidence that disappears with short-lived resources.
The ten agentic AI risks and how they differ from the OWASP Top 10 for LLM Applications, the list SCS-C03 uses as its reference for generative AI guardrails.
Symmetric and asymmetric encryption, protecting data at rest, in transit and in use, and the key management failures that undo good algorithms. Background for the 18 percent Data Protection domain.
The Azure side of cloud security. What replaced Microsoft’s Azure security engineer exam, what SC-500 tests that AZ-500 never did, and what happens to an AZ-500 you already hold.
The vendor-neutral route. How ISC2’s cloud security credential compares with CISSP on scope, difficulty and who each one fits, for anyone weighing a credential that covers every provider.
The SCS-C03 exam is organized into six domains, each carrying its own weight. Identity and Access Management is the largest at 20 percent, and no domain falls below 14 percent, so there is no section you can safely skip. Click any domain for what it covers.
Designing monitoring and alerting for a single AWS account or a whole organization, then building the logging underneath it: an organization CloudTrail trail, a dedicated CloudWatch logging account, Amazon Security Lake as a log data lake, and VPC Flow Logs, transit gateway flow logs and Route 53 Resolver logs picked to match the threats you expect. It also covers analyzing logs with CloudWatch Logs Insights and Athena, and fixing the missing logs and broken CloudWatch agent configurations that leave blind spots.
Writing and testing the response plan before you need it, with runbooks in Systems Manager OpsCenter, Shield Advanced protections set up in advance, and plan testing through AWS Fault Injection Service and Resilience Hub. When an event happens, the domain covers capturing logs as forensic artifacts, validating findings from AWS security services to judge scope and impact, containing and eradicating the threat, restoring from backup, and working out root cause with Amazon Detective.
Controls at three layers. At the edge, AWS WAF rules, rate limiting, geolocation rules, CloudFront headers and Shield Advanced. On compute, hardened AMIs and container images from EC2 Image Builder, vulnerability scanning with Amazon Inspector, patching with Patch Manager, and administrative access through Session Manager and EC2 Instance Connect. On the network, security groups, network ACLs, AWS Network Firewall, Site-to-Site VPN, Direct Connect with MACsec, and segmentation. SCS-C03 also adds guardrails for generative AI applications, with the OWASP Top 10 for LLM Applications as the reference.
The largest domain. Authentication for people, applications and systems through IAM Identity Center, Amazon Cognito, MFA and identity provider federation, plus temporary credentials from AWS STS and S3 presigned URLs. Authorization is the other half: least-privilege IAM policies, permission boundaries and session policies, ABAC and RBAC designs, cross-account resource policies and role trust policies, and tracing an access denied error with the IAM Policy Simulator and IAM Access Analyzer.
Encryption in transit (ELB security policies, enforced TLS, PrivateLink and VPC endpoints, inter-node encryption for EMR, EKS and SageMaker AI) and at rest (choosing between AWS KMS and CloudHSM, client-side or server-side encryption). From there it moves to integrity and retention controls such as S3 Object Lock and Glacier Vault Lock, backups with AWS Backup, secret rotation in Secrets Manager, imported key material and external key stores, masking sensitive data in CloudWatch Logs and SNS, and managing keys and certificates across Regions.
Running security across many accounts. AWS Organizations, Control Tower and its controls, service control policies, resource control policies and declarative policies, delegated administrator accounts, and centralized root access with break-glass procedures. Then consistent deployment with CloudFormation StackSets, CloudFormation Guard and cfn-lint, Firewall Manager, Service Catalog and AWS RAM, and compliance checks with AWS Config rules, Security Hub, Audit Manager and AWS Artifact.
Domains and weights reflect the AWS Certified Security - Specialty (SCS-C03) exam guide, version 1.0. AWS publishes exam guide updates about a month before they show up on the exam, so check the current guide before you schedule.
The questions candidates ask most often when researching the AWS Certified Security Specialty.
The AWS Certified Security - Specialty is Amazon Web Services’ specialty-level certification for securing workloads on AWS. It validates that you can design and implement security controls across detection, incident response, infrastructure, identity, data protection and multi-account governance. The current exam is SCS-C03, and AWS aims it at people who already have hands-on experience securing cloud environments.
The current version is SCS-C03, which AWS has used since December 2, 2025. SCS-C02 was last offered on December 1, 2025. The new version reorganizes the old threat detection and logging domains into Detection and Incident Response, makes Identity and Access Management the largest domain at 20 percent, and adds tasks on generative AI guardrails, data masking and multi-Region key management. AWS has announced no replacement for SCS-C03, but it will stop offering the exam in Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) after December 31, 2026.
No. AWS doesn’t require any earlier certification, so anyone can register for SCS-C03. The experience recommendation is steep, though. The certification page asks for five years of IT security experience and two or more years securing AWS workloads, and the exam guide describes the target candidate as having the equivalent of three to five years securing cloud solutions. AWS also notes that candidates commonly earn the Solutions Architect Associate or Professional first.
The six domains are Detection (16 percent), Incident Response (14 percent), Infrastructure Security (18 percent), Identity and Access Management (20 percent), Data Protection (18 percent), and Security Foundations and Governance (14 percent). Identity and Access Management is the largest, and Infrastructure Security and Data Protection together make up more than a third of the scored content.
SCS-C03 has 65 questions, 50 scored and 15 unscored, and you get 170 minutes. The exam guide lists four question types: multiple choice, multiple response, ordering and matching. Ordering and matching questions only earn credit when every item is placed or paired correctly, and unanswered questions count as wrong with no penalty for guessing, so answer everything.
You need a scaled score of 750 on a scale of 100 to 1,000. The exam uses a compensatory scoring model, so you don’t have to pass each domain separately, only the exam as a whole. Your score report can include a breakdown by section that shows where you were strong or weak.
As of October 2026, the exam costs $300 USD, and AWS lists additional cost details, including foreign exchange rates, on its exam pricing page. If you already hold an active AWS certification, you get a 50 percent discount on your next AWS exam. Training Camp’s boot camp includes the $300 exam voucher in the course fee.
No. The AWS Certified Security Specialty is not an approved option for any work role in the DoD 8140 Qualification Matrix V2.1, so on its own it won’t satisfy a cyber-coded position requirement. If the cloud security role you want is cyber-coded, CCSP is on the matrix, and pairing it with the Security Specialty covers both the requirement and the AWS depth. See the full DoD 8140 work role paths.
It’s valid for three years. You can renew for another three years by passing the latest version of the exam, using the 50 percent discount voucher in your AWS Certification Account. AWS also offers maintenance through a paid AWS Skill Builder subscription, which adds one year and opens once your certification is within 90 days of expiring. Unlike some Associate certifications, it isn’t renewed by passing a Professional exam.
It maps to roles such as Cloud Security Engineer, Cloud Security Architect, DevSecOps Engineer, Cloud Incident Responder, Identity and Access Management Engineer, and Cloud Security Consultant. AWS says the certification supports job roles across cloud architecture, database, networking and DevSecOps, and it’s most useful where an AWS environment is the thing you’re paid to secure.
Take the Security Specialty if your work is in AWS and you need to show you can configure its security services. Take CCSP if you work across several clouds, want a vendor-neutral credential, or need DoD 8140 coverage, since CCSP is on the matrix and the Security Specialty isn’t. CCSP spends whole domains on legal, risk and compliance and on cloud application security, while SCS-C03 goes into AWS service configuration that CCSP never touches, so holding both is a reasonable long-term plan for a cloud security engineer.
It’s a specialty-level exam with a 750 passing score, higher than the 720 needed on the Solutions Architect Associate, and it gives you 170 minutes for 65 questions. AWS’s exam guide says it tests decisions that weigh cost, security and deployment complexity against each other, so expect scenarios where more than one answer would work and only one fits every requirement. Hands-on time with IAM policies, KMS key policies and multi-account setups matters more than reading.
For security engineers and architects who work in AWS every day, yes. SCS-C03 is less than a year old, it covers the multi-account, identity and AI guardrail work cloud security teams handle now, and it’s the security certification AWS itself issues. It’s a weaker fit if you need DoD 8140 coverage, work mostly in Azure or Google Cloud, or are still new to AWS, where the Solutions Architect Associate is the better first step.
Weighing the certification, planning an AWS security path, or arranging cloud security training for a team? Tell us where you stand and we’ll help you plan the next step.