c2.2 Build a cloud security training plan
The hardest challenges in the move to the cloud are rarely technical — training is one of the most important. Give every role a clear learning path so the people protecting your infrastructure understand it.
Implementation guidance
Make security awareness mandatory for everyone
Every employee should complete recurring security-awareness training so they recognize how adversaries operate and avoid unsafe habits (sharing passwords, leaking sensitive information, using insecure channels). Amazon publishes its own security awareness training for free, in multiple languages and without branding, so you can host it in your own learning system.
Give each role a learning path with deadlines
Define what cloud staff must learn on day one, in the first week, month, and quarter, and track progress. Start with foundational cloud infrastructure skills, then add role-specific tracks — for example offensive skills (pen testing) for the red team and cloud incident response for the blue team.
Validate skills with certification
Have your cloud security team work toward the AWS Certified Security – Specialty certification to confirm a solid grasp of AWS security capabilities. Review the exam guide to understand its structure.
Free and instructor-led resources
- AWS Skill Builder — on-demand training; hands-on labs and AWS Jams require a subscription.
- Security ramp-up guide — curated learning by topic.
- Instructor-led courses: Architecting on AWS and Security Engineering on AWS.
- Hands-on security workshops.
Learn at AWS events
AWS runs events with deep-dive security content, including re:Inforce (security-focused) and re:Invent. Recordings are on the AWS Events YouTube channel.
How to validate
- Is there a cloud security training plan with role-specific paths and deadlines?
- What percentage of the relevant staff has completed it?
- Does mandatory security-awareness training reach every employee, not just the security team?
Threats addressed
- Teams that do not understand the infrastructure they protect misconfigure it and miss attacks; untrained employees are a common entry point for social engineering.