We’ve added 10 new cases to CSTrail Simulations, and this batch is focused entirely on AWS security.
These new scenarios are designed for learners who’ve been memorizing cloud security concepts and want to start practicing how real incidents unfold: what the alert says, what the risk is, what decision needs to be made, and what can go wrong when the response is rushed or incomplete.
Practice AWS Security Through Realistic Incidents
Cloud security is often taught through controls, services, and best practices. That foundation is necessary. But once an incident is active, the hard part is not naming the AWS service. It is deciding what to do next.
A public S3 bucket is not just a “misconfiguration.” It may contain customer records. A compromised IAM key is not just an access issue. It may already be powering cryptomining workloads. A stolen instance role credential is not just suspicious activity. It may let an attacker operate as your application from outside AWS.
The new AWS cases put learners in those moments.
Each simulation asks you to triage the situation, investigate what is happening, and make response decisions under pressure. Some cases are beginner-friendly. Others are more advanced and involve cross-account activity, supply-chain compromise, defense evasion, cloud extortion, and privilege escalation.
What’s Included in This Release
The new cases cover a range of AWS security situations, including:
- Public S3 exposure
- Exposed IAM keys and cryptomining
- Internet-exposed RDS databases
- Stolen IAM role credentials via SSRF
- SES account abuse and phishing
- CloudTrail tampering
- Lateral movement through AWS Systems Manager
- KMS key deletion and cloud extortion
- Supply-chain compromise through a shared Lambda layer
- Cross-account privilege escalation
These cases are not meant to be perfect replicas of any single real-world breach. Instead, they are practical training environments built around realistic cloud security scenarios that analysts, engineers, and incident responders should learn to recognize.
Built for Cloud Security Learners and Practitioners
This release is especially useful for aspiring or early-career cloud security analysts, SOC analysts, incident responders, and security engineers who want hands-on decision practice without needing to configure a full AWS lab.
The goal is simple: help learners build better security judgment.
You won’t just be asked what a service does. You’ll be asked what you would do when that service is involved in an active incident, when business impact matters, and when the wrong response can make the situation worse.
Try the New AWS Cases
You can explore the new AWS security simulations now at:
https://simulations.thecybersecuritytrail.com/
Scroll down to the bottom, or select Cloud Security from the SERIES drop-down list.
More cases are already in the pipeline, and in the next couple of weeks, we’ll continue expanding CSTrail Simulations with new cloud security scenarios focused on Microsoft Azure and Google Cloud.
