1. The Beginning

The convergence of offensive security skills and cloud computing expertise represents one of the most strategically valuable combinations in the modern cybersecurity profession. This document examines two closely related certification pathways: the Certified Ethical Hacker (CEH) from EC-Council—the world’s most widely recognized ethical hacking credential—and the AWS Certified Security – Specialty (SCS-C02) from Amazon Web Services, the leading cloud security certification for the world’s dominant cloud platform.

Together, these certifications equip security professionals with the ability to identify, exploit, and remediate vulnerabilities in both traditional and cloud-native environments. The CEH provides the foundational methodology and toolset for ethical hacking, while the AWS Security Specialty delivers deep expertise in securing Amazon Web Services infrastructure. CEH v13 has significantly expanded its cloud hacking content—most notably its dedicated AWS hacking modules—making the two certifications highly complementary.

Why This Combination Matters

Cloud infrastructure has fundamentally transformed the attack surface that security professionals must defend and assess. As of 2024, AWS holds approximately 31% of the global cloud infrastructure market, making it the single most prevalent cloud environment that penetration testers, red teamers, and security auditors encounter in real-world engagements. Security professionals who cannot effectively assess AWS environments are increasingly limited in their ability to perform comprehensive security testing for enterprise clients.

• Over 95% of Fortune 500 companies use AWS services in some capacity
• Cloud misconfigurations are the leading cause of cloud security breaches globally
• AWS-specific attack techniques (IAM privilege escalation, S3 bucket exposure, Lambda abuse) are now standard components of penetration testing engagements
• Demand for professionals who can combine ethical hacking methodology with cloud security expertise commands significant salary premiums
• CEH v13’s expanded cloud module makes AWS hacking a core exam competency, not an optional specialty

2. Certified Ethical Hacker (CEH) – Overview

The Certified Ethical Hacker (CEH) is a professional certification issued by EC-Council (International Council of E-Commerce Consultants), founded in 2001 and headquartered in Albuquerque, New Mexico. The CEH is one of the most widely held cybersecurity certifications globally, with over 350,000 certified professionals across more than 145 countries. It is DoD 8570/8140 approved for multiple information assurance roles, making it particularly prevalent in government, defense, and federal contracting environments.

The certification validates a professional’s knowledge of ethical hacking methodology, tools, and techniques across a comprehensive attack surface—from network infrastructure and web applications to mobile devices, IoT, and cloud environments. CEH v13, the current version, represents the most significant curriculum expansion in the certification’s history, with dedicated modules for AI-driven hacking, advanced cloud exploitation including AWS, and operational technology (OT) security.

EC-Council and the CEH Mission

EC-Council’s foundational philosophy is that to defeat a hacker, you must think like one. The CEH program is built on this principle, teaching security professionals the same techniques, tools, and methodologies used by malicious actors—within a structured, ethical, and legal framework. EC-Council positions the CEH as validating the ability to lawfully perform penetration testing, identify security weaknesses, and report findings to improve organizational security postures.

CEH v13 at a Glance

The CEH Practical and CEH Master

EC-Council offers a hands-on complement to the knowledge-based CEH exam called the CEH Practical. This six-hour proctored examination takes place in a live, simulated network environment and requires candidates to apply hacking techniques to solve real-world challenges. Candidates who pass both the CEH exam and the CEH Practical are awarded the CEH Master designation—the highest level of the CEH credential family and a strong signal of genuine hands-on capability.

3. CEH v13 Curriculum – The 20 Hacking Domains

CEH v13 organizes its curriculum into 20 comprehensive modules that collectively map the full attack lifecycle—from initial reconnaissance through to maintaining access and covering tracks. This structured methodology mirrors real-world penetration testing engagements and ensures that certified professionals have systematic knowledge of both attack and defense at each phase.

The CEH Attack Methodology Framework

The CEH curriculum is organized around a five-phase ethical hacking methodology that provides a repeatable framework for conducting security assessments:

All 20 CEH v13 Modules

Modules 1–5: Foundations and Reconnaissance

• Module 1 – Introduction to Ethical HackingCore concepts, terminology, types of hackers, and the legal and ethical framework governing penetration testing
• Module 2 – Footprinting and ReconnaissanceOSINT techniques, domain and IP research, social media intelligence, Google hacking (dorks), Shodan, and passive reconnaissance tools
• Module 3 – Scanning NetworksNmap, Hping3, Nessus scanning techniques, banner grabbing, OS fingerprinting, and vulnerability enumeration
• Module 4 – EnumerationSMB enumeration, SNMP enumeration, LDAP/Active Directory enumeration, NFS enumeration, and SMTP user enumeration
• Module 5 – Vulnerability AnalysisCVE/CVSS scoring, vulnerability scanners (Nessus, OpenVAS, Qualys), and vulnerability research methodology

Modules 6–10: Exploitation Techniques

• Module 6 – System HackingPassword cracking, privilege escalation techniques, keyloggers, spyware, and rootkits; Windows and Linux post-exploitation
• Module 7 – Malware ThreatsVirus and worm anatomy, Trojans, ransomware, fileless malware, APT techniques, and malware analysis fundamentals
• Module 8 – SniffingPassive and active sniffing, ARP poisoning, MAC flooding, DNS poisoning, and Wireshark/Tcpdump usage
• Module 9 – Social EngineeringPhishing campaigns, vishing, smishing, pretexting, impersonation, and insider threat mitigation
• Module 10 – Denial-of-ServiceDoS and DDoS attack types, botnets, volumetric vs. application-layer attacks, and DDoS mitigation strategies

Modules 11–15: Network and Application Attacks

• Module 11 – Session HijackingTCP session hijacking, cookie theft, cross-site scripting for session capture, and countermeasures
• Module 12 – Evading IDS, Firewalls, and HoneypotsPacket fragmentation, tunneling, encryption-based evasion, and firewall bypass techniques
• Module 13 – Hacking Web ServersWeb server misconfigurations, HTTP response splitting, Web Cache Poisoning, and web server attack tools
• Module 14 – Hacking Web ApplicationsOWASP Top 10, SQL injection, XSS, CSRF, SSRF, broken authentication, and web application assessment methodology
• Module 15 – SQL InjectionIn-depth SQL injection techniques including error-based, blind, time-based, and out-of-band; SQLMap; stored procedures abuse

Modules 16–20: Advanced and Emerging Topics

• Module 16 – Hacking Wireless NetworksWPA2/WPA3 attacks, PMKID attacks, evil twin attacks, Bluetooth hacking, and wireless security assessment tools
• Module 17 – Hacking Mobile PlatformsAndroid and iOS attack surfaces, mobile malware, MDM bypass, mobile application security testing
• Module 18 – IoT and OT HackingIoT attack surfaces, operational technology (SCADA/ICS) vulnerabilities, protocol attacks, and industrial security assessment
• Module 19 – Cloud Computing (AWS Focus)Cloud architecture, AWS-specific attack techniques, container hacking, serverless exploitation — detailed in Section 4
• Module 20 – CryptographyEncryption algorithms, PKI, digital signatures, hashing, steganography, and cryptographic attack techniques

AI Integration in CEH v13

CEH v13 introduces a significant new dimension: the integration of artificial intelligence into both attack and defense techniques. This reflects the rapidly evolving reality that threat actors are actively using AI to enhance their attacks while defenders are adopting AI-powered tools for threat detection. Key AI-related content includes:

• AI-assisted reconnaissance: automated OSINT collection and target profiling
• AI-powered phishing: generating convincing spear-phishing emails using language models
• AI-driven vulnerability discovery: using machine learning to identify unknown vulnerabilities
• Adversarial machine learning: attacking AI systems through data poisoning and model evasion
• AI-enhanced SIEM and threat detection: defending against AI-assisted attacks

4. Module 19: Cloud Computing and AWS Hacking (CEH Deep Dive)

Module 19 of CEH v13 is the most expansive and technically detailed cloud security module in the certification’s history. It reflects the industry reality that penetration testers regularly encounter AWS environments and must be equipped to identify and exploit cloud-specific misconfigurations, privilege escalation paths, and service vulnerabilities. This module is the bridge between traditional ethical hacking methodology and cloud-native offensive security.

Cloud Architecture Fundamentals for Ethical Hackers

Before exploiting cloud environments, CEH candidates must understand the architectural differences between cloud and traditional infrastructure. Module 19 covers:

• Cloud service models: IaaS, PaaS, SaaS — and the attack surface unique to each
• Cloud deployment models: public, private, hybrid, and multi-cloud
• The Shared Responsibility Model: what AWS secures vs. what the customer must secure — a critical concept for identifying customer-owned vulnerabilities
• Cloud-native components: virtual machines (EC2), containers, serverless functions (Lambda), and managed services
• Cloud networking: VPCs, subnets, security groups, NACLs, and Internet Gateways

AWS Identity and Access Management (IAM) Attacks

IAM misconfigurations are the most prevalent class of AWS vulnerability exploited in penetration tests and real-world breaches. The CEH module dedicates substantial coverage to IAM-based attack techniques:

IAM Privilege Escalation Techniques

• Abusing overly permissive IAM policies to escalate from a low-privilege user to administrator
• Exploiting the iam:PassRole permission to assume more privileged roles via other services
• CreatePolicyVersion exploitation: overwriting an existing policy with a permissive version
• SetDefaultPolicyVersion: rolling back to a previously permissive policy version
• Exploiting iam:CreateAccessKey to generate new credentials for privileged accounts
• Lambda-based privilege escalation: passing a privileged role to a Lambda function and executing attacker-controlled code with elevated permissions
• EC2 UserData injection: modifying EC2 instance launch configurations to execute malicious startup scripts with the instance’s attached role

Credential Theft and Abuse

• Extracting AWS credentials from EC2 instance metadata service (IMDS v1) — the endpoint at 169.254.169.254
• Server-Side Request Forgery (SSRF) attacks targeting the IMDS endpoint to steal EC2 instance role credentials
• Credential harvesting from misconfigured S3 buckets containing .env files, configuration files, and source code
• Extracting credentials from publicly exposed CI/CD pipelines (GitHub Actions, CodeBuild)
• CloudTrail log analysis to understand what credentials have been used and what actions are available

Amazon S3 Attack Techniques

Amazon S3 (Simple Storage Service) misconfigurations represent some of the most common and impactful AWS vulnerabilities, responsible for numerous high-profile data breaches. CEH Module 19 covers the full S3 attack methodology:

• S3 bucket enumeration: discovering bucket names through predictable naming conventions, Certificate Transparency logs, and tools such as S3Scanner and bucket-stream
• Accessing publicly readable buckets: listing bucket contents and downloading sensitive files without authentication
• Exploiting misconfigured bucket ACLs (Access Control Lists): unauthorized read, write, or delete operations
• S3 bucket takeover: registering previously deleted buckets that are still referenced by applications
• Accessing buckets via pre-signed URL manipulation
• Cross-account S3 data exfiltration using misconfigured bucket policies
• Sensitive data discovery in S3: looking for credentials, PII, backups, source code, and database dumps

AWS Compute Attacks (EC2, Lambda, ECS)

EC2 Instance Attacks

• Exploiting publicly exposed EC2 instances with weak security group configurations (0.0.0.0/0 on sensitive ports)
• EC2 metadata service exploitation via SSRF to retrieve instance profile credentials
• Abusing EC2 user data scripts that contain hardcoded credentials or execute insecure initialization logic
• Lateral movement between EC2 instances sharing the same security group or IAM role
• Exploiting EC2 key pair mismanagement: reused keys, publicly shared AMIs with embedded credentials

AWS Lambda Function Attacks

• Identifying Lambda functions with overly permissive execution roles
• Code injection into Lambda functions via insecure event source inputs
• Exploiting Lambda environment variables containing plaintext secrets and API keys
• Abusing Lambda function URLs with weak or absent authentication
• Lambda privilege escalation: passing a privileged role to an attacker-controlled function

Container and ECS Attacks

• Exploiting misconfigured Amazon ECS task definitions with privileged container modes
• Container escape techniques in ECS environments
• ECR (Elastic Container Registry) enumeration for publicly accessible container images containing sensitive data
• Kubernetes (EKS) attacks: RBAC misconfigurations, exposed API servers, and pod privilege escalation

AWS Network and Service Attacks

Virtual Private Cloud (VPC) Exploitation

• Security group misconfiguration analysis: identifying overly permissive inbound rules
• VPC peering misconfigurations enabling unintended cross-account network access
• Abusing VPC endpoints to bypass security controls
• Network ACL bypass techniques and traffic interception

AWS Database Service Attacks

• Publicly accessible RDS (Relational Database Service) instances: identifying and exploiting exposed databases
• DynamoDB table enumeration and unauthorized data access via misconfigured resource policies
• ElasticSearch/OpenSearch cluster exposure: unauthenticated access to search indices containing sensitive data
• Secrets Manager and Parameter Store enumeration for credential harvesting

AWS API Gateway and Web Service Attacks

• API Gateway authentication bypass: exploiting missing or misconfigured authorizers
• Injection attacks against API Gateway-fronted Lambda functions
• CloudFront distribution misconfigurations enabling unauthorized origin access
• Route 53 subdomain takeover via dangling DNS records pointing to deprovisioned AWS resources

AWS-Specific Reconnaissance and Enumeration Tools

5. AWS Certified Security – Specialty (SCS-C02)

The AWS Certified Security – Specialty certification (exam code SCS-C02) is Amazon’s advanced-level credential for security professionals who design, implement, and manage security solutions on the AWS platform. It is distinct from the CEH in that it approaches cloud security from a defender and architect perspective, validating the ability to secure AWS environments rather than attack them. Together with the CEH, the AWS Security Specialty creates a comprehensive offensive-defensive skill profile highly valued by employers.

AWS Security Specialty at a Glance

SCS-C02 Domain Breakdown

Domain Deep Dives – SCS-C02

Domain 1: Threat Detection and Incident Response (14%)

This domain tests the ability to design and implement threat detection solutions and respond to security incidents within AWS. Key services and topics include:

• Amazon GuardDuty: managed threat detection service; understanding finding types and severity levels
• AWS Security Hub: centralized security findings aggregation and compliance dashboards
• Amazon Detective: root cause analysis and investigation of security findings
• AWS CloudTrail: API call logging for forensic investigation and anomaly detection
• Incident response playbooks for AWS-specific scenarios: compromised IAM credentials, S3 data exfiltration, EC2 cryptomining
• Automating incident response using AWS Lambda, EventBridge, and Systems Manager

Domain 2: Security Logging and Monitoring (18%)

Effective security monitoring is a foundational defense capability. This domain covers:

• CloudTrail configuration: enabling in all regions, log file validation, and S3 bucket protection
• VPC Flow Logs: capturing network traffic metadata for anomaly detection
• Amazon CloudWatch: metric alarms, log insights queries, and dashboards for security monitoring
• AWS Config: resource configuration tracking and compliance rules
• Amazon Macie: automated sensitive data discovery in S3 using machine learning
• Centralized logging architecture: aggregating logs from multiple accounts into a security account

Domain 3: Infrastructure Security (20%)

The highest-weighted domain covers the design and evaluation of secure AWS infrastructure:

• VPC security design: security groups, NACLs, private subnets, and bastion host architectures
• AWS Web Application Firewall (WAF): rule configuration for common web exploits
• AWS Shield: DDoS protection at Standard and Advanced tiers
• AWS Network Firewall: stateful and stateless deep packet inspection rules
• EC2 security hardening: IMDSv2 enforcement, instance profiles, and patch management via Systems Manager
• Certificate management: AWS Certificate Manager (ACM) and private CA configuration

Domain 4: Identity and Access Management (16%)

IAM is the cornerstone of AWS security. This domain validates deep expertise in access control:

• IAM policy design: least privilege principles, permission boundaries, and service control policies (SCPs)
• AWS Organizations: multi-account governance and organizational unit (OU) structure for security isolation
• AWS IAM Identity Center (SSO): centralized identity federation and role assignment
• Cross-account access patterns: resource-based policies, role assumption, and trust relationships
• Privileged Access Management: just-in-time access, AWS IAM Access Analyzer, and anomaly detection
• AWS Cognito: identity management for customer-facing applications

Domain 5: Data Protection (18%)

Protecting data at rest and in transit is a core responsibility of the AWS security professional:

• AWS Key Management Service (KMS): customer-managed key (CMK) configuration, key policies, and encryption of AWS services
• AWS CloudHSM: hardware security module for cryptographic key management requirements
• S3 security: encryption options (SSE-S3, SSE-KMS, SSE-C), bucket policies, and Object Lock
• Secrets Manager vs. Parameter Store: selecting and implementing the appropriate secrets management solution
• Data classification and tagging strategies for enforcing data protection controls at scale
• Certificate management and TLS enforcement across AWS services

Domain 6: Management and Security Governance (14%)

Security governance ensures that security controls are consistently applied across complex multi-account AWS environments:

• AWS Control Tower: automated multi-account governance with guardrails
• AWS Organizations Service Control Policies (SCPs): preventive guardrails at the organizational level
• Automated compliance assessment with AWS Config rules and AWS Security Hub standards
• Third-party security tool integration: SIEM, CASB, and vulnerability management platforms
• Security governance for multi-region deployments: ensuring consistent controls globally

6. CEH and AWS Security: How They Complement Each Other

The CEH and AWS Security Specialty certifications represent opposite ends of the same security spectrum—one teaches how to attack, the other teaches how to defend. When held together, they create a uniquely powerful professional profile: an individual who understands both the attacker’s tactics and the defender’s toolset in the AWS environment. This dual perspective is increasingly valued and, for certain roles, expected.

Attack-Defense Mapping

The following table maps key CEH AWS attack techniques to their corresponding AWS defensive controls, illustrating how the two certifications speak to the same security challenges from opposing perspectives:

The AWS Penetration Testing Permission Policy

A crucial distinction for professionals pursuing CEH AWS skills is understanding the legal framework for testing AWS environments. AWS maintains a Penetration Testing Policy that governs what testing activities are permitted without prior approval and which require explicit written authorization from AWS.

Permitted Without Prior AWS Approval (as of current policy)

• EC2 instances, NAT Gateways, and Elastic Load Balancers
• Amazon RDS databases
• Amazon CloudFront distributions
• Amazon Aurora databases
• Amazon API Gateways
• AWS Lambda and Lambda Edge functions
• Amazon Lightsail resources
• Amazon Elastic Beanstalk environments

Prohibited Activities (Never Permitted)

• DNS zone walking of Route 53 hosted zones
• Denial-of-service (DoS) or DDoS testing against any AWS resources
• Port flooding, protocol flooding, or request flooding
• Testing AWS infrastructure shared with other customers

7. CEH Exam Preparation Strategy

The CEH examination tests a broad knowledge base across 20 domains and requires both conceptual understanding and familiarity with a wide range of tools and techniques. Unlike the OSCP, the CEH is primarily a knowledge-based multiple-choice exam rather than a hands-on assessment (unless pursuing the CEH Practical). An effective preparation strategy must address both breadth and the specific style of EC-Council questions.

EC-Council Official Training Paths

• iLearn (Self-Paced): EC-Council’s official self-paced e-learning platform; includes video lectures, labs, and practice tests
• iWeek (Live Online): Instructor-led live virtual training spanning one week; intensive but comprehensive
• Master Class: EC-Council’s premium training with extended lab access and instructor mentorship
• Accredited Training Centers (ATCs): In-person or virtual training through EC-Council’s global partner network

Recommended Study Timeline

Phase 1: Foundation (Weeks 1–4)

• Read the CEH v13 courseware material (all 20 modules) for conceptual grounding
• Watch EC-Council’s official video content for each module
• Take notes on tools, techniques, and countermeasures — the exam heavily tests tool identification
• Complete the official iLabs for hands-on reinforcement of key techniques

Phase 2: Domain Mastery (Weeks 5–8)

• Focus 2–3 study sessions per week on one module per session
• Use third-party materials: Matt Walker’s CEH Certified Ethical Hacker All-in-One Exam Guide is highly regarded
• Practice questions using EC-Council’s official practice exam engine or Boson Ex-SIM for CEH
• Target 75%+ accuracy on practice questions before moving to the next module

Phase 3: Exam Readiness (Weeks 9–10)

• Complete 3–5 full-length 125-question practice exams under timed conditions (4 hours)
• Review every incorrect answer — understand the rationale, not just the answer
• Memorize key tool associations: which tools are associated with each attack technique
• Review EC-Council’s ethical hacking countermeasures — the exam tests defenses equally with attacks

Key Study Focus Areas for CEH

Experienced test-takers consistently identify the following as high-density exam areas requiring extra attention:

Recommended Resources

• CEH v13 Official Courseware (EC-Council): The authoritative source — required reading
• Matt Walker, CEH All-in-One Exam Guide (McGraw-Hill): Highly readable comprehensive review
• Boson Ex-SIM for CEH: Best-in-class practice exam engine with detailed explanations
• TryHackMe CEH Learning Path: Hands-on labs aligned to CEH modules
• Hack The Box (Starting Point): Supplement the knowledge base with practical exploitation experience
• YouTube — TCM Security, NetworkChuck, IppSec: Free video content covering CEH-relevant techniques

8. AWS Security Specialty Preparation Strategy

The AWS Certified Security – Specialty exam (SCS-C02) is one of the most challenging AWS certifications, requiring both deep theoretical knowledge of AWS security services and practical experience designing and implementing security solutions. The exam assumes candidates have prior AWS experience, and study without hands-on practice will rarely be sufficient to pass.

8.1 Prerequisites and Foundation

Before beginning SCS-C02 preparation, candidates should possess solid working knowledge of:

• AWS core services: EC2, S3, VPC, IAM, CloudTrail, CloudWatch, Lambda, RDS, and Route 53
• AWS networking fundamentals: subnets, routing, security groups, NACLs, and VPN connectivity
• General security concepts: encryption, PKI, identity federation, and incident response
• Recommended: pass AWS Certified Cloud Practitioner (CLF-C02) or an Associate-level exam first

8.2 Recommended Study Timeline

Phase 1: Service Deep Dives (Weeks 1–5)

• Study each security-relevant AWS service in depth using the official AWS documentation
• Focus on GuardDuty, Security Hub, IAM, KMS, CloudTrail, VPC, WAF, and Macie in particular
• Use AWS Skill Builder’s official SCS-C02 exam prep course and digital training
• Set up an AWS Free Tier account and configure each service you are studying — hands-on is essential

Phase 2: Scenario-Based Practice (Weeks 6–8)

• Use Tutorials Dojo (Jon Bonso) practice exams — the gold standard for AWS exam preparation
• Study each incorrect answer thoroughly; understand both the right answer and why alternatives are wrong
• Target a consistent 80%+ on Tutorials Dojo timed mode before scheduling the exam
• Review Adrian Cantrill’s or Stephane Maarek’s SCS-C02 video courses for visual learning

Recommended Resources for SCS-C02

9. Career Value, Roles, and Industry Recognition

The combination of CEH and AWS Security Specialty certifications positions professionals for some of the most strategically important and well-compensated roles in the modern cybersecurity job market. As organizations accelerate cloud adoption, the demand for professionals who understand both offensive and defensive cloud security has grown dramatically.

Roles That Benefit from CEH and AWS Security

Salary Expectations

Professionals holding both CEH and AWS Security Specialty certifications command significant salary premiums due to their dual offensive-defensive expertise in the highest-demand cloud platform. Below are representative U.S. salary ranges:

• Cloud Penetration Tester (0–3 years): $90,000 – $130,000 annually
• Cloud Security Engineer (2–5 years): $110,000 – $160,000 annually
• Senior Cloud Security Architect (5+ years): $150,000 – $220,000+ annually
• Red Team Operator with Cloud Focus (3–7 years): $120,000 – $180,000 annually
• Federal / DoD Cloud Security Analyst (with clearance): $100,000 – $170,000 annually
• Big 4 Consulting (Cloud Security Practice): $100,000 – $175,000 plus performance bonuses

CEH in the Broader EC-Council Certification Path

• CEH (Certified Ethical Hacker): Foundational ethical hacking methodology and toolset
• CEH Practical: Hands-on 6-hour lab exam; awarded alongside CEH for CEH Master status
• CPENT (Certified Penetration Testing Professional): Advanced pen testing with live network ranges
• LPT Master (Licensed Penetration Tester Master): Elite credential awarded via EC-Council’s advanced pen testing exam
• CHFI (Computer Hacking Forensic Investigator): Digital forensics and incident response complement
• CCISO (Certified Chief Information Security Officer): Executive-level security leadership credential

AWS Security Certification Path

• AWS Cloud Practitioner (CLF-C02): Foundational AWS concepts and services
• AWS Solutions Architect – Associate (SAA-C03): Core architectural knowledge; recommended before Security Specialty
• AWS SysOps Administrator – Associate: Operational AWS knowledge complementary to security
• AWS Security – Specialty (SCS-C02): The target credential for security practitioners
• AWS Advanced Networking – Specialty: Valuable complement for deep VPC and network security work
• AWS Certified Machine Learning – Specialty: Relevant for AI/ML security workloads

Complementary Third-Party Certifications

• OSCP (Offensive Security Certified Professional): Highly regarded hands-on penetration testing credential; strongest complement to CEH for technical depth
• CISSP (Certified Information Systems Security Professional): Comprehensive security management; pairs with both CEH and AWS Security Specialty for senior roles
• CCSP (Certified Cloud Security Professional): ISC2’s cloud security credential; valuable alongside AWS Security Specialty
• GCPN (GIAC Cloud Penetration Tester): SANS Institute credential specifically for cloud penetration testing
• AWS Certified DevOps Engineer – Professional: For professionals moving into DevSecOps roles

10. Building a Hands-On Lab Environment

Both the CEH and AWS Security Specialty certifications reward candidates who have invested in practical, hands-on experience beyond study materials. Building a personal lab environment is one of the most effective ways to internalize the concepts and techniques covered in both programs.

CEH Lab Setup

For CEH preparation, a virtualized lab environment using a personal computer or cloud-based virtual machines provides the foundation for practicing attack techniques legally and safely:

• Hypervisor: VMware Workstation Pro, VMware Fusion (macOS), or VirtualBox (free)
• Attack machine: Kali Linux (primary CEH attack platform); Parrot OS is a popular alternative
• Target machines: Metasploitable 2 and 3 (intentionally vulnerable Linux); DVWA (Damn Vulnerable Web Application); VulnHub VMs
• Windows targets: Windows Server evaluation VMs for Active Directory practice
• Network setup: Host-only or NAT network configurations to isolate the lab from the internet

AWS Practice Environment Setup

An AWS Free Tier account provides the foundation for hands-on AWS Security Specialty preparation. The following services and configurations should be set up and experimented with:

• Enable AWS CloudTrail in all regions with log file validation enabled — this is the foundational logging service
• Configure Amazon GuardDuty and generate sample findings to understand detection capabilities
• Set up AWS Config with managed rules (e.g., s3-bucket-public-access-prohibited, iam-no-root-access-key)
• Create IAM users with different permission levels and use IAM Access Analyzer to identify overly permissive policies
• Configure a VPC with public and private subnets, security groups, and NACLs — practice restricting traffic
• Enable AWS Security Hub and review the CIS AWS Foundations Benchmark findings
• Deploy an S3 bucket, intentionally misconfigure it, and then use Macie to detect sensitive data
• Set up AWS KMS with customer-managed keys and encrypt an EBS volume and S3 bucket

Cloud Hacking Practice Platforms

• CloudGoat (Rhino Security Labs): Intentionally vulnerable AWS environment; deployable via Terraform for safe, legal AWS attack practice
• Flaws.cloud: Series of AWS security challenges at increasing difficulty levels; free, publicly accessible
• Flaws2.cloud: Advanced version of Flaws.cloud; includes attacker and defender perspectives
• TryHackMe AWS Rooms: Guided AWS hacking challenges with step-by-step instructions
• Hack The Box Cloud: AWS and Azure hacking challenges in a controlled lab environment
• PentesterLab AWS: Structured web and cloud application security challenges

11. Ethical and Legal Framework

The skills developed through the CEH and AWS Security certifications are among the most powerful in the information security profession. With this power comes an unambiguous ethical and legal responsibility. Both EC-Council and AWS operate within strict codes of conduct, and professionals who misuse these skills face severe legal consequences.

EC-Council Code of Ethics

All CEH holders are bound by EC-Council’s Code of Ethics. Key provisions relevant to AWS cloud security work include:

• Keep client information and data confidential; never disclose findings, credentials, or data encountered during authorized assessments
• Perform security testing only with written authorization; verbal permission is legally insufficient
• Disclose all findings honestly and completely — do not omit unflattering results from penetration test reports
• Never use skills to gain unauthorized access to systems, even for educational or research purposes
• Report discovered vulnerabilities responsibly; follow coordinated disclosure principles
• Maintain and continuously update professional knowledge; do not perform assessments beyond your competency level

AWS Acceptable Use Policy

AWS’s Acceptable Use Policy (AUP) governs the use of all AWS services. Key provisions include:

• Prohibition of using AWS services to conduct unauthorized network scanning or penetration testing against non-owned infrastructure
• Prohibition of using AWS services to launch attacks against third parties
• Prohibition of generating, distributing, or facilitating malware
• Compliance with all applicable laws and regulations in the jurisdictions where AWS services are used

Legal Framework for AWS Penetration Testing

Penetration testing of AWS environments involves multiple layers of legal authorization:

• Customer Authorization: The customer (your client or your organization) must provide written permission for all testing activities
• AWS Permission Policy: Testing must comply with AWS’s Penetration Testing policy, which permits testing of specific services without prior AWS notification
• Scope Definition: A formal Rules of Engagement (RoE) document must define the exact resources in scope, prohibited actions, and emergency contact procedures
• Data Handling: Any sensitive data encountered (credentials, PII, financial data) must be handled in accordance with applicable privacy laws and the engagement contract
• Incident Reporting: If active threats or evidence of prior breaches are discovered, immediate notification to the client is required

Key Applicable Laws

• Computer Fraud and Abuse Act (CFAA) – U.S.: Primary federal law governing unauthorized computer access; applies to all cloud infrastructure
• Electronic Communications Privacy Act (ECPA) – U.S.: Governs interception of electronic communications including network traffic in cloud environments
• GDPR (EU) and State Privacy Laws: Data encountered in AWS environments may be subject to privacy regulations governing processing, storage, and disclosure
• Cloud Customer Agreements: AWS’s Terms of Service and Customer Agreements create contractual obligations that must be observed alongside statutory requirements

12. Onward and Upward

The Certified Ethical Hacker (CEH) and AWS Certified Security – Specialty certifications represent two complementary pillars of modern cloud security expertise. The CEH provides the offensive foundation—a structured methodology, comprehensive toolset, and AWS-specific attack knowledge that enables security professionals to identify vulnerabilities before malicious actors do. The AWS Security Specialty provides the defensive architecture—the deep service knowledge, governance frameworks, and operational security capabilities required to build and maintain secure cloud environments at enterprise scale.

CEH v13’s dedicated AWS hacking module marks a pivotal evolution in the certification, acknowledging that cloud infrastructure is no longer a specialty niche but a core component of virtually every enterprise attack surface. Security professionals who master both the offensive techniques covered in CEH Module 19 and the defensive controls tested in the AWS Security Specialty examination are equipped to deliver genuinely comprehensive security assessments and remediation guidance in cloud environments.

The global cloud security talent shortage is acute, and the demand for professionals who can bridge the attack-defense divide in AWS environments will only intensify as cloud adoption deepens. For security professionals willing to invest in both certifications—and the hands-on lab practice that brings them to life—the career opportunities, compensation, and professional impact are substantial.