Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing
AI SKILLSUPDATED

SEC510: Cloud Security Engineering and Controls

SEC510Cloud Security, Artificial Intelligence
  • 5 Days (Instructor-Led)
  • 38 Hours (Self-Paced)
Course authored by:
Brandon EvansEric Johnson
Brandon Evans & Eric Johnson
Register NowCourse Preview
SEC510: Cloud Security Controls and Mitigations
Course authored by:
Brandon EvansEric Johnson
Brandon Evans & Eric Johnson
Register NowCourse Preview
  • GIAC Public Cloud Security (GPCS)

    Learn about certification

  • 38 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Advanced Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 52 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

Prevent cloud incidents from becoming breaches with attack-driven controls across AWS, Azure, and GCP. Build multicloud defenses and secure AI workloads through hands-on labs that use agentic AI.

Featured Quote

The course provided so much information and details about security misconfigurations and mistakes in the cloud that one would not believe fit into the week. Very comprehensive, but the scary thing is that it feels like it is barely scratching the surface! Awesome job by the course authors.
Petr Sidopulos

Course Overview

Protecting multicloud environments is tough but essential. Default controls often fall short, and what works for one CSP may fail in another. SEC510 delivers advanced training for engineering cloud security defenses across AWS, Azure, and GCP, emphasizing attack-driven strategies over compliance. Students also gain skills to secure modern environments, from identity and ransomware protection to defending AI Vector Databases and workloads, learning practical controls that reduce risk and safeguard critical assets at scale. They will learn tried-and-true techniques alongside GenAI and Agentic AI-powered solutions to optimize their work.

Prevent Real Attacks With Controls That Matter

SEC510 prepares professionals to navigate the complexity of safeguarding multicloud environments and serves as a foundational path for those pursuing the GPCS certification (GIAC Public Cloud Security), which validates skills in applying cloud security engineering best practices across AWS, Azure, and GCP.

Whether an application is developed in-house or by a third party, accepting the inevitability of application flaws is key for implementing successful cloud security controls. While few cybersecurity professionals can fix vulnerable code, it is often easier to engineer secure cloud solutions to mitigate these risks. Relying solely on CSP defaults and documentation is insufficient. SEC510 reveals numerous instances of incorrect, incomplete, or contradictory CSP controls. Additionally, if there is a zero-day vulnerability in a cloud service used by your organization, you must brace for that impact by controlling what you can.

While standards and frameworks, such as the MITRE ATT&CK Cloud Matrix, the Center for Internet Security (CIS) Cloud Provider Benchmarks, and the Cyber Defense Matrix, are helpful tools of the trade, they still have limits. That is why SEC510 goes beyond them to teach the techniques necessary to protect what matters to your organization. Mitigate the risk of common cloud mistakes with cloud security controls that matter, leveraging AI where useful and reducing your attack surface.

Author Statement

"The use of multiple public cloud providers introduces new challenges and opportunities for security and compliance professionals. As the service offering landscape is constantly evolving, it is far too easy to engineer security solutions that are not effective in all clouds. Leveraging AI is necessary but insufficient. While it is tempting to dismiss the multicloud movement or block it at the enterprise level, this will only make the problem harder to control.

"Why do teams adopt multiple cloud providers in the first place? To make their jobs easier or more enjoyable. Developers are creating products that meet the organization's goals, not for the central security team. If a team discovers that a service offering can help get its product to market faster, it can and should use it. Security should embrace the inevitability of the multicloud movement and take on the hard work of engineering guardrails so the organization can move quickly and safely.

"The multicloud storm is here, whether you like it or not. Prevent the rain from drowning your organization."

- Brandon Evans and Eric Johnson

What You’ll Learn

  • Make informed choices across AWS, Azure, and GCP with deep dives into PaaS and IaaS
  • Use GenAI and agentic AI to analyze, implement, and validate cloud security controls at scale
  • Test and validate security controls instead of relying on vendor documentation
  • Build layered IAM and integrate identity into network security
  • Automate encryption and compliance checks
  • Prevent, mitigate, and recover from ransomware
  • Secure FaaS, multicloud, IaC deployments, and AI workloads

Business Takeaways

  • Prevent incidents from becoming breaches with attack-driven, preventive controls—including defenses for emerging AI workloads
  • Reduce the attack surface of your organization's cloud environments
  • Control the confidentiality, integrity, and availability of data in the Big 3 CSPs
  • Increase use of secure automation to keep up with the speed of today's business
  • Resolve unintentional access to sensitive cloud assets
  • Reduce the risk of ransomware impacting your organization's cloud data

Meet Your Authors

  • Slide 1 of 2
    Brandon Evans
    Brandon Evans

    Brandon Evans

    Senior Instructor

    Brandon Evans is a SANS Senior Instructor and Partner at Cyverity. As the lead author of SEC510, he guides cloud and DevSecOps professionals in securing AWS, Azure and GCP workloads through hands-on training.

    Read more about Brandon Evans
  • Slide 2 of 2
    Eric Johnson
    Eric Johnson

    Eric Johnson

    Fellow

    Eric Johnson is a Fellow at the SANS Institute and Principal Security Engineer at Puma Security. He leads hands-on training in SEC540: Cloud Native Security and DevSecOps Automation, co-authors SEC549 and SEC510, and develops open-source tools to help practitioners secure cloud pipelines.

    Read more about Eric Johnson
Slide 1 of 0

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in SEC510: Cloud Security Engineering and Controls.

Section 1Cloud Engineering and Identity Access Management (IAM)

SEC510 begins with cloud breach trends and the challenges of multicloud. Students explore IAM and machine identity risks, practice real-world attacks, and use tools like IAM analyzers to detect Broken Access Control. The section ends with strategies to prevent privilege escalation.

Topics covered

  • Cloud Identity and Access Management
  • Cloud Managed Identity and Metadata
  • Broken Access Control and Policy Analysis
  • IAM Privilege Escalation

Labs

  • IAM Provisioning
  • Virtual Machine Credential Exposure
  • Broken Access Control and Policy Analysis
  • IAM Privilege Escalation
  • Bonus Challenges (Section 1)

Overview

SEC510 starts with a brief overview of cloud breach trends, exploring why the vast majority of breaches are now happening in the cloud. We will explore how multicloud makes security harder, why organizations are going multicloud, and how both standardization and cloud agnosticism cannot solve the problem alone. We introduce three of the frameworks we will use throughout the course to implement attack-driven controls and mitigations: the MITRE ATT&CK Cloud Matrix, the Center for Internet Security (CIS) Cloud Foundational Benchmarks, and the Cyber Defense Matrix. Students will then initialize their lab environment and deploy a modern web application to each of the Big 3 providers.

This leads to an analysis of one of the most critical and misunderstood concepts in cloud security: Identity and Access Management (IAM). This module will ensure that all students have a foundation of IAM knowledge on which the rest of the section is built. It covers the goals fulfilled by properly provisioning access, each cloud's IAM service (AWS IAM, Microsoft Entra ID, and Google Cloud Identity), and the various types of access control provided by each.

The next module shifts the discussion from human identities to machine identities. Students will learn how workloads running on AWS Elastic Compute Cloud (EC2), Azure Virtual Machines (VMs), and the Google Cloud Compute Engine (GCE) are given temporary IAM credentials. They will then compromise real IAM credentials from their cloud virtual machines using the Instance Metadata Service (IMDS) to examine firsthand how an attacker can abuse them to access sensitive cloud data and consume cloud resources.

With this foundation, students will discuss the primary vulnerability caused by granting permissions improperly: Broken Access Control (BAC). They will learn how to detect improper access and implement better permissions using a variety of cloud-native tools: the AWS IAM Access Analyzer, Microsoft Entra ID Permissions Management, and Google Cloud IAM Policy Intelligence. These strategies are critical to prevent a minor vulnerability from becoming front-page news.

The section concludes by discussing a critical way that attackers can obtain improper permissions: Privilege Escalation. They will examine the many escalation paths that are available by default in each cloud provider. By implementing policy guardrails, they will drastically minimize the likelihood of privilege escalation being effective.

Full Topic Details

  • Introduction
    • Cloud Breach Trends
    • Insecure Defaults
    • Multicloud Considerations
    • Shadow Cloud Accounts
    • Cloud Procurement Through Mergers and Acquisitions
    • Effectiveness of Standardization, Cloud Agnosticism, and AI
    • MITRE ATT&CK Cloud Matrix
    • Center for Internet Security (CIS) Cloud Foundations Benchmarks
    • Cyber Defense Matrix
    • Lab Environment Introduction
    • HashiCorp Terraform Overview
  • Cloud Identity and Identity Access Management (IAM)
    • AWS IAM
    • Microsoft Entra ID
    • Google Cloud Identity
    • Identity-Based Policies
    • Resource-Based Policies
    • Attribute-Based Access Control
    • Built-In vs. Custom Policies and Roles
    • AWS Organization Service Control Policy (SCP)
    • AWS Permissions Boundaries
    • AWS Session Policy
    • Azure Role-Based Access Control (RBAC)
    • Google Cloud Allow Policy
    • Google Cloud Deny Policy
  • Cloud Managed Identity and Metadata Services
    • Cloud Compute Services
    • Machine Identities
    • AWS Elastic Compute Cloud (EC2)
    • AWS IAM Roles
    • AWS Instance Profiles
    • Azure Virtual Machines (VMs)
    • Azure Managed Identity
    • Google Cloud Compute Engine (GCE)
    • Google Cloud Service Accounts
    • Instance Metadata Services (IMDS)
    • IMDS Exploits
    • Server-Side Request Forgery
    • Command Injection
    • IMDS Hardening
  • Broken Access Control and Policy Analysis
    • Exploiting Built-In Policies and Roles
    • Cloud Resource Hijacking
    • Using Custom Policies to Meet Business Requirements
    • Finding Broken Access Control
    • AWS IAM Access Analyzer
    • Microsoft Entra ID Permissions Management
    • Google Cloud IAM Policy Intelligence
  • IAM Privilege Escalation
    • IAM Permission Editor
    • Transitive Identity Impersonation
    • Dangerous Built-In Policies and Roles
    • Default Machine Identity Permissions
    • Preventing Privilege Escalation
    • Policy Guardrails

Section 2Private Networks, Endpoints, and Encryption

Section 2 focuses on networking and encryption controls. Students learn to secure VMs, use private endpoints for PaaS, prevent Remote Code Execution (RCE) with data exfiltration, analyze flow logs to detect malicious activity, and manage cryptographic keys across all three major clouds.

Topics covered

  • Protecting Public Virtual Machines
  • Private Endpoint Security and Abuse
  • Enabling Traffic Monitoring
  • Cryptographic Key Management
  • Encryption with Cloud Services

Labs

  • Protecting Public Virtual Machines
  • Control Egress Traffic with Private Endpoints
  • Remote Code Execution via Private Endpoint Abuse
  • Detect and Prevent Improper Key Usage
  • Bonus Challenges (Section 2)

Overview

Section 2 covers how to lock down infrastructure and data using virtual private network controls. As the public cloud IP address blocks are well known and default network security is often lax, millions of sensitive assets are unnecessarily accessible to the public Internet. This section will ensure that none of these assets belong to your organization.

It begins by showing how public IP addresses, administrative ports, and Serial Console services can be removed while allowing for secure administration via the AWS Systems Manager (SSM) Session Manager, Azure Bastion, Google Cloud OS Login, and the Google Cloud Identity-Aware Proxy (IAP). These techniques allow an organization to work effectively while keeping internal systems off the public internet. Then, it covers how VMs that must expose an HTTP(S) server can be protected with Cloud Application Load Balancers (ALBs) and built-in Web Application Firewall (WAF) services.

With our infrastructure locked down, we pivot to preventing untrusted networks from accessing our Platform as a Service (PaaS) platforms using Private Endpoints. We will demonstrate how defenders can use these endpoints to restrict data access to internal networks. This topic is critical as an organization's most sensitive data is often stored in PaaS instead of IaaS.

While private endpoints enable powerful protections, they can also be abused. Specifically, AWS Private Endpoints with improperly configured Endpoint Policies can be used to perform Remote Code Execution (RCE) in and data exfiltration from isolated networks without internet access. Students will use a malicious payload to exfiltrate data from a target's AWS account to an attacker's AWS account. They will then fix the Endpoint Policy to prevent this attack vector.

The next module covers how to enable cloud-based network analysis capabilities to address malicious traffic on network channels that cannot be blocked. Students will analyze cloud flow logs and search for indicators of compromise. This module covers flow logging solutions in all three cloud, Google Cloud Firewall Rules logging, AWS Traffic Mirroring, and Google Cloud Packet Mirroring. Many of these topics have associated Bonus Challenges.

The section concludes by covering all you need to know about encryption in the cloud. Students will learn about each provider's cryptographic key management solution and how it can be used to apply multiple layers of encryption at rest. Students will also learn how in-transit encryption is performed throughout the cloud, such as the encryption between clients, load balancers, applications, and database servers. These techniques will improve your organization's security while satisfying its legal and compliance needs. Finally, it covers the security and compliance risks posed by Post-Quantum Cryptography (PQC), what to do about it, and how the Big 3 cloud providers are addressing it.

Full Topic Details

  • Protecting Public Virtual Machines
    • Network Service Scanning
    • Eliminate Public IP Addresses
    • Block SSH and RDP Administrative Access
    • Disable Serial Console Debug Access
    • AWS Systems Manager (SSM) Session Manager
    • Azure Bastion
    • Google Cloud OS Login
    • Google Cloud Identity-Aware Proxy (IAP)
    • Cloud Application Load Balancers (ALBs)
    • Built-In Web Application Firewall (WAF) Services
  • Private Endpoint Security
    • AWS PrivateLink
    • Azure Private Link
    • Google Cloud Private Google Access
    • Google Cloud VPC Service Controls
    • Custom Service Endpoints
    • Supply-Chain Attacks via Software Packages
    • Remote Code Execution (RCE)
  • Private Endpoint Abuse
    • AWS Private Endpoint Policy
    • Remote Code Execution Without Internet Access
    • Malicious Payload Delivery via S3 and Private Endpoints
    • Data Exfiltration via AWS CloudTrail
  • Enabling Traffic Monitoring
    • Flow Logging
    • Google Cloud Firewall Rules Logging
    • AWS Traffic Mirroring
    • Google Cloud Packet Mirroring
  • Cryptographic Key Management
    • AWS KMS
    • Azure Key Vault
    • Google Cloud KMS
    • Overview of Single-Tenant Alternatives: AWS CloudHSM, Azure Dedicated HSM, Azure Key Vault Managed HSM, and Google Cloud Bare Metal (Rack) HSM
    • Key Usage Audit Logging
  • Encryption with Cloud Services
    • Disk-Level Encryption
    • Service-Level Encryption
    • Column-Level Encryption
    • In-Transit Encryption
    • Enforcing Encryption Consistently Across Cloud Services

Section 3Cloud Data Security and AI Controls

Section 3 focuses on cloud data security and AI controls. Students explore secure storage, ransomware defense, Vector Databases, leveraging Generative AI (GenAI) / Agentic AI to implement cloud security controls, and how to secure Retrieval Augmented Generation (RAG) infrastructure in the cloud.

Topics covered

  • Cloud Storage Platforms
  • Vector Databases
  • AI-Driven Mitigations
  • Securing Cloud AI Infrastructure

Labs

  • Recover From Ransomware
  • Vector Database Security
  • AI-Driven Mitigations
  • Securing Cloud AI Infrastructure
  • Bonus Challenges (Section 3)

Overview

Data security is as important, if not more important, in the cloud than it is on premises. Cloud-based GenAI and Agentic AI depend on the confidentiality and integrity of cloud data. This section examines secure object storage, ransomware protection, Vector Databases, and Retrieval Augmented Generation (RAG) infrastructure.

The second module is focused on Vector Databases. These systems are core to GenAI and Agentic AI infrastructure. As a result, AI security depends on Vector Database controls. The module explains the relationship between these Vector Databases and AI, how Vector Databases differ from traditional object storage, use cases for Vector Databases (Semantic Search, Semantic Caching, AI Agent Memory, and more), and how to handle complex Vector Database integrity challenges.

The second half of the section explores the intersection between Cloud Security Controls and GenAI and Agentic AI. It will cover how AI can be used to enforce controls, the risks of offloading responsibilities to AI platforms, agentic AI code editors, and vibe coding. The final module teaches students how to secure cloud-based AI infrastructure. It details the Retrieval-Augmented Generation (RAG) process, explains how the data it uses is stored, demonstrates dangerous implementation flaws in these systems, and provides mitigations for each. It uses Azure’s AI Foundry AI Search as a case study.

Full Topic Details

  • Cloud Storage Platforms
    • Access Control Defense-in-Depth
    • Ransomware Prevention and Recovery
    • Data Retention
    • Object Lifecycles
    • Cloud Sensitive Data Detection with Amazon Macie
  • Signed URLs
    • Data Exfiltration Paths
    • Signed URLs
  • Vector Databases
    • Object Storage vs. Vector Storage
    • Cloud Vector Database Services
    • Semantic Search
    • Semantic Caching
    • AI Agent Memory
    • Amazon Bedrock
    • Amazon OpenSearch and OpenSearch Serverless
    • Vector Database Integrity Challenges
  • AI-Driven Mitigations
    • Effective and Ineffective Use-Case for Applying LLMs to Security
    • Cognitive and Responsibility Offloading as a Security Risk
    • Code Editors and Security
    • Case Study: Translating Terraform for the Big 3 Clouds to Oracle Cloud Infrastructure (OCI) using GenAI
  • Securing Cloud AI Infrastructure
    • Model Fine-Tuning vs. Retrieval-Augmented Generation (RAG)
    • RAG Data Ingestion
    • Cloud RAG Solutions
    • RAG IAM, Network, and Data Access Control Concerns

Section 4Serverless Workloads and End-User Security

Section 4 covers securing cloud app infrastructure and users, starting with serverless FaaS benefits and risks. Students harden real serverless functions, explore Customer Identity and Access Management (CIAM) threats like account takeover via Amazon Cognito, and protect the most critical services in Google Cloud’s Firebase platform.

Topics covered

  • Cloud Serverless Functions
  • Cloud Customer Identity and Access Management
  • Firebase Databases and Google Cloud Implications

Labs

  • Serverless Prey
  • Harden Serverless Functions
  • Using and Exploiting CIAM
  • Broken Firebase Database Access Control
  • Bonus Challenges (Section 4)

Overview

This section teaches students how to secure the infrastructure powering their cloud-based applications and how to protect the users of those applications. It begins with a computing paradigm taking the industry by storm: serverless Functions as a Service (FaaS). It balances the discussion of the challenges serverless introduces with the advantages it provides in securing product development and security operations. After introspecting the serverless runtime environments using Serverless Prey (an open-source tool written by the course authors), students will examine and harden practical serverless functions in a real environment.

The next module covers how Customer Identity and Access Management (CIAM) can help track and authenticate the users of an organization's applications. It does a deep dive into AWS's CIAM solution, Amazon Cognito, and how its default configuration can be exploited to perform user enumeration and account takeover attacks. It also shows how users in Cognito User Pools can obtain dangerous AWS IAM permissions using Cognito Identity Pools. Most importantly, it will demonstrate how these attacks can be prevented.

This section also covers Google Cloud's CIAM solution, Google Cloud Identity for Customers and Partners (CICP). Google Cloud obtained this service through their acquisition of a company named Firebase. The section concludes with a detailed breakdown of this CIAM and its interplay with Firebase's flagship products, the Realtime Database and Cloud Firestore. These highly popular but rarely reviewed services are serverless databases with many access control considerations and security implications for Google Cloud projects.

Full Topic Details

  • Cloud Serverless Functions
    • AWS Lambda
    • Azure Functions and the Azure App Service
    • Google Cloud Functions / Google Cloud Run Functions
    • Security Advantages and Concerns for Serverless
    • Function as a Service Controls
    • Persistence with Serverless
  • Cloud Customer Identity and Access Management (CIAM)
    • Overview of OAuth 2.0, OpenID Connect (OIDC), and SAML
    • Amazon Cognito User Pools
    • User Enumeration Attacks
    • Amazon Cognito User Account Takeover Attacks
    • Amazon Cognito Identity Pools
    • Amazon Cognito AWS IAM Broken Access Control
    • Google Cloud Identity for Customers and Partners
    • Firebase Authentication
  • Firebase Databases and Google Cloud Implications
    • Firebase Realtime Database
    • Cloud Firestore
    • Google Cloud Privilege Escalation via Firebase
    • Compliance Concerns

Section 5Multicloud, CSPM, and Third-Party Integrations

The final section covers multicloud operations, focusing on IAM risks, safe credential use, and Workload Identity Federation. Students automate security checks with CSPM tools, explore trust issues with third-party platforms, and study how to mitigate a real cloud security vendor vulnerability using Microsoft Defender as a case study.

Topics covered

  • Multicloud Access Management
  • Cloud Security Posture Management (CSPM)
  • Vendor Integration and Multicloud Security
  • Summary and Additional Resources

Labs

  • Secure Multicloud Integration
  • Automated Benchmarking
  • Prevent Cross-Cloud Confused Deputy
  • Bonus Challenges (Section 5)

Overview

The course concludes with practical guidance on how to operate an organization across multiple cloud providers. Many of the topics discussed in the course become more complicated if an organization's cloud providers are integrated with one another. We begin by discussing how multicloud integration impacts Identity and Access Management (IAM). Many organizations use long-lived credentials to support multicloud integrations. These credentials are much more valuable to attackers than those that are short-lived. Although students will learn best practices for long-lived credentials, this will only mitigate the risk, not eliminate it.

The next module goes one step further by demonstrating novel ways to use Workload Identity Federation to authenticate from one cloud provider to another. Students will learn how to use these methods to integrate with third-party Cloud Security Posture Management (CSPM) services, including those provided by the cloud.

Finally, students will learn how third-party integrations, including those for CSPMs, can go wrong. Organizations should distrust external services at least as much, if not more so, than their internal systems and users. This module provides the key requirements for minimizing the level of trust vested in these vendors and reducing the risk that this trust is abused. Students will explore this topic by using Multicloud CSPM services as an example. Specifically, they will learn about Microsoft Defender for Cloud's cross-cloud CSPM capabilities. They will analyze a case study of a critical vulnerability in Microsoft Defender for Cloud, discovered by the authors of this course, that could be used to access sensitive data in an organization's linked AWS accounts. Finally, they will implement mitigations to prevent similar types of exploits from being performed via third-party cloud vendors.

Full Topic Details

  • Multicloud Access Management
    • Risks of Long-Lived Credentials
    • Workload Identity Federation
  • Workload Identity
    • Cross-Cloud Authentication Without Long-Lived Credentials
  • Cloud Security Posture Management
  • Vendor Integrations
    • Vendor Integration Assessment Criteria
    • The Confused Deputy Problem
    • Confused Deputy Vulnerability in Microsoft Defender for Cloud
    • Mitigating Cross-Customer Broken Access Control via Cloud Vendors
    • Denying Excessive Permissions to Cloud Vendors
  • Summary
  • Additional Resources

Things You Need To Know

Important! Bring your own system configured according to these instructions!

The SEC510 course labs contain lab exercises for AWS, Azure, and GCP. Most labs can be completed with any one of these providers. However, we strongly recommend completing the labs for all three providers to learn how the services in each differ in small, yet critical ways. Experiencing this nuance in these interactive labs will help you better defend each platform and prepare for the GPCS certification.

The majority of SEC510's labs teach how to perform cloud security engineering tasks using tried-and-true techniques. This is important to ensure you understand how these processes work. However, some of these processes can be optimized using AI. For this reason, the labs provide many optional instructions demonstrating how you can leverage Agentic AI, specifically OpenAI’s Codex, to perform these cloud security engineering tasks quicker and more easily. We highly recommend trying these AI instruction paths.

SANS will provide students with the AWS accounts, Azure subscription, and Google Cloud project required to complete the labs for those providers.

OnDemand students:

  • Students can dynamically provision access to their AWS accounts, Azure subscription, and Google Cloud project by logging in to their SANS account and visiting the My Labs page.
  • When cloud account provisioning is complete, students can download time-limited credentials for accessing the cloud account.

Live events (In Person or Live Online)

  • Students are automatically provisioned access to their AWS account, Azure subscription, and Google Cloud project 24 hours before class starts.
  • Students can log in to their SANS account and visit the My Labs page to download their cloud credentials the day before class begins.

Mandatory Laptop Requirement:

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Bring Your Own Laptop Configured Using The Following Directions:

A properly configured system is required for each student participating in this course. Before starting your course, carefully read and follow these instructions exactly:

  • Operating system must be the latest version of Windows 10, macOS 10.15.x or later, or a Linux distribution that also can install and run the Firefox browser described below.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Must have the ability to install Firefox, enable a Firefox extension, and install a new trusted root certificate on the machine.
  • Prior to class, ensure that the following software is installed on the host operating system:

In Summary

Before beginning the course, you should:

SANS will be providing access to the following cloud environments: AWS, Azure, and Google Cloud. Unfortunately, due to some cloud security controls we cannot control, sometimes the login you receive requires verification with a valid phone number where you can receive text messages (virtual numbers will not work). Please ensure you have and are willing to provide your phone number to the cloud provider should this situation occur.

After you have completed those steps, access the SANS provider cloud accounts to connect to the SANS Cloud Security Flight Simulator. The SEC510 Flight Simulator server hosts an electronic workbook, terminal, and other services that can be accessed through the Firefox browser.

You must access the "Setup Instructions" document in the Course Material Downloads section of your SANS portal and follow its instructions before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact customer service.

SEC510 training is recommended for a diverse range of individuals, including:

  • Security engineers
  • Cloud engineers
  • DevOps engineers
  • Security analysts
  • Security researchers
  • Security auditors
  • System administrators
  • Operations personnel
  • Anyone who is responsible for:
    • Evaluating and adopting new cloud offerings
    • Researching new vulnerabilities and developments in cloud security
    • Handling Identity and Access Management
    • Managing a cloud-based virtual network
    • Secure configuration management
    • Generative AI (GenAI) and Agentic AI infrastructure

The GIAC Public Cloud Security (GPCS) certification validates a practitioner's ability to secure the cloud in both public and multi cloud environments. GPCS-certified professionals are familiar with the nuances of AWS, Azure, GCP and have the skills needed to defend each of these platforms.

  • Evaluation and comparison of public cloud service providers
  • Auditing, hardening, and securing public cloud environments
  • Introduction to multi-cloud compliance and integration

More Certification Details

  • Printed and Electronic courseware
  • MP3 audio files of the course
  • Access to the SANS Cloud Security Flight Simulator
  • Thousands of lines of IaC and secure configurations for each cloud platform that you can use in your organization

No, the bonus challenges are optional. Most use the AWS, Azure, and Google Cloud accounts SANS provides. One requires an Oracle Cloud Infrastructure (OCI) account, which SANS does not provide. Students who choose that challenge will need to set up their own OCI account and are responsible for any charges, though OCI's Free Tier credit is usually enough to finish it.

Although SEC510 uses Terraform Infrastructure-as-Code to deploy and configure services in each cloud for the labs, students will not need in-depth knowledge of Terraform or need to understand any of the syntax used. However, students will be introduced at a high level to what this code accomplishes.

The following are courses or equivalent experiences that are prerequisites for SEC510:

  • SEC502: Cloud Security Tactical Defense or hands-on experience using the AWS and Azure Cloud.
  • Students must have basic familiarity with the high-level concepts of cloud IAM and networking.
  • Students must be comfortable working with the Bash commands.

NOTE: This is not an application security course, and it will not teach you how to fix vulnerable application code. Instead, it will teach you practical controls and mitigations that you can use to prevent AppSec incidents from becoming breaches. While knowing how to code is helpful, it is not strictly required for this course.

The SEC510 course is part of the Cloud Security Engineer Journey. Security practitioners use these skills to build multicloud controls, mitigate risk, and detect attacks. The other two courses in the Journey are:

Depending on your current or desired future role, other courses that are great next steps in your cybersecurity journey are:

Cloud security controls are techniques and settings provided by cloud service providers (CSPs) that help protect cloud-based assets from unauthorized access, data breaches, and other cyber threats. While each CSP offers default controls, these are often generic and insufficient because they do not account for the unique needs of individual organizations.

Effective cloud security requires configuring these controls based on the organization’s specific business goals, risk tolerance, and operational requirements. This means going beyond defaults and tailoring protections—like access restrictions, encryption, and network segmentation—to fit real-world threats. When implemented thoughtfully by professionals who understand the nuances of different CSPs, cloud security controls play a critical role in reducing risk and securing sensitive data in an increasingly complex multicloud environment.  AI can help manage this complexity, but only when used by multicloud engineering experts.

SEC510: Cloud Security Engineering and Controls will deepen your expertise in securing multicloud environments, an increasingly vital skill in today’s cybersecurity world. You will gain hands-on experience with real-world attacks, learn to apply cloud-native tools across AWS, Azure, and Google Cloud, and master topics like IAM, secure configuration, data protection, and privilege escalation prevention. SEC510 focuses on practical, attack-driven controls rather than just compliance, equipping you to proactively defend cloud assets and reduce risk. These skills are in high demand and will set you apart in roles involving cloud security architecture, incident response, or DevSecOps.

Relevant Job Roles

Cloud Security Engineer Training, Salary, and Career Path

Cloud Security

Cloud Security Engineers integrate advanced security measures into cloud and cloud-native environments, maximize security automation within DevOps workflows, and proactively mitigate threats to safeguard modern cloud infrastructures.

Explore learning path

Cloud Security Analyst Training, Salary, and Career Path

Cloud Security

A Cloud Security Analyst monitors and analyzes activity across cloud environments, proactively detects and assesses threats, and implements preventive controls and targeted defenses to protect critical business systems and data.

Explore learning path

Cybersecurity Architecture (OPM 652)

NICE: Design and Development

Responsible for ensuring that security requirements are adequately addressed in all aspects of enterprise architecture, including reference models, segment and solution architectures, and the resulting systems that protect and support organizational mission and business processes.

Explore learning path

Technology Research and Development (OPM 661)

NICE: Design and Development

Responsible for conducting software and systems engineering and software systems research to develop new capabilities with fully integrated cybersecurity. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems.

Explore learning path

Enterprise Architecture (OPM 651)

NICE: Design and Development

Responsible for developing and maintaining business, systems, and information processes to support enterprise mission needs. Develops technology rules and requirements that describe baseline and target architectures.

Explore learning path

Secure Systems Development (OPM 631)

NICE: Design and Development

Responsible for the secure design, development, and testing of systems and the evaluation of system security throughout the systems development life cycle.

Explore learning path

Solution Architecture (ARCH)

Skills Framework for the Information Age

Definition of technology solutions that meet functional and non-functional requirements while aligning with strategic goals. Designs integrate security, scalability, and cost-effectiveness.

Explore learning path

Course Schedule and Pricing

Have Questions?Contact Us

GIAC Certification Attempt

Add a GIAC certification attempt and receive two free practice tests. View pricing in the info icons below.

OnDemand Course Access

When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.

Group and Private Pricing

Enroll your team as a group or arrange a private session for your organization. We’ll help you choose the format that fits your goals.

Contact Sales
Showing 10 of 10

Learn Alongside Leading Cybersecurity Professionals From Around The World

  • Slide 1 of 4
    One of the best SANS courses I have taken. I am going to recommend this training to other company InfoSec Professionals in our company.
    Randy FrestonBoA
  • Slide 2 of 4
    I maintain that this is the single best SANS class available (and I just got my 8th cert). If you can only take one course - this is the one.
    Joshua WileyTikTok
  • Slide 3 of 4
    If you Cloud, you need this course - <period>.
    Sean AyresUPS
  • Slide 4 of 4
    I would definitely recommend this course. I consider the security topics covered to be critical knowledge for companies that are hosting in the cloud. The course content has been very well put together, well researched, and is very applicable.
    Dan Van WingerdenRadiology Partners
Slide 1 of 0

Benefits of Learning with SANS

Bryan Simon: Teacher Standing Next to Smartboard and Explaining Concept

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Close Up of Woman Holding a Pen and Documents

Get access to our range of industry-leading courses and resources