Updated September 2026: AWS has not renamed or retired this certification. It is still called AWS Certified Security – Specialty, and the current exam is SCS-C03, which replaced SCS-C02 on December 2, 2025. The new version reorganizes the domains, gives identity and access management the biggest weight, adds generative AI guardrails, and introduces ordering and matching questions (AWS). AWS says the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions of the exam retire after December 31, 2026 (AWS).
AWS Certified Security – Specialty is Amazon Web Services’ advanced certification for people who secure workloads in AWS. It tests whether you can detect threats, respond to incidents, lock down networks and compute, design identity and permissions at scale, protect data with encryption and key management, and govern many AWS accounts at once. It’s one of the few vendor certifications that security teams, not just cloud teams, actively hire for.
This guide covers who the certification is for, the SCS-C03 exam facts, the six domains and what changed from SCS-C02, the cost, a study plan, career value, and how it compares with CCSP, SC-200 and CISSP. For the wider picture, see Best Cybersecurity Certifications in 2026.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Who AWS Certified Security – Specialty is for
- Cloud security engineers and architects working mainly in AWS
- Security analysts and incident responders who investigate AWS environments
- DevSecOps engineers who build security into AWS pipelines and accounts
- Solutions architects who want to prove security depth on top of an associate or professional AWS certification
AWS positions this as an experienced-level exam. Its certification page says it’s intended for people with five years of IT security experience and two or more years of hands-on experience securing AWS workloads, while the SCS-C03 exam guide describes the target candidate as having the equivalent of three to five years of experience securing cloud solutions (AWS, exam guide). There are no formal prerequisites.
AWS Security Specialty exam facts (SCS-C03)
| Item | Details |
|---|---|
| Exam code | SCS-C03 (in use since December 2, 2025; SCS-C02 ended December 1, 2025) |
| Questions | 65: 50 scored and 15 unscored (unscored questions are not identified) |
| Question types | Multiple choice, multiple response, ordering and matching |
| Time limit | 170 minutes |
| Scoring | Scaled 100 to 1,000; 750 to pass; compensatory (you pass on the overall score, not each domain) |
| Price | US$300 (foreign exchange rates apply outside the U.S.) |
| Where you test | Pearson VUE test centers or online proctored |
| Languages | English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese and Spanish (Latin America); the last three retire after December 31, 2026 |
| Validity | Three years; recertify by passing the latest version of the exam |
| Discount | 50% off your next AWS exam once you hold an active AWS certification |
Sources: AWS’s Security – Specialty certification page and the official SCS-C03 exam guide.
The six SCS-C03 domains
| Domain | Weight | What it covers |
|---|---|---|
| 1. Detection | 16% | Monitoring and alerting across accounts, logging solutions and log data lakes (for example, GuardDuty, Security Hub, Security Lake, Macie), and troubleshooting them |
| 2. Incident Response | 14% | Designing and testing an incident response plan, and responding to security events |
| 3. Infrastructure Security | 18% | Security controls for network edge services, compute workloads and networks, including protections and guardrails for generative AI applications |
| 4. Identity and Access Management | 20% | Authentication (IAM Identity Center, Cognito, MFA) and authorization strategies at scale |
| 5. Data Protection | 18% | Controls for data in transit and at rest, and protecting secrets, credentials and cryptographic key material |
| 6. Security Foundations and Governance | 14% | Centrally deploying and managing accounts (for example, Control Tower and organization policies such as SCPs and RCPs), secure deployment strategies and compliance evaluation |
Weights and tasks come from the SCS-C03 exam guide. Compared with SCS-C02, the old “Threat Detection and Incident Response” and “Security Logging and Monitoring” domains became separate Detection and Incident Response domains, IAM rose from 16% to 20%, and “Management and Security Governance” was renamed “Security Foundations and Governance” (AWS comparison). If you’re using study material written for SCS-C02, check it against the new guide.
What the AWS Security Specialty costs
- Exam: US$300. If you already hold an active AWS certification, you get a 50% discount on your next AWS exam.
- Official prep: AWS Skill Builder has an exam prep plan, an official practice question set and a pretest. Some of it is free; the fuller practice material needs a subscription.
- Hands-on practice: Budget a small amount for your own AWS account. Most labs cost little if you tear resources down afterward, but set a billing alarm first.
- Recertification: Every three years by passing the current version of the exam.
A 10-week SCS-C03 study plan
This assumes about eight to ten hours a week and working AWS experience. Build in your own account throughout; the scenario questions reward people who have configured these services, not just read about them.
- Weeks 1 to 2: identity and access (20%). IAM policy evaluation logic, permission boundaries, SCPs and RCPs, cross-account roles, IAM Identity Center and Cognito. This is the biggest domain and it shows up inside every other one.
- Weeks 3 to 4: data protection (18%). KMS key policies and grants, envelope encryption, Secrets Manager, ACM and TLS, S3 encryption and bucket policies.
- Weeks 5 to 6: infrastructure security (18%). VPC design, security groups vs network ACLs, WAF, Shield, Network Firewall, secure compute access with Session Manager, and generative AI guardrails.
- Weeks 7 to 8: detection and incident response (30% combined). CloudTrail, CloudWatch, GuardDuty, Security Hub, Security Lake, Detective and Config. Practice automated responses and write down your incident runbook for a compromised access key and a compromised EC2 instance.
- Week 9: governance (14%). Organizations, Control Tower, account vending, deployment guardrails and compliance checks.
- Week 10: practice. Take the official practice question set and pretest, review every explanation, and practice the new ordering and matching question types.
Is the AWS Security Specialty worth it? Jobs and salary
AWS’s certification page cites Skillsoft’s October 2024 IT Skills and Salary survey, which ranked the Security – Specialty among the top highest-paying technical certifications in the United States (AWS). That’s a vendor citing a third-party survey, so treat it as a signal rather than a promise.
For an independent benchmark, the U.S. Bureau of Labor Statistics reports a median pay of $129,180 in May 2025 for information security analysts, with 21% projected growth from 2025 to 2035 (BLS). Cloud security engineers with deep AWS skills often sit above that median, but the certification works best alongside real AWS experience.
AWS Security Specialty vs CCSP, SC-200 and CISSP
- AWS vs CCSP: CCSP is vendor-neutral cloud security from ISC2 and covers governance, legal and architecture across all clouds. The AWS exam is deeply technical and AWS-only. Many cloud security engineers hold both.
- AWS vs SC-200: SC-200 is Microsoft’s security operations analyst exam, focused on Sentinel and Defender. It’s a SOC role; the AWS exam is broader cloud security engineering.
- The Azure equivalent has changed: Microsoft retired the Azure Security Engineer Associate certification and its AZ-500 exam on August 31, 2026. Its replacement is the Cloud and AI Security Engineer Associate certification (exam SC-500), available since July 21, 2026 (Microsoft). If you secure both AWS and Azure, SC-500 is now the Azure counterpart to this exam.
- AWS vs CISSP: CISSP is a broad management-leaning certification that many senior roles require. The AWS exam proves hands-on cloud depth. They complement each other.
Planning your next certification? See the full certification roadmap for the order to take them by career goal.
What I would tell a friend starting the AWS Security Specialty
Learn IAM policy evaluation until you can predict the result of a tricky policy without running it. Then build: turn on GuardDuty, Security Hub and CloudTrail in a lab account and trigger findings on purpose. Most real AWS breaches come from leaked keys, overly broad permissions and public storage, not exotic exploits, and the exam leans the same way.
Most cloud breaches start with a leaked key, not an exotic exploit. The CyberExperts Daily Brief covers what changed in security and why it matters, in five minutes, weekday mornings. Get tomorrow’s brief.
Frequently asked questions
Is AWS Certified Security – Specialty being retired?
No. As of September 2026 the certification is active under the same name. The current exam is SCS-C03, which replaced SCS-C02 on December 2, 2025. Only the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) language versions retire after December 31, 2026.
How many questions are on the AWS Security Specialty exam?
65 questions in 170 minutes: 50 scored and 15 unscored. Question types include multiple choice, multiple response, ordering and matching.
What is the passing score for SCS-C03?
750 on a scaled score of 100 to 1,000. Scoring is compensatory, so you need to pass the exam overall, not each domain.
How much does the AWS Security Specialty exam cost?
US$300. If you already hold an active AWS certification, you get 50% off your next AWS exam.
What changed from SCS-C02 to SCS-C03?
The domains were reorganized into Detection, Incident Response, Infrastructure Security, Identity and Access Management (now the largest at 20%), Data Protection, and Security Foundations and Governance. The exam also added generative AI guardrails and new ordering and matching question types.
How long is the AWS Security Specialty valid?
Three years. You recertify by passing the latest version of the exam.
Do I need another AWS certification first?
No. There are no prerequisites, but AWS says candidates commonly earn the Solutions Architect – Associate or Professional first, and it recommends several years of security and hands-on AWS experience.
Sources
- AWS, AWS Certified Security – Specialty: aws.amazon.com
- AWS, SCS-C03 exam guide: docs.aws.amazon.com
- AWS, Comparison of SCS-C02 and SCS-C03: docs.aws.amazon.com
- Microsoft Partner Center, August 2026 announcements (AZ-500 retirement and SC-500): learn.microsoft.com
- BLS, Information security analysts: bls.gov
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
