AWS Security Specialty in 2026: Why IAM Decides SCS-C03

Last updated September 2026

First, the rumor: AWS has not renamed or retired this certification. It’s still AWS Certified Security – Specialty. What changed is the exam. SCS-C03 replaced SCS-C02 on December 2, 2025, with reorganized domains, identity and access management as the biggest weight, generative AI guardrails, and new ordering and matching questions (AWS). AWS says the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions of the exam retire after December 31, 2026 (AWS).

This is AWS’s advanced security cert. It tests whether you can detect threats, respond to incidents, lock down networks and compute, design identity and permissions at scale, protect data with encryption and key management, and govern many AWS accounts at once. Cloud teams and security teams both hire for it.

SCS-C02 to SCS-C03: what moved

Weights and tasks come from the SCS-C03 exam guide. Compared with SCS-C02, the old “Threat Detection and Incident Response” and “Security Logging and Monitoring” domains became separate Detection and Incident Response domains, IAM rose from 16% to 20%, and “Management and Security Governance” was renamed “Security Foundations and Governance” (AWS comparison). If you’re using study material written for SCS-C02, check it against the new guide.

SCS-C03 format, scoring and price

Sources: AWS’s Security – Specialty certification page and the official SCS-C03 exam guide.

Who should sit it, and what to have first

• Cloud security engineers and architects working mainly in AWS
• Security analysts and incident responders who investigate AWS environments
• DevSecOps engineers building security into AWS pipelines and accounts
• Solutions architects who want to prove security depth on top of an associate or professional AWS cert

This is not a first cloud cert. AWS’s certification page says it’s intended for people with five years of IT security experience and two or more years of hands-on experience securing AWS workloads, while the SCS-C03 exam guide describes the target candidate as having the equivalent of three to five years of experience securing cloud solutions (AWS, exam guide). There are no formal prerequisites.

IAM is where it’s won or lost

• Policy evaluation logic. Identity policies, resource policies, permission boundaries, SCPs and RCPs all interact. If you can’t predict the result of a tricky policy without running it, you’re not ready.
• KMS details. Key policies versus grants, and who can actually use a key, catch out people who only ever clicked “encrypt.”
• Thinking in one account. The exam assumes Organizations, Control Tower and many accounts. Single-account habits lead to wrong answers.
• The new question types. Ordering and matching are new in SCS-C03. Practice them before exam day so the format doesn’t cost you time.

Ten weeks, biggest domain first

Budget eight to ten hours a week, with working AWS experience. Build in your own account the whole way; the scenario questions reward people who have configured these services.

• Weeks 1 to 2: identity and access (20%). IAM policy evaluation logic, permission boundaries, SCPs and RCPs, cross-account roles, IAM Identity Center and Cognito. This is the biggest domain and it shows up inside every other one.
• Weeks 3 to 4: data protection (18%). KMS key policies and grants, envelope encryption, Secrets Manager, ACM and TLS, S3 encryption and bucket policies.
• Weeks 5 to 6: infrastructure security (18%). VPC design, security groups vs network ACLs, WAF, Shield, Network Firewall, secure compute access with Session Manager, and generative AI guardrails.
• Weeks 7 to 8: detection and incident response (30% combined). CloudTrail, CloudWatch, GuardDuty, Security Hub, Security Lake, Detective and Config. Practice automated responses and write down your incident runbook for a compromised access key and a compromised EC2 instance.
• Week 9: governance (14%). Organizations, Control Tower, account vending, deployment guardrails and compliance checks.
• Week 10: practice. Take the official practice question set and pretest, review every explanation, and practice the new ordering and matching question types.

Price and discounts

• Exam: US$300. If you already hold an active AWS certification, you get a 50% discount on your next AWS exam.
• Official prep: AWS Skill Builder has an exam prep plan, an official practice question set and a pretest. Some of it is free; the fuller practice material needs a subscription.
• Hands-on practice: Budget a small amount for your own AWS account. Most labs cost little if you tear resources down afterward, but set a billing alarm first.
• Recertification: Every three years by passing the current version of the exam.

How security teams read this cert

As proof of hands-on AWS security depth, which is hard to fake in an interview. It pairs well with a broad cert and real incident or engineering experience on the platform. Most real AWS breaches come from leaked keys, overly broad permissions and public storage, not exotic exploits, and good interviewers probe exactly those.

AWS’s certification page cites Skillsoft’s October 2024 IT Skills and Salary survey, which ranked the Security – Specialty among the top highest-paying technical certifications in the United States (AWS). That’s a vendor citing a third-party survey, so treat it as a signal rather than a promise.

Independent pay data isn’t broken out by certification. The U.S. Bureau of Labor Statistics reports a median pay of $129,180 in May 2025 for information security analysts, with 21% projected growth from 2025 to 2035 (BLS). Cloud security engineers with deep AWS skills often sit above that median, but the certification works best alongside real AWS experience.

Compared with CCSP, SC-200, SC-500 and CISSP

• AWS vs CCSP: CCSP is vendor-neutral cloud security from ISC2 and covers governance, legal and architecture across all clouds. The AWS exam is deeply technical and AWS-only. Many cloud security engineers hold both.
• AWS vs SC-200: SC-200 is Microsoft’s security operations analyst exam, focused on Sentinel and Defender. It’s a SOC role; the AWS exam is broader cloud security engineering.
• The Azure equivalent has changed: Microsoft retired the Azure Security Engineer Associate certification and its AZ-500 exam on August 31, 2026. Its replacement is the Cloud and AI Security Engineer Associate certification (exam SC-500), available since July 21, 2026 (Microsoft). If you secure both AWS and Azure, SC-500 is now the Azure counterpart to this exam.
• AWS vs CISSP: CISSP is a broad management-leaning certification that many senior roles require. The AWS exam proves hands-on cloud depth. They complement each other. If you would rather have a vendor-neutral, hands-on architecture credential, CompTIA SecurityX covers security engineering across cloud, hybrid and on-premises environments.

Planning a cloud security path? Our certification roadmap lays it out in order.

Best Cybersecurity Certifications in 2026 ranks this cert against the rest of the field. Before you book, turn on GuardDuty, Security Hub and CloudTrail in a lab account and trigger findings on purpose.

Most cloud breaches start with a leaked key, not an exotic exploit. The CyberExperts Daily Brief flags the cloud incidents worth your attention in five minutes each weekday morning. Get tomorrow’s brief.

AWS Security Specialty FAQ

Sources

• AWS, AWS Certified Security – Specialty: aws.amazon.com
• AWS, SCS-C03 exam guide: docs.aws.amazon.com
• AWS, Comparison of SCS-C02 and SCS-C03: docs.aws.amazon.com
• Microsoft Partner Center, August 2026 announcements (AZ-500 retirement and SC-500): learn.microsoft.com
• BLS, Information security analysts: bls.gov

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.