Getting started
How to join the room, which Skill Builder track to pick, what you need before the labs, what this course assumes you already know, and how to get the most out of the day.
Join the class remotely
Two links to keep open for the day. The session itself runs on Webex, and the group exercises happen on a shared Figma whiteboard. Both links stay the same across all three blocks — morning, afternoon and the labs — so you can join once and leave the tabs open, or rejoin on the same links after a break.
Both open in a new tab. Webex works from the browser if you would rather not install the desktop app. The Figma board is open for editing — you can sketch on it directly, no account needed to view.
If your corporate network blocks either button, paste the address straight into your browser instead — proxies often strip the click-through but allow the URL. Figma in particular tends to be blocked on managed laptops more than Webex is.
https://awsvirtual.webex.com/awsvirtual/j.php?MTID=m4bfd03d4a84acb70b9a1012390563531
https://www.figma.com/board/rBsmTgKViCaIRV15ACWQhw/secgov-7sep?node-id=0-1&t=6fR6wEXCqEpnqBzP-1
- Join a few minutes early. First-time Webex users may get an install or permissions prompt for microphone and camera, and it is better to clear that before the session starts than during the first module.
- Use the chat for lab problems. Paste the task and step number, plus the exact error text. That is usually enough to diagnose without a screen share.
- Keep this site open in a second tab. The module pages are built to sit alongside the slides — the diagrams here are clickable where the projected ones are static.
- A personal machine is often easier for the labs. Managed laptops with strict proxies tend to be the thing that blocks the AWS console or the lab portal, not the labs themselves.
Join the lab workshop
The three hands-on labs run in AWS Workshop Studio. You get a temporary AWS account that is already provisioned with everything the labs need — you do not use your own account, and you do not need to enter a credit card.
The access code is already embedded in the link, so the button is enough. The code is shown separately in case you need to type it in manually.
1
Open the join link
The access code arrives prefilled. If you land on a blank join page instead, go to catalog.us-east-1.prod.workshops.aws/join and enter the code above by hand.
2
Sign in when prompted
Choose the email one-time passcode option unless you already have an AWS Builder ID. You will be emailed a short code to paste back in. This signs you in to the workshop only — it is not an AWS account login and it does not touch your corporate credentials.
3
Accept the terms and join the event
Read the terms, tick the box, then join. Provisioning your lab account takes a short while the first time — do this before the lab block starts rather than when it does.
4
Open the AWS console from the left panel
Once you are in, the left-hand panel has the button that opens the console in your temporary account, and the lab instructions sit alongside it. Keep both open next to this site.
The lab account is disposable and region-pinned. Everything in it is deleted when the event closes, so do not put anything you want to keep in there. The labs also pin you to one AWS Region — if a console action fails with an explicit deny mentioning a region policy, check the Region selector in the top right before assuming the lab is broken.
Take it on AWS Skill Builder — two tracks
The same syllabus you are sitting through is available on Skill Builder in two forms. The only real difference is whether you get the hands-on lab environment. Pick whichever fits what you need after class.
Which one? If you only want to re-hear the explanation, take the free track — it costs nothing and needs no account approval. If you want to redo the labs after class, you need the digital classroom, because the lab environment is what the subscription pays for. The classroom labs you get today expire; the Skill Builder ones do not.
Lab access via AWS Builder Labs (alternative route)
Use the Workshop Studio link above unless your instructor says otherwise. This section applies only if your session is provisioned through AWS Builder Labs with a registration email instead of a workshop access code.
1
Find your registration link
Your instructor sends a welcome email before class containing a registration URL that is unique to your session. That link is what ties your account to this specific class — a generic sign-up will not give you the labs.
2
Create your AWS Builder Labs account through that link
Use the registration URL rather than signing up separately. Going in this way applies your class licence automatically, so you will not need a separate code from the instructor.
3
Open your guides from the dashboard
Once you are in, the Lab Guide and Student Guide buttons sit at the top right of the Builder Labs dashboard. They stay greyed out until the class officially starts. Both guides can be read online or downloaded and kept.
4
Check your machine before the first lab, not during it
Any current Windows, macOS or Linux machine works. Use Chrome, Firefox or Edge. Turn off ad blockers and script blockers for the lab domains — they are the single most common cause of a lab that appears broken.
What this course assumes
This is a technical course pitched at people who already work with AWS. It does not re-teach IAM basics or VPC fundamentals.
Expected first
AWS Security Fundamentals and AWS Security Essentials. If you have not done these, the IAM and policy-evaluation material in M02 and M03 will move fast.
Helpful, optional
Introduction to AWS Control Tower, Automated Landing Zone, Introduction to AWS Service Catalog, and the AWS Cloud Management Assessment. Any of these will make the afternoon feel more like reinforcement than first contact.
Assumed comfort
Reading and writing IAM policy JSON, navigating the AWS console, and a general grasp of what a CloudFormation template does.
Not assumed
Prior experience with Organizations, Control Tower, Service Catalog or Config. Those are what the course is for.
What you should be able to do afterwards
- Make the case for governance at scale in terms a budget holder recognises, not just a security team.
- Describe a landing zone — which OUs exist, which accounts are shared, why logging and audit are separated, and where controls attach.
- Choose between preventive and detective for a given requirement, and explain the trade-off rather than defaulting to one.
- Give builders self-service through Service Catalog without handing out permissions you would not defend in an audit.
- Close the loop from a Config rule firing to a Systems Manager automation putting the resource back into compliance.
- Know where to look next — which whitepaper, which blog, which reference architecture.
How to use this site
Every page follows the same shape: a sticky tab bar under the hero, one panel visible at a time. Nothing is hidden behind scroll position, so you can jump straight to the part you want mid-discussion.
- During class — keep the relevant module page open alongside the slides. The diagrams here are clickable where the slides are static.
- During labs — the lab companion pages explain why each step exists. Follow the official lab guide for the actual clicks.
- After class — the deep dives and the resource library are the parts designed to outlive the day.
- Anywhere — the floating button at the top right toggles light and dark, and opens the full page menu. Light mode is built for projectors and printing.
How the day fits together
The course is built as one argument, not five topics. Morning establishes why central governance stops scaling manually and how Control Tower automates the foundation. Afternoon splits control into its two halves — stopping bad things up front, and catching them when they slip through — then hands you the reference material to keep going.
The through-line
Implement
Stand up a multi-account foundation once, from a blueprint, instead of hand-building each account. This is the landing zone.
Provision
Let builders help themselves from a catalogue of pre-approved, pre-constrained products, so speed does not cost you compliance.
Operate
Keep watching after launch. Record configuration, evaluate it against rules, alert on drift, and remediate without a human in the loop.
Read this first if you only have ten minutes. The single most important idea in the course is the split between
preventive and
detective controls — what each one can and cannot do, and why you need both. The
Preventive vs Detective deep dive covers it end to end with the actual policy documents.
Lab companions
Three labs, all in the afternoon. These pages are not a substitute for the official lab guide — they are the context around it: what the lab is actually demonstrating, why each step matters, and which idea from the module it proves.
What each lab proves
| Lab | Module idea it demonstrates | The moment that matters |
|---|
| Lab 1 |
A preventive control can be an enablement mechanism, not just a blocker. |
The launch constraint. The product deploys with permissions the end user does not personally hold — that indirection is the whole trick. |
| Lab 2 |
At scale you operate on sets of resources, never individuals. |
Running one automation against a resource group and watching it fan out. No SSH, no per-instance login. |
| Lab 3 |
Detection without remediation is just a nicer inbox. |
Attaching the remediation action. The rule stops being a report and becomes a control loop. |
Lab environments use plain IAM users, not IAM Identity Center. That is a constraint of the sandbox, not a recommendation. In anything resembling production, federate through IAM Identity Center and stop issuing long-lived access keys — which is exactly what M02 argues.
Services in scope
Eight services carry the course. The point is never the individual service — it is how they compose. Organizations provides the boundary, Control Tower automates the setup, Service Catalog gates provisioning, Config and Systems Manager close the loop after launch.
Foundation — the account boundary
AWS Organizations
The account boundary itself. OUs, consolidated billing, and the attachment point for service control policies.
M01 · M02
AWS Control Tower
Automates the whole landing zone from a blueprint — OUs, shared accounts, controls, and Account Factory.
M02
IAM Identity Center
One place to manage workforce access across every account. SAML federation, SCIM provisioning, permission sets.
M02
AWS CloudFormation
The template layer underneath everything. Service Catalog products, Config rules, and account baselines are all stacks.
M02 · M03
Preventive — stop it before it happens
AWS Service Catalog
Curated portfolios of pre-approved products. Builders self-serve; constraints decide what they can actually launch.
M03 · Lab 1
AWS Budgets
Cost as a governance control. Thresholds, alerts, and budget actions that restrict provisioning when spend runs hot.
M03
Detective — find out when it does
AWS Config
Records what every resource looks like and how it changed, then evaluates that against rules. The audit backbone.
M04 · Lab 3
AWS Systems Manager
Groups resources, surfaces operational data, and runs the automation that actually fixes what Config flags.
M04 · Lab 2
Amazon GuardDuty
Continuous threat detection over CloudTrail, VPC flow logs and DNS logs, using threat intel and machine learning.
M04
AWS Security Hub
Aggregates findings across accounts and providers, runs standards checks, and prioritises what to act on first.
M04
Supporting cast
AWS CloudTrail
The API activity record. Centralised into the log archive account so no member account can quietly erase its own history.
M02 · M04
Amazon CloudWatch
Metrics, dashboards and the event bus that turns a detection into an action.
M04
AWS Transit Gateway
Lives in the network account of the landing zone, providing shared connectivity rather than per-account peering sprawl.
M02
AWS IAM
Still the engine underneath. Roles, policies, and the permission boundaries that constraints and SCPs build on.
All modules