AWS Red Team Certification (ACRTP)

The Amazon Cloud Red Team Professional (ACRTP) certification is earned through the Amazon Cloud Attack and Defense Bootcamp, an instructor-led Pwned Labs program that goes deep on modern attack chains and the detections that catch them, then certifies you hands-on.

Attackers rarely break into AWS by dropping an exploit on a server. They log in with keys that were never meant to be theirs. In AWS, identity and access management is the real perimeter, and an AWS red team certification worth holding should prove you can abuse that layer the way a real intrusion does. The Amazon Cloud Red Team Professional (ACRTP) is built to test exactly that, hands-on, in live AWS accounts.

What the ACRTP certification proves

ACRTP is a hands-on AWS red team certification. There is no multiple choice section. You are dropped into a live AWS account seeded with realistic misconfigurations and telemetry, and you have to work an end-to-end attack chain: enumerate the environment, find the initial foothold, escalate privileges, pivot across services, and demonstrate impact. The assessment measures tradecraft, not trivia. When you pass, the certificate says you attacked real AWS infrastructure and won, which is the claim hiring managers and engagement leads actually care about.

Who this certification is for

ACRTP fits penetration testers moving into cloud, red teamers who need AWS depth, and cloud security engineers who want to understand offense so they can build better defenses. You do not need to be an AWS expert on day one. The Amazon Cloud Attack and Defense bootcamp that leads into the certification starts from cloud fundamentals and moves quickly into IAM abuse, credential theft, and lateral movement, so a strong general security background is enough to keep pace.

What you learn on the path to ACRTP

The curriculum mirrors how AWS environments are actually breached rather than a checklist of service names. Core areas include:

• IAM enumeration and privilege escalation, including role assumption chains and policy misconfigurations that grant more access than intended.
• Credential access: harvesting keys from instance metadata, environment variables, source control, and misconfigured storage.
• Lateral movement across compute, serverless, and container services, and pivoting between accounts in an AWS Organization.
• Abusing managed services such as S3, Lambda, EC2, and Secrets Manager to persist and reach sensitive data.
• Detection and telemetry awareness, so you understand what CloudTrail and GuardDuty record while you operate.

Because the labs run in production-like cloud accounts, you practice against the same signals a defender would see. That blue team awareness is what separates a cloud red teamer from someone who only knows a tool.

ACRTP compared to other AWS security certifications

The AWS Certified Security Specialty is a knowledge exam. It validates that you understand AWS security controls and can answer scenario questions, and it is valuable for defensive and architecture roles. It does not ask you to break anything. Other offensive exams prove general penetration testing skill but spend little time on cloud identity, which is where most cloud compromise now happens. ACRTP sits in the gap: an offensive, fully hands-on assessment focused specifically on AWS attack paths. If your goal is to prove you can execute a cloud red team engagement in AWS, a practical certification is more convincing than a knowledge exam.

How the ACRTP exam works

The certification is assessed in a live AWS account, not a simulation. You are given objectives and a time window, and you have to accomplish them using real tradecraft against real services with real logging in place. There is no memorization component and no proctored quiz. You either reach the objectives or you do not, which makes the credential difficult to fake and easy for an employer to trust.

Related labs to build the skills first

You do not have to start with the certification. Pwned Labs hosts free starter labs for AWS where you practice real techniques against live environments in your browser. Working through those labs is the most direct way to gauge your readiness before committing to the bootcamp and exam. Browse the full catalog at pwnedlabs.io/explore.

Get certified

ACRTP is delivered through the Amazon Cloud Attack and Defense bootcamp, an instructor-led program that goes deep on modern AWS attack chains and the detections that catch them, then certifies you hands-on. See the bootcamp and enrollment details at pwnedlabs.io/bootcamps/acrtp-bootcamp.

Frequently asked questions

Is ACRTP a hands-on certification?

Yes. Every ACRTP assessment takes place in a live AWS account with realistic misconfigurations and telemetry. There is no multiple choice component.

Do I need AWS experience before starting?

You need a solid general security foundation, not prior AWS expertise. The bootcamp begins with cloud fundamentals and progresses into advanced IAM abuse and lateral movement.

How is ACRTP different from the AWS Certified Security Specialty?

The AWS Certified Security Specialty is a defensive knowledge exam. ACRTP is an offensive, fully practical certification that requires you to compromise a live AWS environment.

Does ACRTP cover detection as well as attack?

Yes. The labs run against production-like logging, so you learn what CloudTrail and GuardDuty capture while you operate, which builds the purple team awareness employers want.

What roles does ACRTP support?

Cloud penetration tester, cloud red teamer, and cloud security engineer roles where proving offensive AWS capability matters.