CS

    Cloud Security Cert Prep (AWS, Azure, GCP, CCSP)

    1

    Hands-on tutor for cloud security certifications — learn the methodology and practice in your own authorized account.

    $12

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more
    CS

    Cloud Security Cert Prep (AWS, Azure, GCP, CCSP)

    Example session with this skill installed

    I am studying for the AWS Security Specialty. I struggle with KMS key policies and cross-account access. Can you give me a hands-on lab exercise for my free-tier account?

    • Read your context and instructions
    • Compiled the cloud security cert

    I will guide you through a hands-on lab to configure cross-account KMS access. This exercise focuses on the relationship between the KMS Key Policy in Account A and the IAM Policy in Account B.

    AWS KMS Cross-Account Access Lab

    ComponentResource TypeConfiguration Requirement
    Account AKMS Multi-Region KeyKey Policy must explicitly allow kms:Decrypt for the External ARN.
    Account AS3 BucketEncryption set to the custom KMS ARN.
    Account BIAM User/RolePolicy must grant kms:Decrypt on the Account A Key ARN.
    Account BCLI/SDKMust use the full ARN of the key, not the alias.

    Implementation Steps

    In Account A: Create a symmetric KMS key. In the

    Key Policy, add a statement allowing the root ARN or a specific IAM Role ARN from

    Account B to perform kms:Decrypt and kms:DescribeKey.
    2. In Account A: Upload a test file to an S3 bucket and encrypt it using this new key.
    3.

    In Account B: Create an IAM policy that grants kms:Decrypt permissions specifically for the ARN of the key created in Account A. Attach this to your test user.
    4. Validation: From the Account B CLI, attempt to download and decrypt the object:
    aws s3 cp s3://account-a-bucket/test.txt . --sse aws:kms --sse-kms-key-id <Key-ARN-from-Account-A>

    Teardown Checklist

    • Delete S3 Objects: Empty the test bucket in Account A.
    • Schedule Key Deletion: Set the KMS key for deletion (7-day minimum).
    • Delete IAM Policy: Remove the cross-account policy in Account B to maintain hygiene.

    Next steps

    1. Verify the Key Policy in Account A allows the external principal; without this, the IAM policy in Account B is insufficient.
    2. Check the CloudTrail logs in Account A to see the Decrypt event originating from Account B.
    3. Move to references/aws-security.md to review KMS Grant vs. Key Policy scenarios.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Create personalized gap blueprints for AWS, Azure, and GCP security exams.Design hands-on IAM misconfiguration labs for free-tier cloud accounts.Build cloud-native detection queries for SC-200 and SC-100 prep.Map shared-responsibility boundaries for complex cloud architecture scenarios.

    About this skill

    Preparing for a cloud security certification means learning a curriculum the major exams share: the shared-responsibility model and cloud IAM, each provider's security services across AWS, Azure, and GCP, and cloud detection, logging, and incident response. cloud-cert-prep is a hands-on tutor that teaches that curriculum and walks you through configuring and verifying it in your own authorized account, so you understand the why behind each control instead of memorizing service names.

    It maps the certs that matter — AWS Certified Security – Specialty, Azure AZ-500, SC-200, and SC-100, Google Professional Cloud Security Engineer, and ISC2 CCSP — to the topics, exam format, and study focus each one weights, so your study time lands where the exam actually tests. For cloud threat intelligence and cloud forensics beyond exam scope, it points you to complementary skills.

    This is a knowledge skill: it teaches methodology and builds you a study plan, but it never runs or changes anything in your cloud account for you — you perform the hands-on steps. It is for authorized practice in accounts you own, the free tier, or official vendor labs only; it will not help against tenants you don't own and does not provide exam braindumps. Cloud labs incur real charges, so it keeps you cost-aware and reminds you to tear down after every session. Exam codes and console steps change over time, so it links the official page and tells you to verify. No skill can guarantee a pass — outcomes depend on your practice.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 11 days ago

    • Passed all security checks, Safe to install

    Listed11 days ago

    What's inside

    Frequently Asked Questions