AWS Red Team Certification (ACRTP)

The Amazon Cloud Red Team Professional (ACRTP) certification is earned through the Amazon Cloud Attack and Defense Bootcamp, an on-demand Pwned Labs program that goes deep on modern attack chains and the detections that catch them, then certifies you hands-on.

Attackers rarely break into AWS by dropping an exploit on a server. They log in with keys that were never meant to be theirs. In AWS, identity and access management is the real perimeter, and an AWS red team certification worth holding should prove you can abuse that layer the way a real intrusion does. The Amazon Cloud Red Team Professional (ACRTP) is built to test exactly that, hands-on, in live AWS accounts.

What the ACRTP certification proves

ACRTP is a hands-on AWS red team certification. There is no multiple choice section. You are dropped into a live AWS account seeded with realistic misconfigurations and telemetry, and you have to work an end-to-end attack chain: enumerate the environment, find the initial foothold, escalate privileges, pivot across services, and demonstrate impact. The assessment measures tradecraft, not trivia. When you pass, the certificate says you attacked real AWS infrastructure and won, which is the claim hiring managers and engagement leads actually care about.

Who this certification is for

ACRTP fits penetration testers moving into cloud, red teamers who need AWS depth, and cloud security engineers who want to understand offense so they can build better defenses. You do not need to be an AWS expert on day one. The Amazon Cloud Attack and Defense bootcamp that leads into the certification starts from cloud fundamentals and moves quickly into IAM abuse, credential theft, and lateral movement, so a strong general security background is enough to keep pace.

What you learn on the path to ACRTP

The curriculum mirrors how AWS environments are actually breached rather than a checklist of service names. Core areas include:

• IAM enumeration and privilege escalation, including role assumption chains and policy misconfigurations that grant more access than intended.
• Credential access: harvesting keys from instance metadata, environment variables, source control, and misconfigured storage.
• Lateral movement across compute, serverless, and container services, and pivoting between accounts in an AWS Organization.
• Abusing managed services such as S3, Lambda, EC2, and Secrets Manager to persist and reach sensitive data.
• Detection and telemetry awareness, so you understand what CloudTrail and GuardDuty record while you operate.

Because the labs run in production-like cloud accounts, you practice against the same signals a defender would see. That blue team awareness is what separates a cloud red teamer from someone who only knows a tool.

ACRTP compared to other AWS security certifications

The AWS Certified Security Specialty is a knowledge exam. It validates that you understand AWS security controls and can answer scenario questions, and it is valuable for defensive and architecture roles. It does not ask you to break anything. Other offensive exams prove general penetration testing skill but spend little time on cloud identity, which is where most cloud compromise now happens. ACRTP sits in the gap: an offensive, fully hands-on assessment focused specifically on AWS attack paths. If your goal is to prove you can execute a cloud red team engagement in AWS, a practical certification is more convincing than a knowledge exam.

How the ACRTP exam works

The certification is assessed in a live AWS account, not a simulation. You are given objectives and a time window, and you have to accomplish them using real tradecraft against real services with real logging in place. There is no memorization component and no proctored quiz. You either reach the objectives or you do not, which makes the credential difficult to fake and easy for an employer to trust.

Inside the ACRTP exam environment

The exam is a single realistic scenario rather than a question bank. Once you start, you have 24 hours to work through it. You are given an entry point into a live AWS account and you have to build a complete exploitation chain from that foothold to the flag. Nothing is abstracted away: the services are real, the misconfigurations are the kind that appear in production accounts, and the logging is live while you operate.

The environment is completely self-contained. You do not need to spin up your own infrastructure, register a phishing domain, or bring any external tooling beyond what you would normally carry into an engagement. The exam is not proctored, so there is no screen recording or invigilator on a call. You receive an invitation confirming your start time and the rest is down to your tradecraft.

Because the scenario is a chain rather than a set of isolated tasks, partial knowledge tends to show. You cannot memorize your way past a step that depends on understanding how an IAM trust policy actually evaluates, or why a role assumption succeeds from one principal and fails from another. That is the point: the format rewards operators who understand the mechanics rather than candidates who have rehearsed a checklist.

There is also no report to write. Some offensive certifications require a full pentest report after the practical component, which turns a technical assessment into a documentation exercise. ACRTP does not. You either build the chain and capture the flag or you do not, and that binary outcome is what makes the credential straightforward for a hiring manager to interpret.

Preparing for the ACRTP exam

You do not need prior AWS expertise to start. What you do need is comfort on the Windows or Linux command line and a general security foundation. Familiarity with AWS helps, but the bootcamp opens with cloud fundamentals before moving into IAM abuse, privilege escalation, and lateral movement, so the ramp is built into the path.

Registration includes 45 days of Academy access, which opens every lab on the platform rather than only the bootcamp material. The bootcamp is fully on-demand, so there is no cohort to wait for and no start date to work around. You enroll and begin immediately. The recommended approach is to claim your Academy access when you start rather than saving it, since the premium labs in the learning path are the fastest way to get comfortable with the tooling before you move into the harder material.

Worth knowing before you start: the labs run against production-like logging, so you see what CloudTrail and GuardDuty capture while you operate. Most offensive training treats detection as somebody else's problem. Here it runs alongside the attack path, which builds the purple team awareness that employers increasingly expect from cloud red teamers.

Your access to the custom bootcamp content is lifetime, and that is a separate thing from the 45 day Academy window. The bootcamp labs, the capstone CTF, the course materials, and the private Discord channels remain available to you indefinitely. Only the wider Academy catalog is time boxed, and registration includes a code for 50 percent off the annual subscription if you want to keep that catalog open afterwards. Exam scheduling uses a rolling three day buffer, so you can book any available date at least three days ahead. You sit it when you are ready rather than waiting for a schedule to come round.

After you pass: certification, badge, and retakes

The ACRTP certification does not expire and never needs renewing. There are no continuing education credits to log and no annual maintenance fee. Once you have demonstrated the capability, the credential stands.

Alongside the official certificate you receive a Credly digital badge, which is the format most recruiters and internal HR systems can verify directly. That matters more than it sounds: a verifiable badge removes the step where someone has to email you asking for proof.

If an attempt does not go your way, you can book a new slot. Retakes are scheduled at least two weeks after the previous attempt, which is deliberate. That gap is enough to work back through the labs covering whatever stage of the chain stopped you rather than immediately repeating the same approach. Exam attempts themselves do not expire and there is no deadline by which you must sit the exam, so you can prepare at whatever pace your workload allows.

ACRTP as part of the multi-cloud path

Most organizations do not run on a single provider. Identity federates across AWS, Azure, and Google Cloud, and an attacker who lands in one tenant frequently pivots into another through trust relationships that nobody mapped. Proving capability in one provider is useful, but proving it across all three is what reflects how modern estates actually break.

ACRTP is the AWS component of that path. Its counterparts are the Microsoft Cloud Red Team Professional (MCRTP), covering Azure and Microsoft 365, and the Google Cloud Red Team Professional (GCRTP), covering Google Cloud and Google Workspace. Completing all three earns the Multi-Cloud Red Team Professional (M-CRTP3) certification, a single credential validating offensive capability across every major provider.

The M-CRTP3 bundle covers all three bootcamps with two exam attempts for each of the three certifications. If multi-cloud work is where you are heading, taking the bundled route is more economical than certifying one provider at a time. Each provider certification also stands on its own, so there is no requirement to commit to all three at the outset. Many practitioners certify in the provider they work with daily, then add the others as their remit widens. Details of the bundled route are at pwnedlabs.io/bootcamps/m-crtp3-certification.

Related labs to build the skills first

You do not have to start with the certification. Pwned Labs hosts free starter labs for AWS where you practice real techniques against live environments in your browser. Working through those labs is the most direct way to gauge your readiness before committing to the bootcamp and exam. Browse the full catalog at pwnedlabs.io/explore.

Get certified

ACRTP is delivered through the Amazon Cloud Attack and Defense bootcamp, an on-demand program that goes deep on modern AWS attack chains and the detections that catch them, then certifies you hands-on. See the bootcamp and enrollment details at pwnedlabs.io/bootcamps/acrtp-bootcamp.

Pricing and enrollment

The Amazon Cloud Red Team Professional (ACRTP) bootcamp is $399. That covers the full curriculum, 45 days of Academy access across every lab on the platform, lifetime access to the custom bootcamp labs and the capstone CTF, the course materials, and the private Discord channels. Certification exam attempts are included, and registration also carries a code for 50 percent off the annual Academy subscription if you want to keep the wider catalog open after the 45 days.

If you plan to certify across more than one provider, the M-CRTP3 bundle covers ACRTP, MCRTP and GCRTP together for $999 and awards the Multi-Cloud Red Team Professional certification. That is roughly $200 less than buying the three separately, and it includes two exam attempts for each of the three certifications.

Frequently asked questions

Is ACRTP a hands-on certification?

Yes. Every ACRTP assessment takes place in a live AWS account with realistic misconfigurations and telemetry. There is no multiple choice component.

Do I need AWS experience before starting?

You need a solid general security foundation, not prior AWS expertise. The bootcamp begins with cloud fundamentals and progresses into advanced IAM abuse and lateral movement.

How is ACRTP different from the AWS Certified Security Specialty?

The AWS Certified Security Specialty is a defensive knowledge exam. ACRTP is an offensive, fully practical certification that requires you to compromise a live AWS environment.

Does ACRTP cover detection as well as attack?

Yes. The labs run against production-like logging, so you learn what CloudTrail and GuardDuty capture while you operate, which builds the purple team awareness employers want.

What roles does ACRTP support?

Cloud penetration tester, cloud red teamer, and cloud security engineer roles where proving offensive AWS capability matters.