Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

AWS Certified Security – Specialty (SCS-C03) — Skills Reference · toddkasper | DecimalAI

securityby toddkasper

AWS Certified Security – Specialty (SCS-C03) — Skills Reference

toddkasper/aws-security-specialty

Source toddkasper/expert-skills ↗License MIT

AWS security engineering — threat detection (GuardDuty, Security Hub CSPM, Detective, Security Lake), incident response and containment, IAM policy evaluation and permission boundaries, infrastructure/network security (security groups, NACLs, WAF, Shield, PrivateLink), data protection and KMS encryption strategy, Secrets Manager, Macie, and multi-account governance (SCPs, Control Tower, Config, Firewall Manager).

SkillScore74Maintained

Automatic

Security & AppSec pack

Last verified 8/6/2026

What it changes

Passed 17 of 23 test cases with the skill, and 14 of 23 without it.

Without skill61%

With skill74%

Checks it passed that the model alone missed

Prohibits opening standing port 22 ingress for emergency or operational access.
Directs attaching an unconditional explicit-deny inline policy to the compromised IAM role.
Specifies checking for key policy root delegation when troubleshooting KMS denials with IAM policies.

and 1 more in the full report

3 fixed14 passed either way6 still failing0 broke

Pass-rate lift: +13 pp
Tokens: +233%
Agent turns: 0%
Response time: -24%

Model gemini-3.6-flashMeasured 8/6/2026v117 of 23 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/toddkasper-aws-security-specialty/SKILL.md https://app.decimal.ai/s/toddkasper-aws-security-specialty/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add toddkasper-aws-security-specialty, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/toddkasper-aws-security-specialty/ and pins it in .decimal/skills.lock

decimalai skills add toddkasper-aws-security-specialty

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/toddkasper-aws-security-specialty/SKILL.md https://app.decimal.ai/s/toddkasper-aws-security-specialty/SKILL.md

Raw file: /s/toddkasper-aws-security-specialty/SKILL.md ↗ · machine-readable summary at /s/toddkasper-aws-security-specialty.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 3

Prompt

An alert came in indicating that IAM temporary credentials assigned to an EC2 application server were detected making API calls from an external IP address. Provide a structured incident response playbook to contain the compromise, isolate the host, preserve evidence for investigation, and audit the activity window. Format your output with an ordered step-by-step operational guide, specific mitigation actions, and verification steps to confirm access is completely blocked.

What was checked, without and with the skill
Checked	Without skill	With skill
Directs attaching an unconditional explicit-deny inline policy to the compromised IAM role.	Missed	Passed
Directs replacing security groups with a forensic security group allowing SSM endpoint traffic on TCP port 443.	Missed	Passed
Directs taking EBS volume snapshots prior to host remediation or termination.	Passed	Passed

case-01 · gemini-3.6-flash · 8/6/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md389 lines3 files

AWS Certified Security – Specialty (SCS-C03) — Skills Reference

Overview

Operational playbook for AWS security work. Each section states the rule to apply: decision criteria, concrete limits, anti-patterns, and verification steps. Verify against the live account — effective permissions result from combining multiple policy types, and a single missing allow or extra deny changes the outcome. Benchmarked against AWS Security – Specialty (SCS-C03, December 2025).

Load this skill when… designing or reviewing IAM policies, permission boundaries, SCPs, or RCPs; configuring threat detection (GuardDuty, Security Hub CSPM, Detective, Security Lake); implementing KMS encryption strategy or Secrets Manager rotation; auditing network defenses (WAF, Shield, PrivateLink, NACLs) or building IR/containment automation. Not this skill: pipeline/IaC delivery → see aws-devops-engineer-professional; enterprise architecture trade-offs → see aws-solutions-architect-professional.

Study resources, SCS-C02→SCS-C03 changes, and credential logistics: references/study-resources.md.

Verify steps — use your project's MCP/automation, the AWS CLI (aws) or CloudShell, or the Console, in that order.

Uncertainty & Escalation

Always re-verify live — volatile facts: Shield Advanced pricing [volatile — verify live], GuardDuty finding type catalog (new finding families added quarterly) [volatile — verify live], IAM Access Analyzer supported resource types [volatile — verify live], RCP (Resource Control Policy) service coverage (partial list, expanding) [volatile — verify live], and any feature flagged in the blueprint: frontmatter as a recent addition.
Live wins: when the live AWS account, CLI output, or official AWS docs contradict a claim in this file, the live source is authoritative. Log the discrepancy via the Feedback protocol below so the skill can be corrected.
Escalate to a human — do not silently execute: modifying KMS key policies or deleting CMKs; changing SCPs or RCPs; revoking IAM sessions or attaching explicit-deny policies to production roles; quarantining or terminating EC2 instances (even as an IR step); disabling GuardDuty or CloudTrail in any account; opening security-group or network-boundary rules; any Secrets Manager rotation that affects a production database.
Confidence taxonomy: every fact in this file is considered stable unless tagged [volatile — verify live] (changes with AWS service updates) or [opinion — house style] (a defensible default, not the only valid choice).

1. Identity and Access Management (20%)

Policy evaluation order — the evaluation stack

Every authorization decision passes through this stack in order. Explicit Deny at any layer is an immediate, unconditional halt.

Explicit Deny (any policy type) → AccessDenied, full stop.
SCPs — ceiling on what principals in the OU/account may do. SCPs do not grant; they cap.
RCPs (Resource Control Policies) — ceiling on what any principal (including cross-account) may do to resources in the OU/account. Introduced Nov 2024; apply only to supported services (S3, STS, KMS, SQS, Secrets Manager, ECR, OpenSearch Serverless, DynamoDB, and others — partial list, expanding) [volatile — verify live].
Permission Boundaries — ceiling on what an IAM principal's identity policies may grant. Does not cap resource-policy grants made directly to the role.
Session Policies — ceiling applied at AssumeRole / GetFederationToken; caps the session below the role's full permissions.
Resource Policies + Identity Policies — the grant layer:
- Same account: resource policy OR identity policy may grant (either is sufficient).
- Cross-account: resource policy AND identity policy must both grant.

KMS special case: the key policy is the primary access control. Unless it explicitly delegates to IAM ("Principal": {"AWS": "arn:aws:iam::<account>:root"}), IAM policies for kms:Decrypt etc. have no effect. Always verify the key policy first when debugging KMS denials.

Track record

Benchmark

17 / 23

test cases passed, vs 14 / 23 without

Adoption

Users: 5
Times used: 85

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/2/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

toddkasper / expert-skills

aws/skills/aws-security-specialty/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1Bundled 2 files

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

AWS Certified Security – Specialty (SCS-C03) — Skills Reference

Overview

Uncertainty & Escalation

1. Identity and Access Management (20%)

Policy evaluation order — the evaluation stack

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills