Best Cloud Security Labs in 2027: 5 Places to Practice AWS, Azure and Kubernetes

Giving someone administrator access to an AWS account takes seconds. Figuring out whether they actually need it, what they could do with it, and how to fix the permissions safely is a different skill altogether.

That's the difference between knowing cloud security concepts and being able to use them.

The best cloud security labs give you a place to make mistakes, investigate suspicious activity and fix vulnerabilities without putting a real organisation at risk.

Whether you're learning AWS, exploring Microsoft Azure or getting comfortable with Kubernetes, these five platforms offer different ways to build practical cloud security skills.

First, What Do You Want to Get Better At?

Cloud security covers a lot of ground. You could spend weeks learning AWS services and still feel lost when somebody asks you to investigate a suspicious login.

The trick is choosing labs that match the work you want to do.

If you're interested in becoming a SOC analyst, look for exercises involving cloud logs, suspicious activity and incident investigation. If you're leaning towards cloud security engineering, spend more time on permissions, network configurations and secure deployments.

Kubernetes introduces another set of challenges, particularly around container permissions, workload isolation and runtime monitoring. A useful lab should leave you able to explain three things: what was wrong, how you identified it and what you did about it.

With that in mind, here's where to practice.

The 5 Best Cloud Security Labs Compared

The platforms approach learning differently. Some provide guided exercises and ready-made environments, while others give you more freedom to experiment.

Choose based on the task you want to practise, your current experience and how much setup you're comfortable handling.

1. TryHackMe: A Clear Route From Cloud Basics to Real Security Work

Best for: Beginners and intermediate learners who want structured cloud security training.

Cloud security can feel like learning three subjects at once. You need to understand the infrastructure, know what could go wrong and work out how to investigate or fix it.

TryHackMe makes that progression easier by organising cloud security into practical learning paths and focused rooms.

Rather than dropping you into an unfamiliar environment and hoping you'll work things out, the training introduces the concepts and gives you opportunities to apply them.

AWS: Start With the Permissions Nobody Reviewed

The Defending AWS learning path covers five areas: AWS foundations, identity and access management, networking, compute security and storage protection.

The exercises focus on the kinds of mistakes that regularly create security problems.

One room, The Over-Privileged User, introduces an AWS user who has been given far more access than their work requires.

Your job is to examine the permissions, understand the risk and reduce unnecessary access. You'll also use the IAM Policy Simulator to check whether the revised permissions still allow legitimate activity.

It's a useful introduction to least privilege because you get to see the challenge from both sides: protecting the environment while keeping it usable.

Once you're comfortable with IAM, you can move into exposed services, network controls and insecure storage.

Azure: Follow the Evidence Through Sentinel

The Defending Azure path takes a different approach, focusing on the tools security analysts use to detect and investigate activity in Microsoft environments.

You'll work with Microsoft Sentinel, develop queries using Kusto Query Language (KQL), and explore investigations involving Microsoft Defender XDR.

This makes the path particularly relevant if you're aiming for an Azure SOC role or expect to work with Microsoft's security tooling.

The progression takes you from collecting and querying information to recognising suspicious behaviour and investigating alerts.

Kubernetes: Secure What Happens Inside the Cluster

Kubernetes security sits in separate TryHackMe content, including the Kubernetes Hardening module.

You'll explore cluster configuration, security practices and runtime protection, including monitoring suspicious behaviour with Falco.

The module is a useful next step when you understand basic Kubernetes concepts and want to learn how to defend containerised workloads.

2. Pwned Labs: See How Cloud Attacks Actually Unfold

Best for: Learners who want to explore cloud attack techniques and their defensive implications.

Ever wondered what an attacker could do with an exposed AWS credential or a misconfigured Azure identity?

Pwned Labs gives you environments where you can investigate those possibilities.

Its catalogue includes AWS, Azure and Microsoft 365, Kubernetes and other cloud technologies. The scenarios cover techniques such as exploiting exposed resources, abusing identity permissions and investigating suspicious activity.

The appeal is the freedom to explore a particular attack path. For example, you might begin with a scenario involving an exposed AWS database and discover how a seemingly small configuration mistake can give an attacker access to something much more valuable.

Other exercises focus on cloud logging, detection and remediation.

Pwned Labs provides the cloud environments, so you don't need to create your own AWS or Azure account to get started.

There are free labs for beginners and paid scenarios for learners who want to go deeper.

3. AWS Builder Labs: Learn the Cloud From the Inside

Best for: Anyone who wants to become comfortable configuring and using AWS services.

Sometimes the challenge with cloud security is simply knowing where everything lives.

You understand what an IAM policy does, but you haven't spent much time working with one. You know CloudTrail records activity, but navigating the AWS Console still feels unfamiliar.

That's where AWS Builder Labs can be useful. Available through AWS Skill Builder, these guided exercises let you interact with AWS services in temporary lab environments.

You can follow instructions, configure resources and observe how the services behave. The experience leans towards understanding how AWS works, which provides a valuable foundation for identifying security problems later.

For instance, learning how permissions are assigned makes it easier to recognise when an account has excessive access.

Note: AWS currently provides limited Builder Labs access with free accounts, while a subscription unlocks a broader collection.

4. Microsoft Learn: Understand Azure Before Investigating It

Best for: Learners building Azure administration and security foundations.

You spot an unusual role assignment in an Azure environment.

What does that permission allow? Does it apply to one resource or an entire subscription? And where would you look to find out who made the change?

Those questions become easier once you understand how Azure resources and permissions work.

Microsoft Learn offers structured training across Azure services, including identity, networking, resource management and security. It also connects to official product documentation and configuration guidance.

You can use the material to understand how a service should behave before investigating what happens when it is misconfigured.

The Azure Subscription Catch

Microsoft Learn's written lessons are free, but its former free Azure sandboxes are no longer available.

Many practical exercises now require access to an Azure subscription, which may involve usage charges depending on the services you create.

Check the requirements before starting and use a dedicated practice environment where possible.

5. Kubernetes Goat: Break a Cluster to Understand How to Secure One

Best for: Learners with basic Kubernetes experience who want more freedom to experiment.

Kubernetes Goat takes a different approach to cloud security training.

It gives you an intentionally vulnerable Kubernetes environment and lets you explore what happens when workloads, permissions and configurations go wrong.

The open-source project includes scenarios involving excessive role-based access control (RBAC) permissions, exposed services, container escapes and runtime monitoring.

You deploy Kubernetes Goat into a cluster you control, then work through its security exercises.

That freedom is part of the appeal. You can examine how components interact, investigate suspicious behaviour and understand how a weakness affects the broader cluster.

The catch is that you'll need to manage the environment. The setup requires Kubernetes administration access, kubectl and Helm. Some experience with containers and cluster operations will make the exercises considerably easier.

The project also includes older scenarios, some of which have been deprecated, so check the documentation before starting.

Most importantly, keep the environment completely separate from production systems. Kubernetes Goat deliberately contains insecure configurations and vulnerable applications.

Three Cloud Security Exercises Worth Trying First

You don't need to complete an entire learning path before gaining something useful.

Pick one exercise based on the technology you're interested in, work through it and make sure you understand the result.

AWS: Find and Fix an Overly Permissive User

Begin with the The Over-Privileged User room.

Examine which actions the user can perform and decide which permissions are unnecessary. Then make the permitted changes and validate the result using the IAM Policy Simulator.

The interesting part is checking that the user can still perform the work they're supposed to do. When you're ready to investigate the activity behind cloud permissions, explore CloudTrail records.

One detail worth remembering: S3 object operations such as GetObject are data events, which CloudTrail trails don't record by default. You'll need appropriate logging enabled to investigate them.

Azure: Find Out Who Changed Access

Use an Azure RBAC exercise to examine a role assignment.

Identify the account receiving permission, the role assigned and the scope of that permission.

If the exercise allows it, make a controlled change and inspect the resulting activity record.

Then move towards KQL and Sentinel, where you can use queries to investigate activity rather than manually inspect every record.

Kubernetes: Check What an Identity Can Do

In a practice cluster, inspect a role and its associated binding.

Use kubectl auth can-i to check whether your permitted identity can perform a particular action.

For example:

This checks whether your current identity is authorised to retrieve pods in a namespace named lab. Replace it with the namespace used by your exercise.

From there, investigate how permissions affect cluster security and explore the runtime activity visible through auditing and monitoring tools.

The objective is to understand the permission, its scope and the evidence you would use to investigate misuse.

One Thing That Can Ruin a Good Cloud Lab: The Bill

Hosted labs usually take care of infrastructure provisioning, but exercises running in your own cloud account need more attention.

A virtual machine left running, an unnecessary storage resource or an unexpected service configuration can create charges after you've finished practising.

For any lab requiring your own AWS, Azure or Kubernetes infrastructure, use a dedicated practice environment and check the expected costs before creating resources.

Set budget alerts where the provider supports them, and follow the full cleanup process afterwards.

Finished the Lab? Keep the Evidence.

After each exercise, write a few sentences covering the problem, the evidence you found and the decision you made.

For an IAM exercise, that might mean showing which permission was excessive, why it created risk and how you verified the corrected policy.

For a cloud investigation, explain the events that mattered and what they established.

Keep screenshots or notes where the platform permits, and avoid sharing challenge answers, credentials or restricted lab material. Over time, those write-ups can give you practical examples to discuss in an interview or use when approaching an unfamiliar security problem at work.

And if you can repeat the investigation with less guidance the next time, you're making progress.

Your Next Lab Should Give You a Story to Tell

There's a big difference between saying you've studied cloud security and being able to explain how you investigated an exposed storage bucket, corrected a risky permission or identified suspicious activity in cloud logs.

The second comes from doing the work.

You don't have to learn AWS, Azure and Kubernetes at once. Start with the platform that matches your interests, complete a few focused exercises and build from there.

If AWS is your starting point, the Defending AWS path offers a structured way to develop your skills across identity, networking, compute and storage security.

Prefer security operations in Microsoft environments? Defending Azure takes you into the tools used to investigate cloud threats.