AWS labs

A learner clicks launch and gets a real AWS environment of their own, built from the lab template. Not a simulator, not a shared sandbox with a naming convention keeping people apart.

They get console access, temporary credentials for the CLI and SDKs, a terminal in the browser, and addresses for any app or server the lab runs.

The parts that make cloud labs hard to run are the parts we run:

• One learner per environment, so nobody can reach another learner's resources.
• Scoped permissions, so a lab can only do what the lab is about.
• Optional IP restriction, where a lab limits its resources to the address the learner launched from.
• Secure public addresses for labs with a web app, valid for the session only.
• Automatic teardown at the end of a session, including sessions that end badly.
• A monthly launch spending limit for your organization, which pauses launches once reached.

A lab is a Terraform template plus the guide content around it. Labs are authored in the portal, then reviewed by Cybr before they can be launched.

Updates to a published lab are staged. The version currently serving launches keeps serving them until the update is approved, so a change in progress cannot interrupt a live cohort.

AWS labs are what the private beta runs on today, through both the SDK and Hosted Lab Pages.

Azure is next, with the same treatment: vending, isolation, cost caps, and cleanup.