How to build a useful (and entertaining) threat emulation exercise for AWS

**Executive summary:** This article provides a step-by-step guide to building and running AWS threat emulation exercises to train SOC analysts, covering goals and scope, building realistic AWS infrastructure and benign user activity, crafting a plausible attack (compromised credentials, EC2 metadata role credential retrieval, Secrets Manager access, RDS data dump and exfiltration), executing the simulation, guiding investigators, and capturing lessons learned to improve detections and playbooks.