AWS Cloud Certify · Practice exams
Start a test

Security Specialty

SCS-C03 In-Scope AWS Services: The Complete Official List by Category

Updated October 2026 · 2 min read · Based on official AWS documentation

Quick answer

AWS publishes a non-exhaustive list of in-scope services for SCS-C03, from IAM, KMS and GuardDuty to Network Firewall and Security Lake. Many services are out of scope as a whole, but their security aspects can still appear: you might be asked about an S3 bucket policy, but not about setting up S3 replication.

How to read the list

AWS notes that security affects all services. A service can be missing from the list because the service as a whole is out of scope, yet its security aspects are in scope. The list is non-exhaustive and subject to change, and AWS says the order of items does not reflect their weight on the exam.

In-scope AWS services by category

SCS-C03 in-scope AWS services
CategoryServices and features
AnalyticsAmazon Athena, Amazon OpenSearch Service
Application IntegrationAmazon SNS, AWS Step Functions
ComputeAmazon API Gateway, Amazon EC2 (including EC2 Image Builder and EC2 Instance Connect), Amazon EKS, Amazon EMR, AWS Lambda, Amazon Data Lifecycle Manager
Developer ToolsAWS Fault Injection Service
Internet of ThingsAWS IoT Core
Machine LearningAmazon Bedrock, Amazon CodeGuru Security, Amazon Q Business, Amazon Q Developer, Amazon SageMaker AI
Management and GovernanceAWS CloudFormation, AWS CloudTrail, AWS CloudTrail Lake, Amazon CloudWatch, AWS Config, AWS Control Tower, Amazon Managed Grafana, AWS Organizations, AWS Resilience Hub, AWS RAM, AWS Service Catalog, AWS Systems Manager, AWS Trusted Advisor, AWS User Notifications, AWS Well-Architected Tool
Networking and Content DeliveryAmazon Application Recovery Controller, Amazon VPC (network ACLs, security groups, VPC endpoints, flow logs), Network Access Analyzer, AWS Site-to-Site VPN, AWS Verified Access, AWS Client VPN, Amazon CloudFront, Amazon Verified Permissions, Amazon Route 53 (including Route 53 Resolver DNS Firewall), AWS Direct Connect, Elastic Load Balancing, AWS Transit Gateway
Security, Identity, and ComplianceAWS Artifact, AWS Audit Manager, AWS Certificate Manager, AWS CloudHSM, Amazon Cognito, Amazon Detective, AWS Directory Service, AWS Firewall Manager, Automated Forensics Orchestrator for Amazon EC2, Amazon GuardDuty, IAM, AWS IAM Identity Center, Amazon Inspector, AWS KMS, Amazon Macie, AWS Network Firewall, AWS Private Certificate Authority, AWS Secrets Manager, AWS Security Hub, Amazon Security Lake, AWS Shield, AWS Shield Advanced, AWS STS, AWS WAF
Storage and Data ManagementAmazon S3, AWS Backup, AWS DataSync, Amazon EFS (including EFS Lifecycle policies), Amazon FSx for Lustre

Source: docs.aws.amazon.com/aws-certification/latest/security-specialty-03/scs-02-in-scope-services.html

Out-of-scope services

AWS lists these services as out of scope (the list is non-exhaustive):

Technologies and concepts

Beyond services, AWS lists these technologies and concepts that might appear:

How to use this list to study

  1. Start with the Security, Identity, and Compliance row. Those services appear across several domains. Our study topics cover IAM, KMS, GuardDuty, Macie, Network Firewall, WAF, Shield and Secrets Manager with official sources.
  2. Study the security side of every other service. For S3, that means bucket policies, Object Lock and encryption, not replication setup.
  3. Map services to domains. The exam domains show which tasks name each service.
  4. Compare look-alike services. See GuardDuty vs Inspector vs Macie vs Security Hub and WAF vs Shield vs Network Firewall vs Firewall Manager.

Frequently asked questions

Is Amazon Bedrock on the SCS-C03 exam?

Yes. Amazon Bedrock appears in the Machine Learning category of the in-scope list.

Will I be asked about S3 replication?

AWS gives this example: a candidate would not be asked about the steps to set up replication for an S3 bucket, but might be asked about configuring an S3 bucket policy.

Is the in-scope list complete?

No. AWS states the list is non-exhaustive and subject to change, so check the official exam guide.

Which services are out of scope?

AWS lists Amazon MWAA and AWS Payment Cryptography as examples, and says the list is non-exhaustive.

Sources

AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.

Practice for your AWS exam

Free practice tests with instant explanations and spaced repetition. No sign-up.

Start a practice test Security Specialty hub

Keep reading