Skip to content

AWS Certified Solutions Architect - Associate (SAA-C03)

Exam Overview

The AWS Certified Solutions Architect - Associate (SAA-C03) exam validates the ability to design and implement distributed systems on AWS. This certification demonstrates proficiency in defining solutions using architectural design principles based on customer requirements and providing implementation guidance based on best practices.

Exam Details: - Exam Code: SAA-C03 - Duration: 130 minutes - Number of Questions: 65 scored questions - Question Types: Multiple choice and multiple response - Passing Score: 720 out of 1000 (approximately 72%) - Cost: $150 USD - Language: Available in English, Japanese, Korean, and Simplified Chinese - Delivery: Pearson VUE testing center or online proctoring - Validity: 3 years - Prerequisites: None (1+ years hands-on AWS experience recommended)

Exam Domains

Domain 1: Design Resilient Architectures (26%)

  • Design multi-tier architecture solutions
  • Design highly available and/or fault-tolerant architectures
  • Design decoupling mechanisms using AWS services
  • Choose appropriate resilient storage

Key Services: - Amazon EC2 (Auto Scaling, placement groups) - Elastic Load Balancing (ALB, NLB, GLB) - Amazon S3 (versioning, replication) - Amazon RDS (Multi-AZ, read replicas) - Amazon EFS (shared file storage) - Amazon SQS/SNS (message queuing and pub/sub) - AWS Step Functions (workflow orchestration)

Domain 2: Design High-Performing Architectures (24%)

  • Identify elastic and scalable compute solutions for a workload
  • Select high-performing and scalable storage solutions for a workload
  • Select high-performing networking solutions for a workload
  • Choose high-performing database solutions for a workload

Key Services: - Amazon EC2 (instance types, purchasing options) - AWS Lambda (serverless compute) - Amazon ECS/EKS (container orchestration) - Amazon S3 (storage classes, Transfer Acceleration) - Amazon EBS (volume types, IOPS) - Amazon CloudFront (content delivery) - Amazon RDS (database engines, Aurora) - Amazon DynamoDB (NoSQL database) - Amazon ElastiCache (Redis, Memcached)

Domain 3: Design Secure Applications and Architectures (30%)

  • Design secure access to AWS resources
  • Design secure application tiers
  • Select appropriate data security options

Key Services: - AWS IAM (users, groups, roles, policies) - Amazon VPC (subnets, security groups, NACLs) - AWS KMS (encryption key management) - AWS Secrets Manager (secret storage and rotation) - AWS Certificate Manager (SSL/TLS certificates) - AWS WAF (web application firewall) - AWS Shield (DDoS protection) - Amazon Cognito (user authentication) - AWS CloudTrail (API auditing) - Amazon GuardDuty (threat detection)

Domain 4: Design Cost-Optimized Architectures (20%)

  • Identify cost-effective storage solutions
  • Identify cost-effective compute and database services
  • Design cost-optimized network architectures

Key Services: - Amazon S3 (storage classes, Intelligent-Tiering, lifecycle policies) - Amazon EBS (gp3 optimization) - Amazon EC2 (Reserved Instances, Savings Plans, Spot Instances) - AWS Lambda (pay per request) - Amazon RDS (Reserved Instances) - Amazon Aurora Serverless (auto-scaling database) - Amazon DynamoDB (On-Demand vs Provisioned) - VPC Endpoints (Gateway and Interface) - AWS Cost Explorer (cost analysis)

Core AWS Services for Solutions Architects

Compute Services

Amazon EC2

  • Instance Types: General purpose, compute optimized, memory optimized, storage optimized
  • Purchasing Options: On-Demand, Reserved Instances, Savings Plans, Spot Instances
  • Placement Groups: Cluster, partition, spread
  • Auto Scaling: Dynamic scaling, scheduled scaling, predictive scaling
  • Features: Elastic IPs, user data, instance metadata, enhanced networking

AWS Lambda

  • Serverless compute for event-driven applications
  • Runtime support for multiple languages
  • Event sources: S3, DynamoDB, API Gateway, SQS, EventBridge, etc.
  • Scaling: Automatic scaling based on invocations
  • Use cases: Real-time file processing, data transformation, API backends

Amazon ECS and EKS

  • ECS: Container orchestration with EC2 or Fargate launch types
  • EKS: Managed Kubernetes service
  • Fargate: Serverless container compute
  • Features: Service discovery, load balancing, auto scaling
  • Use cases: Microservices, batch processing, machine learning

Storage Services

Amazon S3

  • Object storage with 99.999999999% (11 9's) durability
  • Storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier, Glacier Deep Archive
  • Features: Versioning, lifecycle policies, replication (CRR, SRR), event notifications
  • Access control: IAM policies, bucket policies, ACLs, pre-signed URLs
  • Performance: Transfer Acceleration, multipart upload, S3 Select

Amazon EBS

  • Block storage for EC2 instances
  • Volume types: gp3 (general purpose SSD), io2 (provisioned IOPS SSD), st1 (throughput HDD), sc1 (cold HDD)
  • Features: Snapshots, encryption, Multi-Attach (io1/io2)
  • Use cases: Boot volumes, databases, big data analytics

Amazon EFS

  • Managed NFS file system
  • Features: Auto-scaling, lifecycle management, encryption
  • Performance modes: General Purpose, Max I/O
  • Throughput modes: Bursting, Provisioned, Elastic
  • Use cases: Shared file storage, content management, web serving

Database Services

Amazon RDS

  • Managed relational database
  • Engines: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server
  • Features: Multi-AZ deployments, read replicas, automated backups, encryption
  • High availability: Automatic failover with Multi-AZ
  • Scaling: Vertical scaling, read replicas for horizontal read scaling

Amazon Aurora

  • AWS-proprietary database (MySQL and PostgreSQL compatible)
  • Performance: Up to 5x faster than MySQL, 3x faster than PostgreSQL
  • Features: Auto-scaling storage, up to 15 read replicas, Global Database
  • High availability: Multi-AZ by default, cross-region replication
  • Aurora Serverless: Auto-scaling capacity based on demand

Amazon DynamoDB

  • Fully managed NoSQL database
  • Data models: Key-value, document
  • Capacity modes: On-demand, provisioned
  • Features: Global Tables (multi-region), DynamoDB Streams, DAX (in-memory cache)
  • Performance: Single-digit millisecond latency, automatic scaling
  • Use cases: Gaming, IoT, mobile apps, real-time applications

Amazon ElastiCache

  • In-memory caching
  • Engines: Redis (persistence, pub/sub, complex data structures), Memcached (simple caching)
  • Use cases: Session storage, database query caching, real-time analytics
  • Features: Automatic failover, backup and restore, cluster mode

Networking Services

Amazon VPC

  • Virtual private cloud for network isolation
  • Components: Subnets (public/private), route tables, internet gateway, NAT gateway
  • Security: Security groups (stateful), network ACLs (stateless)
  • Connectivity: VPC peering, Transit Gateway, VPN connections, Direct Connect
  • Features: VPC Flow Logs, VPC Endpoints (Gateway, Interface)

Elastic Load Balancing

  • Application Load Balancer (ALB): Layer 7 (HTTP/HTTPS), host/path-based routing, WebSockets
  • Network Load Balancer (NLB): Layer 4 (TCP/UDP), ultra-low latency, static IP
  • Gateway Load Balancer (GLB): Layer 3, third-party virtual appliances
  • Features: Health checks, SSL termination, sticky sessions, cross-zone load balancing

Amazon CloudFront

  • Content Delivery Network (CDN)
  • Features: Edge locations, caching, custom SSL certificates, field-level encryption
  • Origins: S3, ALB, API Gateway, custom HTTP servers
  • Use cases: Static content delivery, dynamic content acceleration, live streaming

Amazon Route 53

  • DNS service with high availability and scalability
  • Routing policies: Simple, weighted, latency-based, failover, geolocation, geoproximity, multivalue
  • Health checks: Endpoint monitoring, CloudWatch alarm-based
  • Features: Domain registration, traffic flow, DNSSEC, private hosted zones

Security and Identity

AWS IAM

  • Identity and Access Management
  • Components: Users, groups, roles, policies
  • Policy types: Identity-based, resource-based, permission boundaries, SCPs
  • Best practices: Least privilege, MFA, password policies, credential rotation
  • Cross-account access: IAM roles, resource-based policies

AWS KMS

  • Key Management Service for encryption
  • Key types: Symmetric (AES-256), asymmetric (RSA, ECC)
  • Key management: Customer managed keys, AWS managed keys, AWS owned keys
  • Features: Automatic key rotation, key policies, grants, envelope encryption
  • Integration: Native encryption for 100+ AWS services

AWS Secrets Manager

  • Secret storage and rotation
  • Secret types: Database credentials, API keys, OAuth tokens
  • Features: Automatic rotation with Lambda, versioning, cross-region replication
  • Integration: RDS, Redshift, DocumentDB automatic rotation

Monitoring and Management

Amazon CloudWatch

  • Monitoring and observability
  • Metrics: Standard metrics (CPU, network), custom metrics, metric math
  • Logs: Log groups, log streams, log insights queries, subscriptions
  • Alarms: Metric alarms, composite alarms, alarm actions
  • Features: Dashboards, Events (EventBridge), ServiceLens, Synthetics

AWS CloudTrail

  • API auditing and logging
  • Features: Event history, trails, log file validation, insights
  • Integration: CloudWatch Logs, S3, EventBridge
  • Use cases: Compliance, forensics, operational troubleshooting

AWS Config

  • Resource inventory and configuration tracking
  • Features: Configuration history, change notifications, compliance rules
  • Managed rules: Pre-built compliance checks
  • Custom rules: Lambda-based custom checks
  • Use cases: Compliance auditing, security analysis, resource tracking

Architecture Best Practices (AWS Well-Architected Framework)

1. Operational Excellence

  • Perform operations as code (CloudFormation, CDK)
  • Make frequent, small, reversible changes
  • Refine operations procedures frequently
  • Anticipate failure and learn from operational failures
  • Use managed services to reduce operational burden

2. Security

  • Implement a strong identity foundation (IAM)
  • Enable traceability (CloudTrail, Config, CloudWatch)
  • Apply security at all layers (VPC, security groups, NACLs, WAF)
  • Automate security best practices
  • Protect data in transit and at rest (KMS, TLS/SSL)
  • Keep people away from data (least privilege)
  • Prepare for security events (GuardDuty, Security Hub)

3. Reliability

  • Automatically recover from failure (Auto Scaling, health checks)
  • Test recovery procedures (chaos engineering)
  • Scale horizontally to increase aggregate system availability
  • Stop guessing capacity (Auto Scaling, serverless)
  • Manage change through automation (CI/CD, IaC)
  • Use Multi-AZ and multi-region deployments

4. Performance Efficiency

  • Democratize advanced technologies (managed services)
  • Go global in minutes (CloudFront, Route 53, Global Accelerator)
  • Use serverless architectures (Lambda, Fargate)
  • Experiment more often (low-cost experimentation)
  • Consider mechanical sympathy (right instance type, storage type)

5. Cost Optimization

  • Implement cloud financial management
  • Adopt a consumption model (pay-as-you-go)
  • Measure overall efficiency (CloudWatch, Cost Explorer)
  • Stop spending money on undifferentiated heavy lifting
  • Analyze and attribute expenditure (cost allocation tags)
  • Use Reserved Instances and Savings Plans for predictable workloads
  • Right-size resources based on actual usage

6. Sustainability

  • Understand your impact (carbon footprint)
  • Establish sustainability goals
  • Maximize utilization (right-sizing, serverless)
  • Anticipate and adopt new, efficient offerings
  • Use managed services to reduce infrastructure footprint
  • Reduce downstream impact (efficient architectures)

Common Architecture Patterns

High Availability Multi-Tier Web Application

  • Web Tier: ALB + EC2 Auto Scaling Group across multiple AZs
  • Application Tier: Application servers in private subnets, NAT Gateway for outbound access
  • Database Tier: RDS Multi-AZ with read replicas
  • Session Storage: ElastiCache for Redis
  • Static Content: S3 + CloudFront
  • DNS: Route 53 with health checks and failover

Serverless Application

  • API Layer: API Gateway
  • Compute: Lambda functions
  • Database: DynamoDB with DAX caching
  • Authentication: Cognito user pools
  • Event Processing: EventBridge, SQS, SNS
  • Monitoring: CloudWatch Logs and X-Ray

Hybrid Cloud Architecture

  • Connectivity: Direct Connect or Site-to-Site VPN
  • Identity: AWS Directory Service, federation with on-premises Active Directory
  • Storage: Storage Gateway (File, Volume, Tape)
  • Database: Database Migration Service (DMS)
  • Monitoring: Unified CloudWatch monitoring

Data Lake and Analytics

  • Ingestion: Kinesis Data Streams/Firehose
  • Storage: S3 (data lake storage)
  • Processing: Lambda, Glue (ETL), EMR (big data)
  • Analytics: Athena (ad-hoc queries), Redshift (data warehouse)
  • Visualization: QuickSight
  • Governance: Lake Formation, Glue Data Catalog

Study Strategy

Week 1-2: Compute and Networking Fundamentals - EC2 instance types, purchasing options, Auto Scaling - VPC design, subnets, route tables, security groups, NACLs - Load balancing (ALB, NLB, GLB) - Hands-on: Build multi-tier VPC with public/private subnets

Week 3-4: Storage and Databases - S3 storage classes, lifecycle policies, replication - EBS volume types, snapshots - RDS vs Aurora vs DynamoDB - ElastiCache (Redis vs Memcached) - Hands-on: Implement highly available database with RDS Multi-AZ

Week 5-6: Security, Identity, and Advanced Topics - IAM policies, roles, cross-account access - KMS encryption, Secrets Manager - CloudFront, Route 53 routing policies - Lambda and serverless architectures - Hands-on: Build serverless API with authentication

Week 7-8: Practice Exams and Review - Take multiple practice exams (aim for 80%+) - Review Well-Architected Framework - Focus on weak areas identified in practice tests - Review common scenarios and patterns

Hands-on Practice Requirements

CRITICAL: Build real architectures on AWS. Theory alone is not sufficient.

Essential Labs: 1. Create VPC with public/private subnets, NAT Gateway, security groups 2. Deploy multi-tier web application with ALB and Auto Scaling 3. Implement RDS Multi-AZ with read replicas 4. Set up S3 static website with CloudFront CDN 5. Build serverless REST API (Lambda + API Gateway + DynamoDB) 6. Configure cross-region S3 replication 7. Implement VPC peering or Transit Gateway 8. Set up CloudWatch alarms and dashboards

Common Exam Scenarios

Scenario 1: High Availability Requirements

  • Question focuses on eliminating single points of failure
  • Solution: Multi-AZ deployments, Auto Scaling, health checks, ALB/NLB
  • Key consideration: RDS Multi-AZ for automatic failover, multiple NAT Gateways

Scenario 2: Disaster Recovery

  • Question about RPO (Recovery Point Objective) and RTO (Recovery Time Objective)
  • Strategies: Backup and restore, pilot light, warm standby, multi-region active-active
  • Services: S3 Cross-Region Replication, Route 53 failover, RDS read replicas

Scenario 3: Cost Optimization

  • Question asks for most cost-effective solution
  • Solutions: Reserved Instances/Savings Plans, Spot Instances, S3 lifecycle policies, serverless
  • Considerations: Right-sizing, auto scaling, S3 Intelligent-Tiering, VPC endpoints

Scenario 4: Security Requirements

  • Question about data protection and access control
  • Solutions: IAM roles, security groups, KMS encryption, private subnets, VPC endpoints
  • Best practices: Least privilege, encryption at rest and in transit, network isolation

Scenario 5: Performance Optimization

  • Question about improving application performance
  • Solutions: CloudFront caching, ElastiCache, RDS read replicas, DynamoDB DAX
  • Considerations: Right instance types, provisioned IOPS, multi-region deployments

Exam Tips

Question Strategy

  1. Read carefully - identify key requirements (HA, cost, performance, security)
  2. Look for keywords:
  3. "Most cost-effective" → Reserved Instances, Spot, serverless, lifecycle policies
  4. "Least operational overhead" → Managed services, serverless
  5. "Highly available" → Multi-AZ, Auto Scaling, load balancing
  6. "Fault tolerant" → Multiple AZs, regions, automatic failover
  7. "Secure" → IAM roles, encryption, private subnets, least privilege
  8. "Best performance" → Caching, read replicas, provisioned IOPS
  9. Apply Well-Architected principles - most answers align with the framework
  10. Eliminate wrong answers - often 2 choices are clearly incorrect
  11. Choose AWS-native solutions - prefer AWS services over third-party when appropriate

Common Pitfalls

  • Confusing security groups (stateful) vs NACLs (stateless)
  • Not understanding S3 storage class use cases
  • Forgetting Multi-AZ ≠ Multi-Region
  • Misunderstanding IAM policy evaluation logic
  • Overlooking VPC endpoints for cost savings
  • Choosing complex solutions when simple ones work
  • Not considering operational overhead differences

Time Management

  • 130 minutes for 65 questions = 2 minutes per question
  • Flag uncertain questions and return later
  • Don't spend more than 3 minutes on any question initially
  • Leave 15-20 minutes for review

Study Resources

Official AWS Resources

  1. AWS Skill Builder - SAA-C03 Exam Prep (FREE)
  2. Stephane Maarek's AWS Solutions Architect Associate (Udemy) - Comprehensive, highly rated
  3. Adrian Cantrill's Solutions Architect Course - Deep technical, excellent for understanding
  4. A Cloud Guru SAA-C03 Path - Good for beginners, clear explanations

Practice Exams

  1. Tutorials Dojo (Jon Bonso) - HIGHLY RECOMMENDED, detailed explanations, very close to real exam
  2. Whizlabs - Good question bank, affordable
  3. AWS Skill Builder Official Practice Exam - $40, closest to real exam format
  4. Neal Davis (Digital Cloud Training) - Good practice tests with explanations

Whitepapers and FAQs

Next Steps After Certification

Career Benefits

  • Average 15-20% salary increase
  • Opens doors to cloud architect, solutions architect, cloud engineer roles
  • Industry-recognized credential
  • Foundation for professional-level certifications

Advanced Certifications

Specialty Certifications

  • AWS Certified Security - Specialty
  • AWS Certified Advanced Networking - Specialty
  • AWS Certified Data Analytics - Specialty
  • AWS Certified Database - Specialty
  • AWS Certified Machine Learning - Specialty

Continuous Learning

  • Stay updated with AWS announcements and new services
  • Participate in AWS re:Invent (annual conference)
  • Join AWS community forums and user groups
  • Build real-world projects
  • Follow AWS Architecture Blog
  • Explore AWS Certified Solutions Architect - Professional

Good luck with your AWS Certified Solutions Architect - Associate certification! 🎉

Remember: This exam tests your ability to architect solutions, not just memorize facts. Focus on understanding why certain architectures are chosen, not just what services to use. Build hands-on experience, study the Well-Architected Framework, and practice with quality practice exams.

You've got this! 🚀