Complete guide
SAA-C03 Solutions Architect Associate
Tap any service to see more details and official docs.
Exam breakdown
40–60
Questions
~60
Min read
700
Passing score
Design secure architectures
30% of the examAdvanced IAM and access control
Click any service to see more details
| Mechanism | Scope | Use |
|---|---|---|
| IAM Policies | Specific user/role | Permissions for identities in your account |
| Resource Policies | Specific resource (S3, SQS) | Controlled cross-account or public access |
| SCPs (Service Control) | An entire account or OU in AWS Organizations | Maximum permission limit for the account |
| Permission Boundaries | Specific identity | Maximum limit for what a role can delegate |
Encryption and secrets management
| Service | What it stores | Key feature |
|---|---|---|
| AWS KMS | Encryption keys | Native integration with all AWS services |
| Secrets Manager | Passwords, API keys, tokens | Automatic secret rotation |
| SSM Parameter Store | Configuration, simple secrets | Cheaper, no automatic rotation |
| ACM | SSL/TLS certificates | Free automatic provisioning and renewal |
Network security
Click any service to see more details
| Service | What it protects | Threat type |
|---|---|---|
| Security Groups | EC2, RDS, Lambda instances in a VPC | Stateful: allows automatic response. Allow rules only. |
| NACLs | Entire subnets in the VPC | Stateless: you need inbound AND outbound rules. Allow and Deny. |
| AWS WAF | ALB, CloudFront, API Gateway, AppSync | Web attacks: SQL injection, XSS, rate limiting by IP |
| AWS Shield | All of the AWS infrastructure | DDoS: Shield Standard (free). Shield Advanced ($3,000/month) with SRT |
| Amazon GuardDuty | The entire AWS account (DNS, VPC, CloudTrail) | Threats: compromised instances, suspicious API calls, crypto mining |
SCPs in AWS Organizations do NOT replace IAM Policies — they limit them. If an SCP denies something, no IAM Policy can allow it. They are the highest layer of control.
Design resilient architectures
26% of the examHigh availability with EC2
Click any service to see more details
Resilient databases
Click any service to see more details
Decoupling and queues
Click any service to see more details
Disaster recovery patterns
| Pattern | RTO | RPO | Cost | Description |
|---|---|---|---|---|
| Backup & Restore | Hours | Hours | $ | Restore from backups in S3 in another region |
| Pilot Light | Minutes | Minutes | $$ | Minimal core always running in the DR region |
| Warm Standby | Minutes | Seconds | $$$ | A scaled-down version of the environment running in DR |
| Multi-Site Active | Seconds | Seconds | $$$$ | Both regions active, Route 53 distributes traffic |
For the exam: if they ask for an RTO/RPO of minutes → Warm Standby. If they ask for seconds → Multi-Site Active. If they ask for hours and low cost → Backup & Restore. Always justify the cost.
Design high-performing architectures
24% of the examCompute and scaling
| Service | High-performance scenario |
|---|---|
| EC2 + ASG | Web apps with variable traffic — automatic horizontal scaling |
| AWS Lambda | Millions of short parallel events with no server management |
| ECS / EKS Fargate | Containerized microservices with automatic scaling and no node management |
| EC2 Spot Fleet | Batch and ML workloads needing lots of CPU/GPU at low cost |
Databases and caching
Click any service to see more details
| Cache | Use case |
|---|---|
| ElastiCache Redis | Sessions, leaderboards, pub/sub, complex data structures |
| ElastiCache Memcached | Simple object cache, multi-thread, no persistence |
| DynamoDB DAX | DynamoDB-specific cache, microsecond latency |
| CloudFront | Cache for static and dynamic content at Edge Locations |
Networking and content delivery
Click any service to see more details
For performance questions: static content → CloudFront. Slow database → ElastiCache or a Read Replica. Traffic spikes → Auto Scaling. DB latency → DAX or caching.
Cost optimization
20% of the examPricing model per service
| Service | How to reduce costs |
|---|---|
| EC2 | Reserved/Savings Plans for baseline load. Spot for batch/ML. Rightsizing with Compute Optimizer. |
| S3 | Lifecycle policies → Intelligent-Tiering → IA → Glacier for cooling data. |
| RDS | Reserved Instances for always-on production DBs. Shut down dev/test environments. |
| Lambda | Arm/Graviton processors. Tune memory (more memory can be cheaper due to shorter duration). |
| Data Transfer | Use VPC Endpoints for S3/DynamoDB. CloudFront reduces egress from regions. Same-AZ = free. |
Cost optimization tools
🔍 AWS Compute Optimizer
Recommends the optimal EC2 instance type based on real usage metrics.
💰 Cost Explorer
Analyzes historical spend, forecasts and savings opportunities.
📊 AWS Budgets
Alerts when projected spend exceeds defined thresholds.
🗂️ Cost Allocation Tags
Tags resources by project/team to allocate costs.
Data transfer between AZs in the same region has a cost. Cross-AZ ELB → backend generates inter-AZ traffic. Solution: use an ALB target group with instances in the same AZ as the client.
Tips for exam day
SAA-C03 tests design DECISIONS. Always look for the option that is most secure, most resilient, highest performing, and lowest cost — in that order of priority.
High availability = Multi-AZ + Auto Scaling + ELB. If an AZ fails, traffic keeps flowing automatically.
RDS Multi-AZ = HA (automatic failover). Read Replicas = scale reads. They are NOT the same thing. Multi-AZ does not improve read performance.
SQS to decouple and absorb spikes (pull). SNS for notifications to multiple systems (push). Fan-out = SNS → multiple SQS queues.
VPC Peering is not transitive. For N VPCs use Transit Gateway. Gateway Endpoint for S3/DynamoDB from a VPC at no transfer cost.
Spot Instances for interruption-tolerant workloads (batch, ML training). Reserved for predictable baseline load. On-Demand for spikes.
KMS for key management. Secrets Manager for secrets with automatic rotation. SSM Parameter Store for configuration (cheaper for simple secrets).
CloudWatch Metrics + Alarms → Auto Scaling. CloudTrail for API call auditing. Config for resource configuration compliance.
For multi-region disaster recovery: Route 53 Failover + RDS Cross-Region Read Replica + S3 CRR. Target specific RPO/RTO values.
DynamoDB DAX for microseconds. ElastiCache Redis/Memcached for session and DB result caching. CloudFront for static content.
Want to go deeper?
This guide is a quick summary. Visit the Deep Dive section for an exhaustive walkthrough with real cases, cost analysis and architecture decisions.
Ready to practice?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Was this guide helpful?
Not ready to start yet?
Save your email so you don't have to type it again — pick up later and unlock SAA-C03 with a Pro plan or individual purchase.