AIAI Agent Dev Labaiagentdev-lab.com
Sign in to save progressSign in
Menu

STEP 1 · Study

SAA-C03 StudySolutions Architect – Associate

Read the key points for each exam domain, then use “Practice this domain” to answer questions from that domain only. Domains with a larger weight appear more often on the exam.

01

Design Secure Architectures

30%

Learning goals

  • Choose among IAM users, groups, roles and policies, and use STS for role switching and cross-account access
  • Design multi-account governance with Organizations, SCPs, Control Tower and IAM Identity Center
  • Design traffic paths with public/private subnets, security groups, network ACLs, NAT gateways and VPC endpoints
  • Meet data protection requirements with KMS, ACM, Secrets Manager, S3 encryption and access control, backup and replication

Key points

  • Use IAM Identity Center (or federation with your corporate identity provider) for people, and temporary credentials from IAM roles for applications and services. Keep long-term access keys to a minimum, protect the root user with MFA and do not use it for daily tasks.
  • In IAM policy evaluation an explicit deny always wins, and anything not allowed anywhere is implicitly denied. SCPs and permissions boundaries set the “maximum permissions”; they do not grant permissions by themselves.
  • To access resources in another account, either assume (AssumeRole) a role in the target account, or allow the other party in a resource-based policy such as an S3 bucket policy.
  • Put web servers in public subnets (or make only the ALB public) and the application and database in private subnets. Use a NAT gateway for outbound internet access from private subnets, and a gateway VPC endpoint to reach S3 or DynamoDB without going over the internet.
  • Security groups are stateful and have allow rules only; network ACLs are stateless, support allow and deny rules, and are used to deny specific IPs at the subnet level.
  • Use AWS WAF for SQL injection and cross-site scripting, and AWS Shield for DDoS (Standard is automatic and free; Advanced is paid, enhanced protection). Use GuardDuty for threat detection, Macie to discover sensitive data in S3, and Inspector for vulnerability scanning.
  • For encryption at rest use KMS (key policies control who can use a key; automatic rotation can be enabled); for encryption in transit use TLS with ACM certificates. Rotate database passwords automatically with Secrets Manager.
  • S3 data protection: Block Public Access, bucket policies, versioning, Object Lock (WORM, retention periods) and replication (copies to another Region or account). Centralize backups with AWS Backup.

Workplace uses

  • AccountingAn S3 bucket storing invoice PDFs blocks public access and is encrypted with a KMS key. Object Lock prevents deletion or overwriting during the legal retention period.
  • General AffairsGroup each subsidiary's AWS account under Organizations and use an SCP to block Regions other than Tokyo and Osaka. Employees sign in through IAM Identity Center with their corporate identity.
  • SalesStore the sales support system's DB password in Secrets Manager with automatic rotation. The app retrieves it with an IAM role, so no password is written in code.

Exam objectives (from the exam guide)

  • 1.1 Design secure access to AWS resources.
  • 1.2 Design secure workloads and applications.
  • 1.3 Determine appropriate data security controls.

Learning resources

Learn in detail (3 topics with mini quizzes) →Practice this domain (90 questions) →Next domain ↓
02

Design Resilient Architectures

26%

Learning goals

  • Choose how to decouple processing with SQS, SNS, EventBridge and Step Functions
  • Build horizontally scaling architectures with ALB, Auto Scaling and stateless design
  • Decide when to use containers (ECS, EKS, Fargate) and serverless (Lambda, API Gateway)
  • Choose Multi-AZ, multi-Region, Route 53 failover and DR strategies (backup and restore, pilot light, warm standby, multi-site) from RPO/RTO

Key points

  • Loose coupling: decoupling hand-offs with an SQS queue keeps the sender running even if the receiver falls behind. Use SNS to deliver one message to many destinations (fan-out is SNS → multiple SQS queues), EventBridge to route by event rules, and Step Functions for multi-step flows and retries.
  • SQS standard queues provide at-least-once delivery without ordering guarantees. Use a FIFO queue when you need ordering and deduplication. Messages that keep failing go to a dead-letter queue.
  • Horizontal scaling requires a stateless design that keeps no session data on the server (store sessions in ElastiCache or DynamoDB). ALB routes by HTTP path or host name; NLB is for high-performance TCP/UDP and static IPs.
  • Multi-AZ: spread the ALB and Auto Scaling group across AZs, and use RDS Multi-AZ deployments (automatic failover to a synchronous standby). Read replicas distribute reads and are mainly for performance, not availability.
  • Choose a DR strategy from RPO (how much data loss is acceptable) and RTO (how fast you must recover). From lowest cost: backup and restore → pilot light (data always replicated, minimal compute) → warm standby (scaled-down copy always running) → multi-site (active/active).
  • Use Route 53 failover routing with health checks to switch DNS to the healthy side. Also secure service quotas in the standby environment at production scale.
  • Even legacy apps you cannot change can be made more reliable by placing them behind ELB and Auto Scaling, or pooling connections with RDS Proxy. AWS X-Ray visualizes request flow and latency across distributed apps.

Workplace uses

  • SalesPut orders on SQS before inventory allocation so order intake never stops even if the inventory system lags during peak season. Check failed orders in a dead-letter queue.
  • AccountingDesign DR for the monthly closing system as pilot light from an RPO of 1 hour and RTO of 4 hours, continuously replicating data to the Osaka Region.
  • General AffairsRun the intranet portal on an ALB and an Auto Scaling group across two AZs, so browsing continues even if one AZ fails.

Exam objectives (from the exam guide)

  • 2.1 Design scalable and loosely coupled architectures.
  • 2.2 Design highly available and/or fault-tolerant architectures.

Learning resources

Learn in detail (2 topics with mini quizzes) →Practice this domain (79 questions) →Next domain ↓
03

Design High-Performing Architectures

24%

Learning goals

  • Choose storage that fits requirements from the performance characteristics of S3, EBS (gp3, io2), EFS and FSx
  • Choose compute that fits performance and elasticity from instance families, Auto Scaling, Lambda and containers
  • Meet read/write performance requirements with RDS, Aurora, DynamoDB, ElastiCache, DAX and read replicas
  • Choose CloudFront, Global Accelerator, Direct Connect and VPC designs, and data ingestion and transformation with Kinesis, Firehose, Glue, Athena and others

Key points

  • EBS block storage attaches to EC2 in a single AZ (gp3 is general purpose with IOPS and throughput set independently; io2 is for high-IOPS databases). Use EFS for shared files used by many Linux servers at once, FSx for Windows File Server for Windows file shares, and FSx for Lustre for fast HPC processing.
  • S3 sends large files in parallel with multipart upload, and Transfer Acceleration speeds up uploads from distant locations. S3 supports high request rates per prefix.
  • For read-heavy relational databases, spread reads with read replicas and cache hot data in ElastiCache. Use DAX for microsecond DynamoDB reads.
  • Aurora storage keeps six copies across three AZs and supports up to 15 read replicas. For unpredictable load, Aurora Serverless v2 adjusts capacity automatically.
  • Deliver static and dynamic content to users worldwide with CloudFront (caching at the edge). Use Global Accelerator to carry TCP/UDP traffic over the AWS network to the nearest Region with static anycast IPs.
  • Ingest streaming data with Kinesis Data Streams (multiple consumers can re-read), or Amazon Data Firehose to deliver directly to S3 or Redshift. Use AWS Glue for data transformation (ETL) and the catalog, and Athena to query S3 data directly with SQL.
  • Use a cluster placement group for low-latency communication between HPC nodes, and a spread placement group to spread the impact of failures.

Workplace uses

  • SalesDeliver product catalog images used by sales reps nationwide through CloudFront, reducing load on the head-office servers and speeding up display.
  • AccountingSpread month-end invoice lookups across Aurora read replicas and ElastiCache to keep update processing from slowing down.
  • General AffairsCollect entry/exit logs from each site into S3 with Firehose, and run monthly aggregation in SQL with Athena.

Exam objectives (from the exam guide)

  • 3.1 Determine high-performing and/or scalable storage solutions.
  • 3.2 Design high-performing and elastic compute solutions.
  • 3.3 Determine high-performing database solutions.
  • 3.4 Determine high-performing and/or scalable network architectures.
  • 3.5 Determine high-performing data ingestion and transformation solutions.

Learning resources

Learn in detail (5 topics with mini quizzes) →Practice this domain (72 questions) →Next domain ↓
04

Design Cost-Optimized Architectures

20%

Learning goals

  • Reduce storage costs with S3 storage classes and lifecycle rules, EBS volume types and snapshot management
  • Reduce compute costs by combining On-Demand, Savings Plans, Reserved Instances, Spot and Auto Scaling
  • Choose database types and capacity modes (DynamoDB on-demand/provisioned, Aurora Serverless) from a cost perspective
  • Choose network designs that account for NAT gateway, VPC endpoint, CloudFront, inter-Region and inter-AZ data transfer costs

Key points

  • S3: if you know access frequency, use lifecycle rules to move to Standard-IA or Glacier classes; if the pattern is unpredictable, use Intelligent-Tiering. Glacier Instant Retrieval returns data in milliseconds, Flexible Retrieval in minutes to hours, and Deep Archive is the cheapest with retrieval in up to about 12 hours.
  • Changing EBS from gp2 to gp3 often lowers cost at the same performance. Delete unused volumes and old snapshots.
  • Compute: use Savings Plans or Reserved Instances for steady always-on load, Spot for interruptible batch jobs or variable capacity, and On-Demand for short-term or unpredictable load. Use Auto Scaling to match capacity to demand.
  • Find oversized instances with Compute Optimizer and right-size them. Make costs visible with Cost Explorer, Budgets and cost allocation tags, and alert on budget overruns.
  • DynamoDB: use on-demand for unpredictable or sparse traffic, and provisioned (with auto scaling) for steady, predictable traffic. Stop development RDS instances at night and on weekends, or consider Aurora Serverless v2.
  • When private subnets send heavy traffic to S3 or DynamoDB, use a gateway VPC endpoint (no additional charge) to avoid NAT gateway processing charges.
  • Data transfer: inbound from the internet is generally free; outbound to the internet and inter-Region and inter-AZ traffic are charged. Delivering through CloudFront is often cheaper than serving directly from the origin.

Workplace uses

  • AccountingSet a lifecycle rule that moves accounting records requiring 7-year retention to S3 Glacier Deep Archive after one year, lowering storage costs.
  • General AffairsSchedule development and test EC2 and RDS to stop automatically outside weekday business hours, lowering monthly costs.
  • SalesRun the nightly prospect data aggregation batch on Spot Instances, designed so it can be rerun if interrupted.

Exam objectives (from the exam guide)

  • 4.1 Design cost-optimized storage solutions.
  • 4.2 Design cost-optimized compute solutions.
  • 4.3 Design cost-optimized database solutions.
  • 4.4 Design cost-optimized network architectures.

Learning resources

Learn in detail (4 topics with mini quizzes) →Practice this domain (60 questions) →Try the mock exam →

When you finish reading

Practice all domains (301 questions)Mock exam (65 questions · 130 min)SAA-C03 home
Notes (unofficial, original questions, no pass guarantee)