Exam Overview
The AWS Solutions Architect Associate (SAA-C03) is the most popular AWS certification, held by hundreds of thousands of professionals worldwide. It validates your ability to design distributed systems on AWS that are resilient, high-performing, secure, and cost-optimized.
Here are the key facts before we get into the content.
| Detail | Value |
|---|---|
| Exam code | SAA-C03 |
| Questions | 65 (scored + unscored mixed) |
| Time limit | 130 minutes |
| Passing score | 720/1000 (~72%) |
| Cost | $150 USD |
| Delivery | Pearson VUE (test center or online proctored) |
| Validity | 3 years |
| Recommended experience | 1+ year designing AWS solutions |
The Four Exam Domains
SAA-C03 is organized into four domains with the following score weightings.
| Domain | Name | Weight |
|---|---|---|
| 1 | Design Secure Architectures | 30% |
| 2 | Design Resilient Architectures | 26% |
| 3 | Design High-Performing Architectures | 24% |
| 4 | Design Cost-Optimized Architectures | 20% |
Domain 1: Design Secure Architectures (30%)
Security is the heaviest-weighted domain, accounting for nearly a third of the exam. You need to go beyond surface-level IAM knowledge and understand how to architect security at every layer.
IAM deep dive: This is the most tested topic across the entire exam. You need to understand the difference between identity-based policies, resource-based policies, permission boundaries, and service control policies (SCPs). Know when to use IAM roles vs. IAM users, how cross-account role assumption works, and what the effect of an explicit Deny vs. no permission is.
VPC security: Security groups (stateful, instance-level) vs. NACLs (stateless, subnet-level) — know the difference and when each applies. Understand VPC endpoints (gateway endpoints for S3/DynamoDB, interface endpoints for other services) and why they improve security by keeping traffic off the public internet.
Encryption: Know which AWS services encrypt data at rest by default, which offer optional encryption, and how KMS keys (AWS-managed vs. customer-managed) work. Understand the difference between server-side encryption options for S3 (SSE-S3, SSE-KMS, SSE-C). Know when to use SSL/TLS for in-transit encryption.
Detective controls: CloudTrail (API audit logging — who did what and when), AWS Config (configuration compliance — are resources configured correctly), GuardDuty (threat detection — is anything suspicious happening), and Security Hub (centralized security findings).
Secrets management: AWS Secrets Manager (automatic secret rotation, application integration) vs. AWS Systems Manager Parameter Store (simpler, cheaper for non-rotating secrets). Know when each is appropriate.
Domain 2: Design Resilient Architectures (26%)
This domain tests your ability to design systems that survive failures — component failures, AZ failures, even regional failures — and continue operating.
High availability patterns: Multi-AZ deployments for RDS, ECS, and Elastic Beanstalk automatically handle AZ failures. Understand how RDS Multi-AZ works (synchronous standby replica, automatic failover, same region) vs. RDS Read Replicas (asynchronous, for read scaling and cross-region DR).
Auto Scaling: Know how EC2 Auto Scaling works with launch templates, scaling policies (target tracking, step scaling, scheduled), health checks, and lifecycle hooks. Understand the difference between horizontal scaling (more instances) and vertical scaling (bigger instances) and why AWS architecture favors horizontal.
Elastic Load Balancing: Three load balancer types and when to use each — Application Load Balancer (HTTP/HTTPS, path and host-based routing, WebSockets), Network Load Balancer (TCP/UDP, ultra-low latency, static IP), and Gateway Load Balancer (third-party network appliances). Know sticky sessions, connection draining, and cross-zone load balancing.
Disaster recovery strategies: The four DR patterns in order of increasing cost and decreasing RTO/RPO — Backup and Restore (cheapest, slowest recovery), Pilot Light (core services running, scale up on disaster), Warm Standby (smaller running version of full environment), and Multi-Site Active/Active (full capacity in multiple regions, fastest recovery, most expensive). Know which pattern fits which RTO/RPO requirement.
Decoupling with queues: SQS (simple queue, one consumer per message, good for decoupling microservices), SNS (pub/sub, one message to many subscribers), and EventBridge (event routing, scheduled rules, SaaS integrations). Know when to use each pattern and how dead-letter queues (DLQ) help with failed message handling.
Domain 3: Design High-Performing Architectures (24%)
This domain tests service selection for performance — choosing the right database, storage, network configuration, and compute option for specific workload requirements.
Compute selection: When to use EC2 vs. Lambda vs. ECS/EKS vs. Fargate. Lambda suits event-driven, short-duration workloads. ECS/Fargate suits containerized applications without the overhead of managing EC2 instances. EC2 suits long-running workloads with specific hardware or OS requirements.
Storage performance: EBS volume types — gp3 (general purpose, configurable IOPS), io2 (provisioned IOPS for databases, highest performance), st1 (throughput-optimized HDD for sequential big data), sc1 (cold HDD, infrequent access). EFS vs. EBS — EFS is shared file storage for multiple EC2 instances, EBS is attached to a single instance. S3 Transfer Acceleration and multipart upload for large file performance.
Database performance: Aurora vs. RDS — Aurora is AWS-optimized, up to 5x faster than MySQL, supports Aurora Serverless for variable workloads. DynamoDB for sub-millisecond NoSQL at any scale. ElastiCache (Redis vs. Memcached) for caching frequently read data. Know the DAX (DynamoDB Accelerator) cache specifically for DynamoDB.
Networking performance: CloudFront for global content caching and edge delivery. Route 53 routing policies — latency-based (route to lowest latency region), geolocation (route based on user location), weighted (split traffic between endpoints), failover (primary/secondary for DR). AWS Global Accelerator for TCP/UDP applications requiring consistent global performance.
Hybrid connectivity: AWS Direct Connect for dedicated, consistent bandwidth to on-premises. VPN over the internet for encrypted but variable-bandwidth connectivity. Know when to use each and how they can be combined.
Domain 4: Design Cost-Optimized Architectures (20%)
Cost optimization questions test whether you can achieve performance requirements at the lowest possible cost, not just which service works.
EC2 pricing models: On-Demand (highest price, no commitment), Reserved Instances (1- or 3-year commitment, up to 72% discount for steady workloads), Spot Instances (up to 90% off, but can be interrupted — suitable for fault-tolerant, stateless, batch workloads), Savings Plans (flexible commitment-based discount, applies to EC2, Lambda, and Fargate). Know which model to recommend for each workload type.
S3 cost optimization: S3 storage class selection based on access frequency and retrieval time — S3 Standard (frequent access), S3 Intelligent-Tiering (unknown or changing access patterns), S3 Standard-IA and S3 One Zone-IA (infrequent access), S3 Glacier Instant Retrieval/Flexible Retrieval/Deep Archive (archive, retrieval time ranges from milliseconds to hours). Know how S3 Lifecycle policies automate transitions between storage classes.
Serverless cost advantages: Lambda charges only for actual compute time (no idle cost), making it more cost-effective than EC2 for variable or unpredictable workloads. DynamoDB On-Demand mode eliminates capacity planning costs for spiky traffic. Fargate charges per vCPU and memory per second with no cluster management overhead.
Cost management tools: AWS Cost Explorer for analyzing spending trends, AWS Budgets for setting alerts before overspend, AWS Trusted Advisor for cost optimization recommendations, and Compute Optimizer for right-sizing EC2 instances. Know what each tool does and when to use it.
Services You Must Know Cold
Based on exam analysis, these services appear in the highest number of questions. Study them in depth.
- IAM — policies, roles, federation, cross-account access, permission boundaries
- VPC — subnets, route tables, internet gateways, NAT gateways, security groups, NACLs, VPC peering, Transit Gateway
- EC2 — instance types, pricing models, Auto Scaling, launch templates, placement groups
- S3 — storage classes, bucket policies, lifecycle rules, versioning, replication, Transfer Acceleration
- RDS / Aurora — Multi-AZ, read replicas, parameter groups, encryption, automated backups
- DynamoDB — partition keys, sort keys, GSI/LSI, on-demand vs. provisioned capacity, DAX
- ELB — ALB vs. NLB, target groups, listener rules, SSL termination
- CloudFront — origins, behaviors, caching, geo-restriction, signed URLs
- Route 53 — routing policies, health checks, DNS failover
- Lambda — triggers, execution role, concurrency limits, deployment packages
- CloudFormation — stacks, templates, change sets, stack sets
- KMS — key types, key policies, encryption contexts, envelope encryption
- CloudTrail / CloudWatch / Config — monitoring, logging, compliance
Question Style and How to Approach Them
SAA-C03 questions are scenario-based. Almost every question describes a business situation or technical requirement and asks which solution BEST meets it. The key word is "best" — usually multiple answers could work, but only one is optimal given all the constraints.
Read the requirements carefully. Questions often include constraints like "minimize operational overhead," "most cost-effective," "highest availability," or "requires single-digit millisecond latency." These constraints eliminate certain answers entirely.
Watch for red flags in wrong answers: anything that increases unnecessary complexity, uses deprecated services, breaks the Well-Architected Framework principles, or ignores a stated constraint.
Common traps include: using EC2 when Lambda is more cost-effective for the described workload, choosing Multi-AZ RDS when a read replica is actually needed, confusing CloudFront with Route 53 for latency-based routing, and using SQS when SNS fan-out is actually required.
Realistic Study Plan
For someone with 1-2 years of AWS experience, 4-6 weeks of focused study at 1-2 hours per day is typically sufficient. For someone newer to AWS, 8-10 weeks is more realistic.
Week 1-2: Cover security and networking fundamentals. IAM, VPC, and security services form the backbone of the exam — time spent here pays off in every domain.
Week 3-4: Study compute, storage, and databases. EC2, S3, RDS, Aurora, DynamoDB, and Lambda. Focus on knowing when to use each service and the tradeoffs between options.
Week 5-6: Study high availability patterns, DR strategies, and cost optimization. Then shift to full practice exams. Take at least three complete 65-question exams under timed conditions. Review every wrong answer until you understand the underlying principle, not just the correct option.
You are ready to book the exam when you consistently score 80%+ on practice exams.