AWS Certified Solutions Architect – Professional Cheat Sheet (SAP-C02)
Every in-scope AWS service, architectural pattern, and migration decision the SAP-C02 exam actually tests — organised by the four exam domains, not alphabetically
About This Cheat Sheet
A 13-page professional-tier reference covering every in-scope service from the official SAP-C02 exam guide, organised around the four exam domains: Design Solutions for Organizational Complexity (26%), Design for New Solutions (29%), Continuous Improvement for Existing Solutions (25%), Accelerate Workload Migration and Modernization (20%). Structured for ≥2 years of hands-on AWS architecture experience — sections move from the foundations (Organizations, IAM, multi-account) through networking (VPC, Transit Gateway, PrivateLink, Direct Connect, edge/DNS/LB), compute and elasticity (EC2, Auto Scaling, Batch, Beanstalk, App Runner, Outposts, Wavelength), containers and serverless (ECS/EKS/ECS Anywhere/EKS Anywhere/EKS Distro/Fargate, Lambda, Step Functions, API Gateway, EventBridge, AppSync), application integration, storage (S3, EBS, EFS, FSx, Glacier, Storage Gateway, Backup, Elastic Disaster Recovery), databases (RDS, Aurora, DynamoDB, DocumentDB, Neptune, Keyspaces, ElastiCache, MemoryDB, Timestream), analytics (Athena, EMR, Glue, Lake Formation, Kinesis, MSK, Managed Flink, OpenSearch, QuickSight, Redshift, Data Exchange, AppFlow), HA & DR strategies with Application Recovery Controller, the full migration toolchain (Migration Hub, MGN, DMS/SCT, DataSync, Transfer Family, Snow Family, Proton) with the 7 Rs, monitoring and operations (CloudWatch, CloudTrail, Config, X-Ray, Systems Manager, Compute Optimizer, Managed Grafana, Managed Prometheus, CodeGuru), CI/CD and IaC, cost management, machine learning, IoT, front-end/mobile and end-user computing, media services and blockchain, and the Well-Architected Framework with lenses. Every service on the SAP-C02 in-scope list is audited present.
What's Inside
Organizations & Multi-Account
AWS Organizations with OUs and SCPs, AWS Control Tower landing zone and Account Factory, Resource Access Manager, Service Catalog, IAM Identity Center, License Manager, Service Quotas — the building blocks of enterprise-scale AWS governance.
Identity, Access & Federation
IAM policy evaluation order, permission boundaries, ABAC with resource/principal tags, IAM Access Analyzer with custom policy checks. STS variants (AssumeRole / SAML / WebIdentity / SessionToken). Directory Service (Managed Microsoft AD, AD Connector, Simple AD). Amazon Cognito User Pools vs. Identity Pools.
Encryption, Secrets & Certificates
KMS with multi-Region keys and grants, CloudHSM, envelope encryption. ACM for free public TLS + AWS Private CA for internal trust. Secrets Manager with rotation vs. SSM Parameter Store for config.
Threat Detection & Protection
GuardDuty (including Runtime Monitoring and Malware Protection), Inspector, Macie, Detective, Security Hub, WAF with Managed Rule Groups, Shield Standard vs. Advanced, Network Firewall in a central inspection VPC, Firewall Manager for org-wide policy, Artifact, Audit Manager, Fraud Detector.
Networking — VPC & Hybrid
VPC core (subnets, IGW, egress-only IGW, NAT, security groups, NACLs, route tables, Flow Logs, Reachability Analyzer, Network Access Analyzer, IPAM). Hybrid: Transit Gateway with multiple route tables, VPC peering, PrivateLink, Gateway vs. Interface endpoints, Direct Connect with Direct Connect Gateway, Site-to-Site VPN, Client VPN, Global Accelerator, Route 53 Resolver DNS Firewall.
Edge, DNS & Load Balancing
Route 53 with all eight routing policies, calculated and CloudWatch health checks, Alias records, Private Hosted Zones. Amazon Application Recovery Controller (readiness checks, routing controls, zonal shift). CloudFront with OAC, Lambda@Edge vs. CloudFront Functions, signed URLs/cookies, field-level encryption, real-time logs, origin failover. ALB / NLB / GWLB with sticky sessions, cross-zone tradeoffs, target-group health checks.
Compute, Containers & Serverless
EC2 with instance families, purchasing options (Spot, Reserved, Savings Plans, Dedicated Hosts, Capacity Reservations), Auto Scaling with mixed-instances policies and warm pools. Batch, Beanstalk, App Runner, Lightsail, Outposts, Wavelength. ECS, ECR, ECS Anywhere, EKS, EKS Anywhere, EKS Distro, Fargate. Lambda, Step Functions, API Gateway (REST/HTTP/WebSocket, all authorizers, stage variables, custom domains), EventBridge (rules, Pipes, Scheduler), AppSync for GraphQL.
Application Integration
SQS (Standard/FIFO, visibility timeout, DLQ, long polling, Extended Client), SNS (fan-out, message filtering, FIFO topics), Amazon MQ for legacy AMQP/MQTT/STOMP/JMS, AppFlow for SaaS integration, Amazon SES for transactional/marketing email with VDM, Amazon Pinpoint for multi-channel engagement.
Storage
S3 with all classes, Replication with optional RTC, Object Lock, Storage Lens, Access Points, Block Public Access, Object Ownership. EBS volume types with IOPS/throughput tradeoffs, DLM, Fast Snapshot Restore. EFS, FSx (Windows/Lustre/NetApp ONTAP/OpenZFS), Glacier archive classes, Storage Gateway (S3 File, FSx File, Volume, Tape), AWS Backup with Vault Lock and cross-Region/account copy, Elastic Disaster Recovery for DR.
Database
RDS with Multi-AZ vs. Multi-AZ Cluster vs. Read Replicas, RDS Proxy, Performance Insights. Aurora (including Global Database, Backtrack, Cloning, Aurora Serverless v2). DynamoDB with GSI/LSI, Streams, TTL, Transactions, PITR, DAX, Global Tables, PartiQL. DocumentDB, Neptune, Keyspaces, ElastiCache (Redis/Memcached), MemoryDB (Redis durable), Timestream.
Analytics & Data
Athena (cost-optimised via Parquet + partitioning), EMR (Spark/Hive/Presto/HBase, EMR Serverless, Spot), Glue (serverless ETL + Data Catalog), Lake Formation (row/column/cell permissions, LF-Tags, cross-account sharing), Kinesis Data Streams, Kinesis Video Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, Amazon MSK, OpenSearch Service (with vector k-NN), QuickSight (with Q for NL BI), Redshift (Spectrum, Redshift ML, Serverless, zero-ETL), AWS Data Exchange.
High Availability & Disaster Recovery
Four DR strategies (Backup & Restore, Pilot Light, Warm Standby, Active-Active) with RPO/RTO tradeoffs. Multi-AZ patterns across services. Multi-Region patterns: S3 CRR, DynamoDB Global Tables, Aurora Global Database, Route 53 failover, CloudFront. Application Recovery Controller readiness checks, routing controls, zonal shift, safety rules. Elastic Disaster Recovery (DRS) for continuous replication.
Migration & Modernization
Migration Hub, Application Discovery Service, Application Migration Service (MGN), Database Migration Service (DMS), Schema Conversion Tool (SCT), DataSync, Transfer Family, Snow Family (legacy), AWS Proton for platform engineering. The 7 Rs (Rehost, Replatform, Repurchase, Refactor, Retire, Retain, Relocate).
Monitoring, Observability & Ops
CloudWatch (metric math, composite alarms, anomaly detection, Synthetics, ServiceLens), CloudWatch Logs with subscription filters, CloudTrail + CloudTrail Lake, Config with auto-remediation, X-Ray, Systems Manager (the full suite), Trusted Advisor, Compute Optimizer, Health Dashboard, Amazon Managed Grafana + Managed Service for Prometheus, Amazon CodeGuru (Reviewer and Profiler).
Deployment & Developer Tools
IaC: CloudFormation (templates, change sets, drift detection, StackSets, helper scripts, CreationPolicy/UpdatePolicy/DeletionPolicy), CDK, Service Catalog. CI/CD: CodeBuild, CodeDeploy (blue/green, canary, linear), CodePipeline, CodeArtifact.
Cost Management
Cost Explorer, Budgets with actions, CUR + Athena/QuickSight for chargeback, Savings Plans (Compute vs. EC2 Instance), Compute Optimizer, License Manager, cost allocation tags.
ML, IoT, Media & End-User Computing
SageMaker AI full suite, AI Services (Comprehend, Rekognition, Textract, Transcribe, Translate, Polly, Lex, Kendra, Personalize, Fraud Detector). IoT Core, Greengrass, Device Management, Device Defender, Events, SiteWise, 1-Click, Things Graph. Elastic Transcoder, Kinesis Video Streams, Managed Blockchain. Amplify, Device Farm, AppSync, WorkSpaces, AppStream 2.0.
Well-Architected Framework & Lenses
The six pillars (Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability) and the AWS Well-Architected Tool with workload-specific lenses (ML, Generative AI, Serverless, Financial Services, IoT, SAP, Games).
Why This Cheat Sheet Helps
The SAP-C02 exam asks you to compare entire architectures — each question has long scenarios and each wrong answer is plausible. The winning skill is pattern recognition: 'hybrid DNS' → Route 53 Resolver; 'cross-account logs' → Organizations + centralised CloudTrail; 'legacy Oracle to Aurora' → SCT + DMS; 'no downtime, multi-Region' → Aurora Global Database + Route 53 / ARC. This cheat sheet puts those patterns side by side with the precise AWS vocabulary examiners use.
It assumes real-world experience — you already know how a VPC works. Use it to ensure every in-scope service is on your mental map and to reinforce the architectural decision rules the test actually measures.
How to Use It
Skim the whole sheet once to map the exam's surface area. Then hammer practice exams and, for each wrong answer, find the relevant section and study the tables side by side. Pay extra attention to the Exam Tip boxes — they encode the most frequently-tested decision rules.
In the final week, walk through the four domain percentages against your confidence in each section: Organizational Complexity (26%) → sections 2–5; New Solutions (29%) → sections 6–15; Continuous Improvement (25%) → sections 17–19, 24; Migration (20%) → section 16.
Frequently Asked Questions
Is this AWS Solutions Architect Professional cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the SAP-C02 exam.
How much AWS experience do I need before SAP-C02?
AWS recommends two or more years of hands-on experience designing and deploying workloads on AWS. The exam is architecture-heavy: you are expected to compare entire solutions, not just individual services. If you do not already hold the Solutions Architect Associate or equivalent experience, start there first.
How is SAP-C02 different from SAA-C03?
SAA-C03 tests the service you would choose for a use case. SAP-C02 tests the architecture you would choose — multi-account governance, hybrid networking, DR strategies, migration patterns, and how to refactor an existing workload toward cost efficiency or reliability. Questions are longer, answers more subtly different, and the time per question is generous so you can work through the scenario.
Is this cheat sheet updated for the current SAP-C02 exam?
Yes, it is built directly from the current SAP-C02 exam guide (solutions-architect-professional-02) and audited against the full in-scope services list. It also reflects current services — Amazon Application Recovery Controller, AWS Network Firewall, AWS Proton, the CloudOps rebrand of SysOps, and recent deprecations (Snow Family, legacy AWS Support plans).