For the AWS Certified Solutions Architect – Associate (SAA-C03) — also strong prep for the Developer / SysOps associates and cloud interviews. The exam is scenario-based: almost every question is "given these requirements, pick the best architecture," and the four answers are usually all valid — you choose the one that best fits the stated priority (secure, resilient, fast, or cheap). Two master skills: right service for the requirement and least-privilege networking + IAM. This sheet is organized around the four exam domains, then the service reference, decision patterns, exam-day mindset, and common traps.
0. The exam & the four domains
65 questions · 130 min · multiple-choice / multiple-response · pass ≈ 720/1000 (scaled), compensatory scoring (only the overall score must pass — no per-domain minimum). The domains and their weights are the study plan:
| Domain | Weight | The question it asks |
|---|---|---|
| 1 · Design Secure Architectures | 30% | Least-privilege IAM, network isolation, encryption in transit/at rest. |
| 2 · Design Resilient Architectures | 26% | Multi-AZ, decoupling, backups, the right DR strategy for the RTO/RPO. |
| 3 · Design High-Performing Architectures | 24% | Right compute/storage/DB, caching, scaling, removing bottlenecks. |
| 4 · Design Cost-Optimized Architectures | 20% | Pricing models, storage classes, right-sizing, serverless-when-bursty. |
read the priority word
Every scenario buries the deciding word: "most cost-effective", "highest availability", "least
operational overhead", "most secure". Two answers "work"; the right one optimizes that word.
"Least operational overhead" almost always points at a managed/serverless option.
1. Global infrastructure
| Term | What |
|---|---|
| Region | Geographic area (us-east-1). Choose for latency, price, compliance, service availability. |
| Availability Zone (AZ) | One+ isolated datacenters in a region. Deploy across ≥2 AZs for HA. |
| Edge location | CloudFront/Route 53 PoP, close to users. |
| Local Zone / Outposts | AWS compute closer to a metro / on-prem. |
Design rule: spread across AZs for availability; use multiple regions only for DR or global latency (it's more complex/expensive).
2. IAM
| Thing | What |
|---|---|
| User | A person / long-lived identity. |
| Group | Collection of users; attach policies once. |
| Role | Assumable identity for services / cross-account / federation — temporary creds, no long-lived keys. Prefer this. |
| Policy | JSON: Effect (Allow/Deny), Action, Resource, Condition. |
Evaluation: explicit Deny > Allow > implicit deny. Identity-based +
resource-based policies + SCPs + permission boundaries all apply. sts:AssumeRole gives
temporary credentials.
| Guardrail | What it does |
|---|---|
| SCP (Organizations) | Max permissions for accounts/OUs — a ceiling, grants nothing. The "no one, not even root, can do X" control. |
| Permission boundary | Max permissions an IAM principal can have — caps what an admin can delegate. |
| Resource policy | Attached to the resource (S3 bucket, KMS key, SQS) — enables cross-account access. |
| IAM Identity Center | SSO + short-lived roles for humans (replaces long-lived IAM users). Federate an external IdP here. |
roles over access keys
Give EC2/Lambda/ECS an IAM role (instance profile / task role), never hard-coded access
keys. Keys leak; roles rotate automatically. For humans use IAM Identity Center SSO, not IAM users.
Enforce MFA. Least privilege always.
2b. Securing the architecture (Domain 1 · 30%)
The heaviest domain. Three layers, asked over and over:
- Identity — least-privilege roles, SCPs as the org ceiling, MFA, IAM Access Analyzer to find over-broad/public access.
- Network isolation — private subnets for anything not public-facing, security groups tight, VPC endpoints so traffic to S3/DynamoDB/APIs never leaves AWS, WAF in front of CloudFront/ALB, Shield for DDoS.
- Encryption — at rest with KMS (SSE-KMS on S3/EBS/RDS; customer-managed keys for rotation/audit control), in transit with TLS/ACM certs. Secrets Manager (auto-rotation) or SSM Parameter Store for secrets — never in code/env/AMIs.
| Requirement | Reach for |
|---|---|
| Private access to S3 from a private subnet | S3 gateway VPC endpoint (free) — no NAT/IGW |
| Private access to most other AWS APIs | Interface endpoint (PrivateLink, ENI in your subnet) |
| Rotate DB credentials automatically | Secrets Manager (Parameter Store doesn't rotate) |
| Block SQL-injection / bad IPs at the edge | WAF on CloudFront or ALB |
| Central threat detection across accounts | GuardDuty; findings to Security Hub |
| Your keys, your rotation, your audit trail | KMS customer-managed key (CMK), not the AWS-managed default |
3. Compute
- EC2 — virtual machines. Pricing: on-demand (flexible), reserved/savings plans (commit = discount), spot (cheapest, can be reclaimed — stateless/batch). Graviton (ARM) instances give better price-performance for most workloads.
- Auto Scaling Group (ASG) — maintain/scale EC2 count across AZs; launch templates; scaling policies (target tracking, step).
- Lambda — serverless functions, event-driven, pay per request + duration, 15-min max, scales automatically.
- ECS / EKS / Fargate — containers; Fargate = serverless containers (no nodes to manage).
- Elastic Beanstalk — PaaS that wires EC2+ASG+ELB for you.
4. VPC & networking
| Component | Role |
|---|---|
| VPC | Your isolated private network (a CIDR block) in a region. |
| Subnet | A slice of the VPC in ONE AZ. Public (route to IGW) or private. |
| Internet Gateway (IGW) | VPC ↔ internet for public subnets. |
| NAT Gateway | Private subnets → internet, outbound only (lives in a public subnet). |
| Route table | Decides where subnet traffic goes (0.0.0.0/0 → IGW or NAT). |
| Security Group | Stateful firewall on the ENI/instance. Allow rules only. |
| NACL | Stateless firewall on the subnet. Allow + deny; needs both directions. |
| VPC Endpoint | Private access to AWS services (S3/DynamoDB gateway, or interface) without a NAT/IGW. |
| Peering / Transit Gateway | Connect VPCs (peering = 1:1; TGW = hub). |
SG vs NACL (exam favourite)
Security Group = stateful (return traffic auto-allowed), instance-level, allow-only.
NACL = stateless (must allow ephemeral return ports too), subnet-level, supports deny.
"Works then hangs" often = NACL missing the return range.
5. Storage
| Service | Type / use |
|---|---|
| S3 | Object storage, 11 9s durability. Classes: Standard, IA, One Zone-IA, Glacier/Deep Archive. Versioning, lifecycle, encryption (SSE-S3/KMS), bucket policies. |
| EBS | Block volume attached to ONE EC2 (AZ-bound). gp3/io2 (SSD), st1/sc1 (HDD). Snapshots to S3. |
| EFS | Managed NFS — shared across many instances/AZs (RWX). |
| FSx | Managed Windows/Lustre filesystems. |
| Instance store | Ephemeral local disk — lost on stop/terminate. |
6. Databases
- RDS — managed relational (Postgres/MySQL/MariaDB/Oracle/SQL Server). Multi-AZ = synchronous standby for HA failover (NOT for reads); read replicas = async, scale reads.
- Aurora — AWS cloud-native MySQL/Postgres; faster, auto-scaling storage, up to 15 replicas, Serverless v2.
- DynamoDB — managed serverless NoSQL key-value/document; single-digit-ms; on-demand or provisioned; partition key design matters; DAX cache; Streams.
- ElastiCache — managed Redis/Memcached (in-memory cache/session store).
- Redshift — data warehouse (analytics); Athena — SQL over S3.
7. Messaging & integration
- SQS — managed queue (decouple producers/consumers); standard (at-least-once) vs FIFO (ordered, exactly-once).
- SNS — pub/sub fan-out to many subscribers (incl. SQS, Lambda, HTTP).
- EventBridge — event bus + routing rules (SaaS + AWS events).
- Kinesis — real-time streaming data.
- Step Functions — orchestrate workflows / state machines.
- API Gateway — managed REST/HTTP/WebSocket APIs in front of Lambda/backends.
8. DNS, CDN & LB
- Route 53 — DNS + health-check routing (latency, weighted, failover, geolocation).
- CloudFront — CDN; caches at edge; origin = S3/ALB/custom; integrates WAF.
- ELB — ALB (L7, HTTP, path/host routing), NLB (L4, TCP/UDP, ultra-fast, static IP), GWLB (appliances). Spreads to target groups with health checks.
9. Monitoring, security & cost
- CloudWatch — metrics, logs, alarms, dashboards, Events.
- CloudTrail — API audit log (who did what — and why a call was denied).
- Config — resource config history + compliance rules.
- KMS — managed encryption keys; Secrets Manager / SSM Parameter Store — secrets/config.
- WAF / Shield — web firewall / DDoS; GuardDuty — threat detection.
- Well-Architected pillars: operational excellence, security, reliability, performance, cost, sustainability.
10. Resilient architectures (Domain 2 · 26%)
The reflexes the exam rewards: spread across ≥2 AZs, decouple so one part failing doesn't cascade, and match the DR strategy to the stated RTO/RPO (recovery-time / recovery-point objectives).
- Multi-AZ by default — ASG across AZs, RDS Multi-AZ, ELB spreads traffic, S3/DynamoDB are multi-AZ already.
- Decouple — put SQS between producer and consumer so a slow/failed consumer just backs up the queue instead of dropping work; scale consumers on queue depth.
- Health-based routing — Route 53 failover records + health checks; ALB target health.
- Backups — AWS Backup centralizes EBS/RDS/DynamoDB/EFS backups + retention; enable S3 versioning.
| DR strategy | RTO / RPO | Cost | How |
|---|---|---|---|
| Backup & Restore | hours | lowest | Back up to S3/another region; rebuild on disaster. |
| Pilot Light | tens of min | low | Core (DB replicated) always on but scaled to zero; start the rest on failover. |
| Warm Standby | minutes | medium | A scaled-down full copy always running; scale up on failover. |
| Multi-Site Active/Active | near-zero | highest | Full capacity in 2+ regions serving live; Route 53/Global Accelerator. |
Multi-AZ ≠ DR; multi-Region = DR
Multi-AZ protects against a datacenter/AZ failure (HA within a region). Regional disaster or "must survive
a region outage" needs cross-Region replication (S3 CRR, RDS/Aurora global, DynamoDB global tables)
— pick the DR tier from the RTO/RPO the question states, not the most expensive option by default.
11. High-performing architectures (Domain 3 · 24%)
- Cache to cut latency & load — CloudFront (static/edge), ElastiCache (Redis/Memcached for app/session/DB-query cache), DAX (in front of DynamoDB), read replicas for RDS/Aurora read scaling.
- Scale automatically — ASG target-tracking on CPU/ALB-requests; DynamoDB on-demand or auto-scaling; Aurora Serverless v2 for spiky DB load.
- Right storage for the I/O — gp3 (baseline SSD, tune IOPS/throughput independently), io2 Block Express (high-IOPS databases), st1 (throughput HDD, big sequential), S3 for object/data-lake, FSx for Lustre for HPC.
- Decouple for throughput — SQS/Kinesis absorb spikes; process asynchronously.
- Global reach — Global Accelerator (anycast IPs, TCP/UDP over AWS backbone) vs CloudFront (HTTP caching). S3 Transfer Acceleration for uploads.
12. Cost-optimized architectures (Domain 4 · 20%)
- Compute pricing — On-Demand (flexible, priciest) · Savings Plans / Reserved (commit 1–3 yr for big discount, steady workloads) · Spot (up to ~90% off, interruptible — batch/stateless/fault-tolerant) · Graviton (ARM, better price-performance).
- Serverless when bursty — Lambda/Fargate cost nothing at idle; cheaper than an always-on EC2 for spiky/low-average load.
- S3 storage classes — Standard → Standard-IA (~30d) → Glacier Instant/Flexible → Deep Archive; Intelligent-Tiering when access is unpredictable (auto-moves, no retrieval fee). Lifecycle rules automate transitions.
- Right-size & observe — Compute Optimizer + Cost Explorer; Trusted Advisor flags idle resources; Budgets alert on spend.
- Network cost traps — a NAT Gateway bills hourly + per-GB; a gateway VPC endpoint for S3/DynamoDB is free and cuts NAT traffic. Cross-AZ and egress transfer cost money; keep chatty traffic in one AZ where safe.
cheapest-that-meets-the-requirement
Cost questions still have a hard requirement (durability, availability, latency). Pick the cheapest option
that satisfies it — e.g. don't put data needed in milliseconds into Glacier, and don't answer
"Spot" for a stateful database.
13. Fast "which service?" decision table
| Scenario | Answer |
|---|---|
| Decouple a slow consumer from a producer | SQS between them; scale consumers on queue depth |
| Fan one event out to many subscribers | SNS (often SNS → several SQS) |
| Static website, lowest cost | S3 static hosting + CloudFront |
| Serve S3 to a private subnet, no internet | S3 gateway VPC endpoint |
| Shared filesystem across many Linux instances | EFS (RWX); FSx for Lustre if HPC |
| Sub-ms key-value at any scale | DynamoDB (+ DAX cache) |
| Relational, scale reads | RDS/Aurora read replicas; Multi-AZ for HA |
| Survive a whole-Region outage | Multi-Region: S3 CRR, Aurora/DynamoDB global, Route 53 failover |
| Run containers, no servers to manage | Fargate (ECS/EKS) |
| Cheapest for spiky, short workloads | Lambda |
| SQL directly over data in S3 | Athena |
| Central org-wide permission ceiling | SCP in Organizations |
14. What to keep in mind
- Find the priority word. Secure / resilient / performant / cheapest / least-ops — the answer optimizes that, not everything.
- "Least operational overhead" ⇒ managed/serverless. Fargate over EC2, Aurora Serverless over self-tuned, SQS over self-hosted queues.
- Multi-AZ = HA, Multi-Region = DR. Don't confuse them; pick DR tier from RTO/RPO.
- Roles, not keys; SSO, not IAM users. Any answer embedding access keys is wrong.
- Eliminate two answers fast. Usually two options plainly violate a requirement (public where it must be private, single-AZ where it must be HA). Cut them, then choose between the last two on the priority word.
- Managed HA is built in: S3, DynamoDB, Lambda, SQS, SNS are already multi-AZ — you don't architect their redundancy.
- Encryption is usually a toggle: SSE-KMS on S3/EBS/RDS, TLS via ACM — "encrypt at rest/in transit" rarely needs a custom design.
- Watch the cost traps: NAT Gateway data charges, cross-AZ transfer, and inter-Region egress are common "reduce cost" levers.
15. Common mistakes
- Answering the most-featureful option instead of the one that fits the priority — the exam punishes over-engineering on a cost question and under-provisioning on an availability one.
- Confusing Multi-AZ with a DR/Region strategy — Multi-AZ won't survive a Region outage.
- RDS read replica for HA — replicas scale reads; Multi-AZ is the HA failover (and isn't readable).
- Security Group deny rules — SGs are allow-only + stateful; deny and stateless are NACLs.
- Access keys on EC2/Lambda — use an instance profile / execution role.
- Parameter Store for rotating secrets — it doesn't rotate; Secrets Manager does.
- Putting hot data in Glacier to "save cost" — retrieval latency/fees break the requirement.
- Adding a NAT Gateway to reach S3 — use the free S3 gateway endpoint instead.
- Spot for stateful / user-facing workloads — it can be reclaimed anytime.
- Ignoring the compensatory scoring — you don't need to pass each domain; don't panic over one weak area, maximize the whole.
- Forgetting cross-AZ / egress data-transfer costs when a question asks to reduce spend.
16. Rapid-fire Q&A
- Security Group vs NACL?SG: stateful, instance-level, allow-only. NACL: stateless, subnet-level, allow + deny (must allow return ports).
- Public vs private subnet?Public has a route to an Internet Gateway (+ public IP); private reaches out via a NAT Gateway (outbound only).
- Multi-AZ vs read replica (RDS)?Multi-AZ = synchronous standby for HA failover (not readable). Read replica = async, scales reads (can lag).
- S3 vs EBS vs EFS?S3 = object store (API, 11 9s). EBS = block disk for one EC2 (AZ-bound). EFS = shared NFS across many.
- When Lambda vs EC2 vs Fargate?Lambda = short, event-driven, bursty (no servers). Fargate = containers without nodes. EC2 = long-running / full control / special hardware.
- How should EC2 access S3?Attach an IAM role (instance profile) — never embed access keys.
- Spot vs on-demand vs reserved?Spot = cheapest, can be reclaimed (stateless/batch). On-demand = flexible, pricey. Reserved/Savings = commit for a big discount.
- SQS vs SNS?SQS = queue, one consumer group pulls. SNS = pub/sub fan-out to many subscribers. Often SNS → multiple SQS.
- ALB vs NLB?ALB = L7 (HTTP host/path routing, TLS). NLB = L4 (TCP/UDP, very fast, static IP, extreme scale).
- How does IAM evaluate a request?Explicit Deny wins; else an Allow (identity/resource/SCP/boundary) is needed; default is deny.
- How to get S3 access from a private subnet without internet?An S3 VPC gateway endpoint — no NAT/IGW needed.
- DynamoDB vs RDS?DynamoDB = serverless NoSQL, massive scale, key-based access, design around the partition key. RDS = relational, joins, SQL, vertical-ish scaling + read replicas.
- How do you debug AccessDenied?Read the error (it names action + resource); check CloudTrail for the exact call; simulate the policy; look for an explicit Deny / SCP / boundary.
- RTO 5 min, RPO near-zero, cost matters — which DR?Warm Standby (scaled-down full copy running, scale up on failover). Multi-site active/active gives near-zero RTO but costs the most; backup&restore/pilot light are too slow for 5 min.
- Reduce S3 cost when access is unpredictable?S3 Intelligent-Tiering — auto-moves objects between tiers, no retrieval fee. Lifecycle to IA/Glacier only when access patterns are known.
- SCP vs IAM policy?SCP sets the max permissions (ceiling) for accounts/OUs and grants nothing; an IAM policy grants. A principal can do something only if both an IAM Allow and the SCP permit it.
- Cheapest way to run a fault-tolerant batch job?Spot instances (or Spot in an ASG / on Fargate Spot) — up to ~90% off, and interruptions are fine for retryable batch work.
- Encrypt at rest with your own key rotation and audit?KMS customer-managed key (CMK) with SSE-KMS on S3/EBS/RDS; the AWS-managed default key doesn't give you rotation/policy control.
- Lower latency for a global TCP/UDP app?Global Accelerator (anycast IPs onto the AWS backbone). CloudFront is for cacheable HTTP; Global Accelerator for non-HTTP / whole-app acceleration.
- Rotate database credentials automatically?Secrets Manager (native rotation, integrates with RDS). SSM Parameter Store stores config/secrets but has no built-in rotation.