SAA-C03 · CHEAT SHEET

AWS Certified Solutions Architect - Associate

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Design Secure Architectures

30–30%

Design secure access to AWS resources

Use the root user only for tasks that require it: protect it with phishing-resistant MFA and several devices, never create root access keys, and use a group email address. In AWS Organizations you can centralize root access and delete root credentials from member accounts. To require MFA for API calls, use the aws:MultiFactorAuthPresent condition with temporary STS credentials.
Put users in IAM groups (which cannot be nested or used as a Principal) and use reusable managed policies instead of one-to-one inline policies. To scale permissions without editing policies, apply ABAC with tags on principals and resources. To delegate role creation, require a permissions boundary that sets the maximum; workloads on EC2 use roles through instance profiles.
For cross-account access, create a role in the trusting account whose trust policy names the other account or principal, and grant that principal sts:AssumeRole; switching to a role sets aside your own permissions and returns temporary credentials. Require an external ID from third parties that serve many customers to prevent the confused deputy problem, and give each ECS task its own role.
AWS Control Tower builds a multi-account landing zone, provisions accounts with Account Factory and applies controls to whole OUs: preventive (SCPs, RCPs), detective (AWS Config rules) and proactive (CloudFormation hooks). SCPs limit principals in member accounts, including the root user, and RCPs limit access to their resources by external principals; neither grants permissions or affects the management account.
Resource-based policies (S3 bucket, SQS queue, SNS topic, Lambda function, KMS key) state which principals or services can use the resource. Use aws:PrincipalOrgID to grant access to a whole organization and aws:SourceVpce to limit a bucket to one endpoint. Cross-account access needs an Allow on both sides, and a KMS key always needs permission in its key policy.

Design secure workloads and applications

Security groups are the primary control: they are stateful, support only allow rules and can reference other groups. Network ACLs act at the subnet level, are stateless (responses must also be allowed) and support deny rules evaluated by number. A public NAT gateway in a public subnet gives private subnets outbound IPv4 access without allowing inbound connections; for IPv6, use an egress-only internet gateway.
Use separate VPCs to isolate workloads or organizational units, and subnets to separate application tiers. Routing decides the subnet type: public with a route to an internet gateway, private without one, VPN-only, or isolated with no routes outside the VPC. Each subnet lives in one AZ, load balancers reach targets on private IPs, and gateway endpoints give access to S3 without NAT.
AWS WAF filters HTTP(S) requests on CloudFront, ALB or API Gateway, for example against SQL injection; Shield Standard protects at no extra cost against network and transport DDoS, and Shield Advanced adds layer 7 mitigation, a response team and cost protection. Secrets Manager replaces hard-coded credentials and rotates them. Macie finds sensitive data in S3, GuardDuty detects threats and Inspector finds vulnerabilities.
Site-to-Site VPN connects on-premises networks with IPsec tunnels (two per connection; add a second customer gateway for redundancy), and Client VPN gives individual users TLS access. Direct Connect is a dedicated link that bypasses internet providers, with private interfaces to the VPC and public ones to services such as S3, but it does not encrypt by default: use private IP VPN over it or point-to-point MACsec.

Determine appropriate data security controls

AWS Artifact provides AWS compliance reports and lets you accept agreements such as the BAA for a whole organization. AWS Config records configuration history and, with conformance packs, deploys rules and remediation as one unit; CloudTrail records who performed each action and Amazon Macie discovers sensitive data in S3.
EBS encryption by default is a per-Region setting that encrypts new volumes. In S3, SSE-KMS with a customer managed key lets you control the key policy and share across accounts, and an S3 Bucket Key reduces calls to KMS. EFS and RDS are encrypted only at creation: replicate to a new file system or restore from an encrypted snapshot copy.
An ALB HTTPS listener with an ACM certificate terminates TLS on the load balancer; if TLS must be decrypted on the targets, use an NLB with a TCP listener on port 443. In S3, reject unencrypted traffic with aws:SecureTransport, and in CloudFront enforce HTTPS with the viewer and origin protocol policies.
The key policy is the primary control for a KMS key: unless it enables IAM policies, they grant no access. It separates key administrators (manage, cannot encrypt) from key users (cryptographic operations). Cross-account access needs permission in the key policy and in IAM in the other account, and kms:ViaService limits use to a given service.
AWS Backup centralizes backup plans across services and copies backups to other Regions and accounts in the organization; Vault Lock in compliance mode stops anyone, even the root user, from deleting backups. S3 replication requires versioning and copies only new objects unless S3 Batch Replication is used. DynamoDB point-in-time recovery always restores to a new table.

2. Design Resilient Architectures

26–26%

Design scalable and loosely coupled architectures

The SNS-to-SQS fanout pattern delivers a copy of each event to several queues that each consumer processes at its own pace. Step Functions orchestrates microservices with retries, history and approval waits; Standard workflows support long callbacks. An ALB routes by path to one target group per service, and S3 can send events to SQS for Lambda to process.
Horizontal scaling needs stateless tiers: sessions are stored externally, for example in ElastiCache or DynamoDB. Aurora Auto Scaling adds and removes read replicas, not the writer instance. Predictive scaling launches capacity ahead of daily patterns, and SQS consumers should track backlog per instance rather than the raw message count.
SQS decouples components: standard queues deliver at least once and FIFO queues preserve order with exactly-once processing. The visibility timeout stops another consumer from processing an in-flight message, and a dead-letter queue sets failing messages aside. Amazon MQ suits migrating ActiveMQ or RabbitMQ brokers, and Transfer Family provides managed SFTP into S3.
Containers fit when an application should be packaged with its dependencies and scaled as tasks. Amazon ECS on AWS Fargate removes server management; ECS Managed Instances gives access to GPUs or other instance types while AWS manages the infrastructure; Amazon EKS keeps Kubernetes manifests and tooling without refactoring. Shared state across tasks goes on a mounted Amazon EFS file system.
Serverless patterns fit event-driven or irregular workloads: S3 invokes Lambda when objects are created, SQS absorbs spikes and the event source mapping maximum concurrency protects downstream systems, Step Functions orchestrates steps and waits for approvals with task tokens, and DynamoDB on-demand charges no throughput when there is no traffic.

Design highly available and/or fault-tolerant architectures

Infrastructure integrity is automated with infrastructure as code and continuous controls: CloudFormation drift detection finds changes made outside the template, AWS Config remediates noncompliant resources with Automation runbooks, instance refresh replaces instances with a new AMI, and StackSets deploy the same stack across accounts and Regions.
For high availability across zones, use Auto Scaling groups spanning several zones behind a load balancer and RDS Multi-AZ with automatic failover. Across Regions, use Route 53 failover routing with health checks, Aurora global databases for local reads and Regional recovery, and DynamoDB global tables for writes in several Regions.
Metrics should mirror the business requirement: percentiles such as p99 of TargetResponseTime for latency objectives, backlog per instance to scale SQS consumers, CloudWatch Synthetics canaries to check customer journeys without real traffic, X-Ray to find slow downstream calls, and composite alarms to cut alarm noise.
To remove single points of failure, duplicate every critical component: Direct Connect connections across several locations and devices, both tunnels of each VPN plus a second customer gateway device, RDS Proxy to preserve connections during a failover, and replicas with Multi-AZ in ElastiCache for automatic failover.
Durability comes from combining copies and protection: RDS point-in-time restore from automated backups, AWS Backup plans that copy to another Region, AWS Backup Vault Lock in compliance mode for immutable backups, and S3 Versioning with Cross-Region Replication, plus Batch Replication for objects that already existed.

3. Design High-Performing Architectures

24–24%

Determine high-performing and/or scalable storage solutions

Storage performance depends on type and configuration: io2 Block Express gives consistent sub-millisecond latency and the highest EBS durability; FSx for Lustre provides a high-performance POSIX file system linked to S3; EFS with Elastic throughput absorbs unpredictable spikes; and in S3, Transfer Acceleration and multipart upload speed up uploads.
To grow without capacity planning, choose elastic services: Amazon S3 stores any amount of objects and Amazon EFS grows and shrinks on its own. With EBS volumes, Elastic Volumes increases size, type or performance without detaching them, and in hybrid environments S3 File Gateway provides cached on-premises NFS and SMB shares backed by S3.

Design high-performing and elastic compute solutions

Decoupling means producers and consumers do not depend on each other: Amazon SQS keeps messages until a consumer processes and deletes them; SNS fanout to several SQS queues gives each service its own copy; FIFO queues keep order and exactly-once processing per message group; and dead-letter queues set aside messages that fail repeatedly.
A scaling metric must reflect how busy each instance is and change in proportion to capacity: ALBRequestCountPerTarget for requests per instance, backlog per instance for SQS queues, and predictive scaling for cyclical patterns. Detailed monitoring and the default instance warmup make dynamic scaling respond faster and without overshooting.
Choosing compute starts with the workload profile: memory optimized instances for in-memory databases, cluster placement groups for HPC with heavy node-to-node traffic, Amazon ECS on AWS Fargate for containers without managing servers, and AWS Batch with Spot Instances for interruptible batch jobs at the lowest cost.
In Lambda, memory is the main performance lever because CPU is allocated in proportion to it; ephemeral storage sets the /tmp space; provisioned concurrency removes cold starts and reserved concurrency caps concurrency to protect downstream resources. AWS Compute Optimizer recommends sizes for EC2, Auto Scaling, Lambda and other resources from actual utilization.

Determine high-performing database solutions

RDS read replicas receive changes asynchronously, serve reads and can be promoted; they can live in another Region to bring reads closer and improve recovery, but RDS does not scale them automatically. In Aurora, replicas share the cluster volume, are balanced through the reader endpoint, scale with Aurora Auto Scaling and are promoted by priority.
Database design starts from the access pattern: RDS Proxy pools and reuses connections during surges; DMS Schema Conversion and AWS DMS with ongoing replication enable cross-engine migrations with little downtime; DAX gives DynamoDB microsecond reads with minimal changes; and Neptune or ElastiCache cover highly connected data and in-memory access.
Pick the engine by compatibility and features: Babelfish lets Aurora PostgreSQL accept SQL Server clients and T-SQL with few changes, Backtrack (Aurora MySQL only) rewinds the same cluster in minutes, and RDS Custom gives OS access for Oracle or SQL Server. To change engines, convert the schema with DMS Schema Conversion and move the data with AWS DMS, including ongoing replication.
Choose the database type by data model and access pattern: DynamoDB for serverless key-value at any scale (with multi-active global tables across Regions), Neptune for highly connected data, MemoryDB as a durable in-memory primary database, and Aurora Serverless for unpredictable relational workloads. In Aurora Global Database only the primary cluster performs writes.
Lazy loading caches only requested data but can serve stale values; write-through updates the cache on every write, and a TTL makes keys expire. DAX is the API-compatible cache for DynamoDB that gives microsecond reads; ElastiCache with Valkey or Redis OSS offers complex data types and replication, while Memcached offers only simple types.

Determine high-performing and/or scalable network architectures

In multi-tier designs the load balancer sits in public subnets and the servers in private subnets across at least two zones. For hybrid, a Direct Connect gateway carries a private VIF to VPCs in any Region, and a VPN over a public VIF adds IPsec with a more consistent network. For global reach, Global Accelerator gives static anycast IPs for TCP and UDP, and CloudFront caches content at the edge.
To grow without rebuilding the network, associate non-overlapping secondary CIDR blocks (an existing CIDR cannot be resized) and plan ranges with Amazon VPC IPAM. At scale, Transit Gateway, shared with AWS RAM, replaces peering meshes, which are not transitive, and PrivateLink exposes services to many VPCs even when their ranges overlap.
Cluster placement groups give low latency and high throughput within one zone; partition groups separate groups of instances by rack for distributed workloads such as Cassandra, and spread groups isolate a few critical instances. To bring resources closer to users: Local Zones near large cities, Wavelength at the edge of 5G networks, and Outposts on customer premises.
Application Load Balancer works at layer 7 with HTTP and HTTPS: it routes by path or host and can authenticate users with OIDC or Cognito on HTTPS listeners. Network Load Balancer works at layer 4 with TCP, UDP and TLS, handles millions of requests per second and offers static IPs per subnet. Gateway Load Balancer transparently inserts and scales virtual appliances such as firewalls.

Determine high-performing data ingestion and transformation solutions

An S3 data lake is cataloged with AWS Glue crawlers and queried serverlessly with Athena; columnar formats such as Parquet and partitions reduce the data scanned. Lake Formation centralizes fine-grained row, column and cell permissions across Athena, Amazon Quick and other services, and SSE-KMS with a customer managed key lets you control and audit key usage.
Kinesis Data Streams collects real-time data for several consumer applications, and enhanced fan-out gives each one dedicated read throughput. Amazon Data Firehose delivers streaming data to destinations such as S3 without writing consumers and can convert JSON to Parquet. Managed Service for Apache Flink processes streams in real time, and Amazon MSK runs Kafka without code changes, with MSK Serverless removing capacity management.
DataSync migrates NFS, SMB, HDFS or object data over the network to S3, EFS or FSx with encryption and integrity validation. S3 File Gateway offers NFS or SMB shares backed by S3 with a local cache, and Volume Gateway offers iSCSI volumes. Transfer Family provides managed SFTP, FTPS, FTP and AS2 into S3 or EFS, and Transfer Acceleration plus multipart upload speed up large uploads from far away.
Amazon Quick Sight (formerly QuickSight) builds BI dashboards on Athena and other sources; SPICE keeps data in memory so queries are fast and a per-query source is not charged on every view, and row-level security filters data per user. Indexed logs are visualized with OpenSearch Dashboards, included with every domain, and operational metrics with Amazon Managed Grafana.
Amazon EMR runs Spark, Hive and Hadoop on clusters; EMR Serverless does the same without clusters to operate. On EMR on EC2, task nodes hold no HDFS data and are the natural candidates for Spot Instances, and managed scaling resizes the cluster to the workload. AWS Glue offers serverless Spark ETL, Managed Service for Apache Flink handles stateful streams and Lambda fits short tasks.

4. Design Cost-Optimized Architectures

20–20%

Design cost-optimized storage solutions

S3 charges for every request, so batching many small records into fewer large objects (for example with Firehose buffering) makes ingestion cheaper, and small files archived in Glacier should be bundled because of per-object metadata overhead. Large objects are uploaded with multipart upload, and with Requester Pays the downloader pays for requests and data transfer.
Right-sizing storage avoids paying for empty capacity: gp3 provisions IOPS and throughput independently of size, st1 fits frequent sequential I/O and sc1 cold data. Elastic Volumes grows an EBS volume without stopping the instance but cannot shrink it. In FSx for ONTAP, SSD is provisioned for the active data while the capacity pool tier grows automatically.
Data transfer in to S3 from the internet is not charged, while Transfer Acceleration adds charges. From a VPC, a gateway endpoint reaches S3 without NAT and at no additional cost. DataSync copies from NFS, SMB, HDFS or other clouds, can send only changed data, and can write directly into the chosen S3 storage class.
Some storage grows by itself (Aurora cluster volume, Amazon EFS, the FSx for ONTAP capacity pool) and provisioned storage needs scaling. RDS offers storage autoscaling, which never exceeds the maximum storage threshold you set; for FSx for Windows, AWS provides a CloudFormation template that increases capacity when a free-space alarm fires.
S3 Lifecycle rules transition objects to cheaper classes following a waterfall model and expire them at the end of their lifetime, filtered by prefix, tags or size. In versioned buckets, NoncurrentVersionExpiration cleans up old versions, and AbortIncompleteMultipartUpload removes parts of unfinished uploads. Each storage class's minimum storage duration must be considered.

Design cost-optimized compute solutions

The Application Load Balancer works at Layer 7 with HTTP and HTTPS: it routes by path, host, headers or query string and supports Lambda targets, so several applications can share one load balancer. The Network Load Balancer works at Layer 4 (TCP, UDP, TLS) with static or Elastic IP addresses per subnet. The Gateway Load Balancer transparently inserts and scales third-party virtual appliances.
Horizontal scaling with Auto Scaling adds or removes instances without stopping service, while vertical scaling requires stopping the instance to change its type. Policies include target tracking, step, scheduled and predictive, the latter for cyclical patterns. Hibernation saves RAM to EBS and does not bill the instance while it is stopped; warm pools keep pre-initialized instances stopped or hibernated.
Lambda runs event-driven code without servers and is billed per use, ideal for intermittent workloads. Fargate runs ECS containers without managing instances, and Fargate Spot lowers the cost of interruption-tolerant tasks. EC2 gives full control; savings combine Spot (interruptible work), Savings Plans (Compute, flexible across families, Regions, Fargate and Lambda) and reservations.
Production usually needs multiple Availability Zones (spread Auto Scaling groups, RDS Multi-AZ); going multi-Region without need is an anti-pattern. Non-production environments can run in a single zone and be shut down after hours with Instance Scheduler on AWS or Auto Scaling scheduled actions. On-Demand Capacity Reservations guarantee capacity in one zone with no term commitment.
Each EC2 category balances different resources: general purpose (balanced, with burstable instances for low-to-moderate CPU), compute optimized (CPU-bound work such as transcoding or game servers), memory optimized (in-memory databases), storage optimized (high random IOPS on local disks), accelerated computing (GPUs and other accelerators) and HPC.

Design cost-optimized database solutions

RDS and Aurora automated backups allow restores to any point within the retention period, and DynamoDB point-in-time recovery provides continuous backups with nothing to schedule. For long retention, an AWS Backup plan defines frequency and lifecycle, and some resources, such as DynamoDB with advanced features, can move to cheaper cold storage.
Choosing an engine means choosing compatibility and licensing: Aurora is MySQL- and PostgreSQL-compatible and avoids commercial licenses, Babelfish lets SQL Server applications use Aurora PostgreSQL with few changes, and extensions such as PostGIS exist only in PostgreSQL. For SQL Server and Oracle, the license model (included or your own) and the edition, such as Express or Developer for testing, drive much of the cost.
DynamoDB on-demand charges per request and needs no capacity planning, while provisioned mode with reserved capacity lowers the cost of steady, predictable workloads. Aurora Serverless adjusts capacity to demand and can pause at 0 ACUs in idle environments. For relational databases, RDS Proxy pools connections and ElastiCache offloads repeated reads without a larger instance.
Each data type has a purpose-built database: Timestream for time series, Neptune for graphs, Keyspaces for Cassandra workloads and Redshift for analytics. Columnar storage in Redshift, or Parquet and ORC files in S3 queried with Athena, reduces I/O for queries that read a few columns across many rows, while row-oriented storage suits OLTP.
To change engines, DMS Schema Conversion (or AWS SCT) converts schema and code, and AWS DMS migrates the data with a full load and ongoing replication. For like-to-like moves, DMS homogeneous data migrations use native tools serverlessly; from RDS for MySQL to Aurora MySQL an Aurora read replica is recommended, and to change Region, a cross-Region read replica that is later promoted.

Design cost-optimized network architectures

A zonal NAT gateway lives in a single zone: sharing one is cheaper but loses internet access if its zone fails, while one per zone adds resiliency and avoids cross-zone traffic. A regional NAT gateway spreads across zones automatically without public subnets, a private NAT gateway reaches other networks without internet, and for IPv6 the egress-only internet gateway has no charge of its own.
Site-to-Site VPN builds encrypted IPsec tunnels over the internet and is the low-cost option for light traffic or as a Direct Connect backup. Direct Connect uses a private connection that can lower costs and give more consistent performance for heavy traffic, but it is not encrypted by default: combine it with VPN or MACsec. Client VPN gives individual users encrypted remote access.
Transfer between zones in a Region is charged in both directions and transfer between Regions is charged when leaving the source Region, so keep heavy traffic within the same zone and Region. Gateway endpoints for S3 and DynamoDB bypass the NAT gateway at no extra charge, VPC peering is the cheapest option between a few VPCs, and Global Accelerator gives static anycast IPs for TCP and UDP.
CloudFront serves content from the lowest-latency edge location and goes to the origin only on a cache miss, which reduces origin load and data transfer. To raise the cache hit ratio, use a long max-age and a cache key with only the values that change the response; Origin Shield consolidates origin requests, and CloudFront Functions handles lightweight tasks at the edge.
To review a network workload, VPC flow logs show which sources and destinations generate traffic, and Cost Explorer breaks down spend by usage type group, such as inter-AZ or Region-to-Region transfer, and by account. Cost allocation tags and AWS Budgets split and watch spending per team, and Trusted Advisor flags inactive NAT gateways and unassociated Elastic IP addresses.

Practice this certification