Design Secure Architectures (30%)
- IAM: least privilege, roles for workloads (never embedded keys), permission boundaries, identity federation / IAM Identity Center for humans.
- Data protection: encryption at rest with KMS (S3, EBS, RDS), encryption in transit with TLS, S3 Block Public Access, bucket policies and VPC endpoint policies.
- Network isolation: private subnets, security groups (stateful, allow-only) vs. network ACLs (stateless, allow + deny), VPC endpoints to reach AWS services without the public internet.
- Edge protection: AWS WAF on CloudFront / ALB / API Gateway, AWS Shield for DDoS, Secrets Manager for credential rotation.
Design Resilient Architectures (26%)
- Multi-AZ for high availability; multi-Region for disaster recovery. Know the four DR strategies: backup and restore, pilot light, warm standby, multi-site active/active — cost and RTO/RPO rise together.
- Decouple with SQS (queue, pull, smooths spikes), SNS (fan-out pub/sub), EventBridge (event routing). A queue in front of workers is the classic "make it resilient" answer.
- Auto Scaling groups across AZs behind an Elastic Load Balancer. Route 53 health checks and failover routing for cross-Region.
- Storage durability: S3 (11 nines, multi-AZ by default), EBS snapshots to S3, RDS automated backups and Multi-AZ standby, Aurora's 6-way replicated storage.
Design High-Performing Architectures (24%)
- Compute choice: EC2 for control, Lambda for event-driven and spiky, Fargate for containers without node management. Right-size and use Auto Scaling.
- Caching: CloudFront at the edge, ElastiCache (Redis/Memcached) for the database tier, DynamoDB Accelerator (DAX) for DynamoDB, RDS read replicas for read-heavy relational load.
- Storage performance: EBS gp3 / io2 for IOPS, instance store for scratch, S3 for throughput and parallelism, FSx for high-performance / Windows / Lustre workloads.
- Data transfer: Direct Connect for consistent throughput to on-premises, S3 Transfer Acceleration and multipart upload for large objects over distance.
Design Cost-Optimized Architectures (20%)
- Compute pricing: On-Demand for short/unpredictable, Savings Plans or Reserved Instances for steady baseline, Spot for fault-tolerant and interruptible, all three combined in one Auto Scaling group.
- Storage cost: S3 storage classes and lifecycle policies (Standard → Standard-IA → Glacier → Deep Archive), S3 Intelligent-Tiering when access patterns are unknown, delete unattached EBS volumes and old snapshots.
- Move data-transfer cost down: keep traffic in one AZ where possible, use VPC endpoints and CloudFront to cut egress, avoid cross-Region chatter.
- Visibility: Cost Explorer, Budgets, Compute Optimizer and Trusted Advisor to find idle and oversized resources.
Test yourself on SAA-C03
Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.
Also free: 15 SAA-C03 sample questions with answers and the SAA-C03 study guide.