Monitoring, logging, analysis, remediation, and performance optimization
- CloudWatch: metrics and alarms (composite alarms, anomaly detection), Logs Insights queries, cross-account and cross-Region dashboards, and the CloudWatch agent for OS-level metrics and logs on EC2, ECS and EKS.
- CloudTrail records API activity; EventBridge routes events to targets such as Lambda and Systems Manager Automation runbooks for automatic remediation.
- Performance: Compute Optimizer for right-sizing, EBS volume types (gp3 lets you set IOPS and throughput separately), S3 multipart upload and Transfer Acceleration, RDS Performance Insights and RDS Proxy, EC2 placement groups.
- Shared storage: EFS (with lifecycle management to cheaper storage classes) and FSx; DataSync for moving data in and out of AWS.
Reliability and business continuity
- Scaling: Auto Scaling policies (target tracking, step, scheduled, predictive), ECS service auto scaling, Aurora replicas and Aurora Serverless v2, DynamoDB on-demand or auto scaling, caching with CloudFront, ElastiCache and DAX.
- High availability: Multi-AZ for RDS, ElastiCache and FSx; ELB and Route 53 health checks decide which targets and records receive traffic.
- Backup and restore: AWS Backup plans (including cross-Region and cross-account copies), snapshots, point-in-time recovery, S3 and FSx versioning.
- The four DR strategies — backup and restore, pilot light, warm standby, multi-site active/active — trade cost against RTO and RPO.
Deployment, provisioning, and automation
- CloudFormation: change sets, drift detection, StackSets across accounts and Regions, and the AWS CDK (synth, diff, bootstrap) on top of it. Terraform and Git are in scope as third-party tools.
- Images: EC2 Image Builder for AMIs and container images; Amazon ECR lifecycle policies, replication and image scanning.
- Deployment strategies: rolling, blue/green and canary, for EC2 Auto Scaling groups, ECS services (circuit breaker, built-in blue/green) and Lambda.
- Systems Manager (Run Command, State Manager, Patch Manager, Automation) and event-driven automation with EventBridge, S3 Event Notifications and Lambda manage resources that already exist.
Security and compliance
- IAM: roles for workloads (never long-lived keys), permissions boundaries vs. SCPs, Access Analyzer and the policy simulator for troubleshooting access, IAM Identity Center permission sets for multi-account access.
- Compliance: SCPs that restrict Regions and services, AWS Config rules and conformance packs, Trusted Advisor security checks.
- Data protection: KMS keys and key policies, ACM certificates for encryption in transit, Secrets Manager rotation, Macie for data classification.
- Findings: GuardDuty (threats), Inspector (vulnerabilities), Security Hub (consolidated findings and automation rules) and AWS Config.
Networking and content delivery
- VPC: subnets and route tables, security groups vs. network ACLs, NAT and egress-only internet gateways, VPC endpoints and PrivateLink, peering and Transit Gateway, Site-to-Site and Client VPN.
- Network protection: WAF, Shield, Network Firewall and Route 53 Resolver DNS Firewall. Know how to reduce network costs, such as NAT gateway and cross-AZ data transfer.
- Route 53 routing policies, Resolver endpoints and query logging; CloudFront caching and Global Accelerator.
- Troubleshooting: VPC Flow Logs, ELB, WAF and CloudFront logs, Reachability Analyzer, and CloudWatch network monitoring (Internet Monitor, Network Flow Monitor, Network Synthetic Monitor).
Test yourself on SOA-C03
Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then study the rest.
Also free: 15 SOA-C03 sample questions with answers and the SOA-C03 study guide.