AWS SAA-C03

AWS Solutions Architect SAA-C03: Complete Study Notes

This handbook is a complete, self-contained SAA-C03 preparation resource designed for learners who want to understand architecture decisions deeply enough to pass scenario-heavy exam questions. It explains how AWS services work together, when each choice is appropriate, what trade-offs matter, and which exam traps repeatedly mislead candidates.

SAA-C03 Architecture Scenario Mastery Service Comparisons Exam Alerts

Tutorials Logic Editorial Team 13 min read Published Jun 5, 2026 Reviewed Jul 21, 2026

SAA-C03 Exam Orientation

SAA-C03 is not a memorization exam about isolated AWS service definitions. It is an architecture judgment exam. Questions present requirements involving security, reliability, cost, performance, and operational efficiency, and ask you to choose the best design or service combination.

What you need: service-purpose knowledge, architecture pattern recognition, trade-off reasoning, and the ability to eliminate plausible but inferior options.
What makes it difficult: multiple answers may technically work, but only one best satisfies the stated priorities.
How to read questions: identify the primary constraint first. Common primary constraints include lowest operational overhead, highest availability, lowest latency, strict data durability, private connectivity, and cost optimization.

Current exam format

SAA-C03 Exam Orientation reference table
Item	SAA-C03 detail
Duration and format	130 minutes; 65 multiple-choice or multiple-response questions.
Scoring	50 questions are scored and 15 are unscored. Results use a 100–1,000 scale; the minimum passing score is 720.
Domain 1	Design Secure Architectures — 30% of scored content.
Domain 2	Design Resilient Architectures — 26% of scored content.
Domain 3	Design High-Performing Architectures — 24% of scored content.
Domain 4	Design Cost-Optimized Architectures — 20% of scored content.

Study from the official SAA-C03 exam guide and confirm scheduling details on the official certification page. AWS periodically revises exam guides, so recheck the scope before booking.

Winning rule: for SAA-C03, always read for architectural intent. The exam often hides the real clue inside phrases like minimize management, near real time, shared storage, cross-Region resiliency, or private access without internet exposure.

Architecture Principles and the Well-Architected Lens

The Solutions Architect exam expects you to think like a designer rather than a service catalog reader. A strong answer usually aligns with the AWS Well-Architected pillars, even when the question does not mention them directly.

Architecture Principles and the Well-Architected Lens reference table
Pillar	What it means in design questions	Typical exam signals
Operational Excellence	Automate, observe, and improve systems.	Monitoring, automation, Infrastructure as Code, managed operations.
Security	Protect data, systems, and identities.	Encryption, IAM, least privilege, network isolation, auditability.
Reliability	Recover and adapt during failures.	Multi-AZ, backups, failover, decoupling, DR plans.
Performance Efficiency	Choose the right resource types and scale methods.	Caching, instance families, DynamoDB, CloudFront, Auto Scaling.
Cost Optimization	Avoid unnecessary spend while meeting requirements.	Right-sizing, serverless, lifecycle policies, Savings Plans.
Sustainability	Use resources efficiently.	Often indirectly reflected in efficient managed designs.

How architecture questions are solved

Start with the business requirement.
Identify constraints: uptime, performance, compliance, budget, existing technology, or geographic scope.
Select the storage, compute, database, and network model that best fit those constraints.
Prefer managed services when the question emphasizes reducing maintenance.
Avoid complexity that the requirement does not justify.

Compute Patterns: EC2, Auto Scaling, Lambda, Containers, and Beyond

Compute choices define how applications run and how much operational work your team performs. SAA-C03 questions often hinge on knowing which compute model best fits an application pattern.

Amazon EC2

Use when you need full server control, custom OS settings, specialized software, or persistent long-running processes.
Important related concepts: instance families, AMIs, security groups, EBS, Auto Scaling, load balancing, placement, and purchasing models.
Exam clue: if the workload requires deep host-level customization, EC2 is often appropriate.

Auto Scaling and Elastic Load Balancing

Auto Scaling: adjusts instance count according to policy or demand.
Application Load Balancer: Layer 7 routing for HTTP/HTTPS with host/path-based decisions.
Network Load Balancer: Layer 4, very high throughput, low latency, TCP/UDP/TLS patterns.
Gateway Load Balancer: inserts virtual network appliances into traffic flows.

Lambda

Ideal for event-driven, highly variable, or short-duration tasks with minimal infrastructure management.
Often paired with S3, API Gateway, EventBridge, DynamoDB streams, or SQS.
Exam clue: choose Lambda when the question stresses serverless, event triggers, rapid scaling, or minimal administration.

ECS vs EKS

Compute Patterns: EC2, Auto Scaling, Lambda, Containers, and Beyond reference table
Service	Best for	Trade-off
ECS	AWS-native container orchestration with simpler operations.	Less Kubernetes portability, lower complexity.
EKS	Kubernetes-managed control plane for organizations needing Kubernetes ecosystem compatibility.	More operational complexity.

Storage Deep Dive: S3, EBS, EFS, FSx, Backup, and Data Protection

Storage questions are central to SAA-C03 because architecture decisions often depend on access model, durability, performance, sharing needs, and cost.

Amazon S3

S3 is object storage designed for massive scale, high durability, and broad integration across AWS. Architects must know far more than just "file storage."

Objects and buckets: data is stored as objects inside buckets, identified by keys.
Storage classes: choose based on access frequency, retrieval urgency, and cost profile.
Versioning: protects against accidental overwrite or delete.
Lifecycle rules: automate transitions and expiration for cost control.
Replication: supports same-Region or cross-Region duplication for resilience or compliance.
Encryption: supports server-side and customer-managed models.
Access control: IAM, bucket policies, access points, and block public access settings matter.
Events: S3 can trigger downstream processing such as Lambda.
Static website hosting: useful for static public content, though CloudFront often complements it.

EBS

Block storage for EC2.
Good for boot volumes, transactional workloads, and workloads needing low-latency attached disk.
Snapshots are stored in S3 under the hood and are important for backup strategy.

EFS

Managed elastic NFS file system for Linux workloads.
Use when multiple instances need concurrent shared file access.

Database Selection: RDS, Aurora, DynamoDB, ElastiCache, and Analytics Stores

Architects are expected to choose the right data service based on consistency model, relational needs, scale pattern, latency, and operational requirements.

RDS and Aurora

RDS: managed relational databases with backups, maintenance simplification, Multi-AZ options, and read replicas.
Aurora: AWS-built relational engine compatible with MySQL or PostgreSQL, designed for higher performance and cloud-native resilience patterns.
Multi-AZ: improves availability and failover, not read scaling.
Read replicas: improve read scalability and can support some disaster recovery patterns.

DynamoDB

Fully managed NoSQL service for key-value and document data.
Best when access patterns are known and low-latency scale is critical.
Related exam ideas: partition keys, global tables awareness, on-demand capacity, DynamoDB Accelerator awareness, and event-driven integration.

ElastiCache

Use for caching hot data, session state, or frequently read items to reduce latency and backend load.

Redshift

Data warehouse for analytical queries rather than OLTP application transactions.

Networking and VPC Architecture

Networking is one of the most heavily tested SAA-C03 areas. You must understand not just what a VPC is, but how subnets, route tables, gateways, endpoints, and security boundaries work together.

VPC fundamentals

VPC: logically isolated virtual network.
Subnet: network segment inside a VPC, usually public or private by routing design.
Route table: defines where subnet traffic goes.
Internet Gateway: enables internet connectivity for public-facing resources.
NAT Gateway: allows private subnet resources to initiate outbound internet access without becoming publicly reachable.
Security Group: stateful instance or ENI-level firewall.
Network ACL: stateless subnet-level filter.

NAT Gateway vs Internet Gateway

Internet Gateway: used by public resources needing inbound and outbound internet access.
NAT Gateway: used by private resources needing outbound access only.
Exam decision point: if a private subnet instance must download updates but remain non-public, choose NAT Gateway, not Internet Gateway.

VPC endpoints

VPC endpoints provide private connectivity from a VPC to supported AWS services without traversing the public internet path. This is a frequent exam answer when questions ask for private service access, improved security posture, or reduced internet exposure.

Messaging, Integration, and Event-Driven Design

Modern architectures often reduce tight coupling by introducing queues, topics, buses, and workflow services. SAA-C03 expects you to know when direct synchronous calls should be replaced by asynchronous patterns.

SQS vs SNS vs EventBridge

Messaging, Integration, and Event-Driven Design reference table
Service	Primary pattern	Use when
SQS	Queue / buffering	Producers and consumers must be decoupled and work processed reliably.
SNS	Pub/sub fan-out	One message must notify multiple subscribers.
EventBridge	Event bus and routing	Events must be matched to targets using rules or SaaS/AWS integration patterns.

Step Functions

Used to orchestrate workflows, retries, branches, and service integrations in a managed way.

Exam Scenario

An ordering system must accept requests quickly even when downstream processing is slow. Best fit: SQS between producer and worker services. Why: the queue buffers load and decouples systems. Why not SNS alone: SNS distributes notifications but does not itself serve as the same durable processing buffer pattern.

Security Architecture Decisions

Security in SAA-C03 is about layered design, not one isolated service. The best answers usually combine identity controls, encryption, network restrictions, logging, and managed detection.

IAM: least privilege, roles, cross-account access, temporary credentials.
KMS: centralized key control for encryption choices.
Secrets Manager: managed secret storage and rotation.
WAF and Shield: web-layer filtering and DDoS protection.
CloudTrail: audit trail.
GuardDuty: threat detection from AWS activity signals.
Config: configuration history and compliance evaluation.

IAM User vs IAM Role

User: named principal, often long-term credential-oriented.
Role: temporary assumable identity and usually the better design for workloads or cross-account access.

Reliability, Backup, and Disaster Recovery

Architects must balance availability, durability, RTO, RPO, and cost. SAA-C03 frequently tests whether you can identify the lightest design that still meets recovery objectives.

Reliability, Backup, and Disaster Recovery reference table
Pattern	Meaning	Trade-off
Backup and restore	Recover from stored backups.	Lowest cost, slowest recovery.
Pilot light	Critical core services stay ready in another Region.	Moderate cost, faster than restore-only.
Warm standby	Smaller running version of environment remains active.	Higher cost, faster recovery.
Active-active	Multiple Regions actively serve traffic.	Highest complexity and cost, strongest recovery posture.

RTO: acceptable time to restore service.
RPO: acceptable amount of data loss measured in time.
Multi-AZ: protects against AZ-level failure inside a Region.
Multi-Region: addresses Region-level disaster scenarios.

Performance Efficiency and Cost Optimization

The exam often combines performance and cost because architects are expected to meet requirements efficiently rather than by brute force.

CloudFront: lowers latency for distributed users and reduces origin load.
ElastiCache: improves repeated-read performance.
Read replicas: scale relational reads.
DynamoDB: low-latency access at scale when the data model fits.
Auto Scaling: avoids paying for constant peak capacity.
S3 lifecycle policies: reduce storage cost for aging objects.
Spot Instances: reduce cost for interruption-tolerant workloads.
Savings Plans: reduce compute cost for predictable usage patterns.

CloudFront vs Global Accelerator

CloudFront: content delivery and caching for HTTP/S and static/dynamic acceleration patterns.
Global Accelerator: improves routing to application endpoints using the AWS global network, without acting as a content cache in the same way.
Exam decision point: if the main issue is content caching and global edge delivery, choose CloudFront; if the issue is improving pathing to application endpoints across Regions, Global Accelerator may be the better fit.

Scenario-Based Architecture Drills

Scenario 1: Public web application with unpredictable traffic

Best fit: Application Load Balancer, Auto Scaling EC2 or serverless pattern depending workload shape, deployed across multiple AZs. Why: this supports elasticity and availability. Wrong alternatives: one large instance in one AZ fails high-availability goals.

Scenario 2: Private EC2 instances must access S3 without traversing the public internet

Best fit: VPC endpoint for S3. Why: private connectivity without public internet path. Wrong alternatives: NAT Gateway allows outbound internet access but does not provide the same private service access model.

Scenario 3: Relational production database requires high availability but not read scaling

Best fit: RDS Multi-AZ. Why: designed for failover and resilience. Wrong alternatives: read replicas primarily help scale reads, not provide the same failover model.

Scenario 4: Many microservices need to react independently when an order is created

Best fit: SNS or EventBridge depending routing pattern. Why: pub/sub or event routing supports fan-out. Wrong alternatives: SQS alone is queue-based buffering, not the cleanest fan-out answer.

Scenario 5: Static assets must load quickly worldwide with minimal origin load

Best fit: S3 plus CloudFront. Why: durable origin plus edge caching. Wrong alternatives: EBS and EFS do not match global content distribution needs.

Scenario 6: Workload in one account needs temporary access to another account

Best fit: a cross-account IAM role with a trust policy and least-privilege permissions. Why: role assumption supplies temporary credentials. Wrong alternatives: creating and sharing long-lived IAM user access keys increases credential risk.

Scenario 7: Unpredictable key-value traffic needs single-digit millisecond performance

Best fit: DynamoDB with on-demand capacity when the access pattern fits. Why: it removes server and capacity planning for variable NoSQL demand. Wrong alternatives: selecting a relational database solely because it is familiar ignores the stated data model and scaling requirement.

Scenario 8: One order event feeds independent consumers with separate retries

Best fit: publish to SNS and subscribe a separate SQS queue for each consumer. Why: SNS provides fan-out while each queue buffers work and isolates failures. Wrong alternatives: one shared queue distributes messages among consumers instead of giving every consumer its own copy.

Scenario 9: Regional recovery must be much faster than backup-and-restore allows

Best fit: choose pilot light, warm standby, or active-active according to the stated RTO, RPO, and budget. Decision: warm standby keeps a scaled-down environment running and is usually faster to recover than pilot light, while active-active offers the fastest recovery at the highest cost and complexity.

Scenario Decision Checklist

Extract hard requirements: data model, protocol, latency, throughput, availability scope, RTO, RPO, compliance, and budget.
Circle qualifiers: phrases such as least operational effort, most cost-effective, without public internet, and must preserve order decide between otherwise valid designs.
Choose the service category first: object/block/file storage, relational/NoSQL/cache database, queue/topic/event bus, or VM/container/serverless compute.
Check failure boundaries: one instance, one AZ, one Region, or one account. Add only the resilience the question requires.
Eliminate hidden contradictions: a NAT Gateway is not private service connectivity, a read replica is not the standard Multi-AZ failover answer, and encryption does not replace access control.
Compare operations and cost last: among designs that meet every hard requirement, prefer the option matching the stated management and cost priority.

Scenario Decision Checklist reference table
Question signal	Shortlist	Confirm before choosing
Shared POSIX files across Linux instances	Amazon EFS	Not object or single-instance block storage.
Private S3/DynamoDB access	Gateway VPC endpoint	Endpoint policies and route tables meet the access requirement.
Read-heavy relational workload	Read replicas or cache	Question asks for read scale, not synchronous failover.
Bursty asynchronous processing	SQS plus scalable workers	Visibility timeout, retries, idempotency, and dead-letter handling.
Global cached web content	CloudFront	Origin, cache behavior, and private-origin controls satisfy security.

Common Exam Traps

Most secure is not always the right answer if the question asks for lowest operational overhead and another managed secure option exists.
Most scalable is not always correct if the workload is relational and needs SQL semantics.
Multi-AZ and read replica are different features with different goals.
Private subnet does not mean no outbound access; NAT Gateway is often involved.
CloudWatch versus CloudTrail remains an architect-level trap too.
Advanced-looking answer choices are frequently distractors when a simpler managed design satisfies the requirement.

Quick Revision, Remember This, and Exam Alert

Quick Revision

Design for failure using multiple AZs and decoupled components.
Choose storage by access model: object, block, or shared file.
Use Multi-AZ for availability, read replicas for read scaling.
Use NAT Gateway for outbound internet from private subnets.
Use VPC endpoints for private access to supported AWS services.
Prefer roles over static credentials for workloads.
Use SQS for buffering, SNS for fan-out, EventBridge for rule-based event routing.
Use CloudFront for edge caching and lower latency.
Prefer managed services when operational simplicity matters.

Remember This

The exam asks for the best architecture, not a merely functional one.
Underline the main constraint in every scenario: cost, uptime, latency, private access, or operations.
Eliminate answers that solve a different problem than the one asked.

Exam Alert

High-probability SAA-C03 topics include VPC design, NAT Gateway vs Internet Gateway, VPC endpoints, ALB vs NLB, S3/EBS/EFS differences, RDS Multi-AZ vs read replicas, RDS vs DynamoDB, SQS vs SNS vs EventBridge, CloudFront, IAM roles, KMS, disaster recovery patterns, and choosing managed services for lower operational overhead.

Previous Next