What's on the Solutions Architect exam
Exam code: SAA-C03
Practice the real format
Do you think you are ready? Put your knowledge to the test with a free, timed practice exam that mirrors the Solutions Architect format — with instant scoring, per-domain breakdowns, and full answer explanations.
Start a practice exam →The AWS Certified Solutions Architect – Associate (SAA-C03) validates your ability to design solutions on AWS that are secure, resilient, high-performing, and cost-effective. It is one of the most widely pursued cloud certifications in the industry and assumes roughly a year of hands-on experience designing or operating AWS workloads.
Domains covered
The exam is organized into weighted domains. The percentages indicate roughly how much of the exam each domain represents, which is a useful guide for allocating study time.
Design Secure Architectures 30%
Designing secure access to AWS resources, secure workloads and applications, and appropriate data security controls using services like IAM, security groups, and encryption.
Design Resilient Architectures 26%
Building scalable and loosely coupled architectures, and designing for high availability and fault tolerance across Availability Zones and Regions.
Design High-Performing Architectures 24%
Selecting performant storage, compute, database, and networking solutions, and knowing when to introduce caching or scaling.
Design Cost-Optimized Architectures 20%
Choosing cost-effective storage, compute, and database options, and applying the right pricing models to control spend.
How to prepare
The exam is scenario-driven: most questions describe a situation and ask for the best design given competing constraints. That means recognizing trade-offs — between cost and resilience, or performance and simplicity — matters more than memorizing service facts. Timed practice papers are especially valuable because they train you to read long scenarios efficiently within the 130-minute limit.
SAA-C03 concepts mapped to AWS services
The SAA-C03 exam is scenario-driven — every question gives you a business constraint and asks you to select the best-fit service or architecture pattern. This reference table maps the generic concept you'll encounter in a question to the exact AWS service that solves it, grouped by the domains you'll be tested on.
| Generic Concept | AWS Service | Purpose / What it does |
|---|---|---|
| Identity, Security & Compliance | ||
| Identity & access management | AWS IAM | Controls authentication and authorization for users, groups, and roles |
| Temporary credentials | AWS STS | Issues temporary, scoped credentials for users and services assuming roles |
| Multi-account governance | AWS Organizations | Centrally manages multiple AWS accounts, SCPs, and consolidated billing |
| Secrets management | AWS Secrets ManagerSSM Parameter Store | Securely stores and rotates passwords, API keys, and configuration secrets |
| Encryption key management | AWS KMS | Creates and manages symmetric and asymmetric encryption keys for AWS services |
| Certificate management | AWS ACM | Provisions and auto-renews SSL/TLS certificates for ALB, CloudFront, API Gateway |
| Threat detection | Amazon GuardDuty | Continuously monitors accounts and workloads for malicious activity using ML |
| Security posture management | AWS Security Hub | Aggregates and prioritises security findings from GuardDuty, Inspector, and Macie |
| Web application protection | AWS WAF | Protects web applications from SQLi, XSS, and custom rule-based attacks |
| DDoS protection | AWS Shield | Standard (free) and Advanced protection against DDoS attacks |
| Audit & compliance logging | AWS CloudTrail | Records every API call across your AWS account for auditing and forensics |
| Configuration compliance | AWS Config | Tracks resource configuration changes over time and evaluates compliance rules |
| Networking | ||
| Virtual private cloud | Amazon VPC | Creates logically isolated virtual networks with full control over IP ranges |
| Public & private subnets | VPC Subnets | Segregates workloads — public subnets for internet-facing resources, private for internal |
| Internet connectivity | Internet Gateway | Enables bidirectional internet access for resources in public subnets |
| Private outbound internet | NAT Gateway | Allows private instances to reach the internet (e.g. for patches) without inbound exposure |
| Private AWS connectivity | VPC Endpoints | Accesses S3, DynamoDB, and other AWS services without traversing the public internet |
| Dedicated hybrid connectivity | AWS Direct Connect | Private, consistent-bandwidth connection between on-premises data centres and AWS |
| Encrypted hybrid connectivity | AWS Site-to-Site VPN | IPSec-encrypted tunnel over the internet between AWS and on-premises |
| Multi-VPC & hybrid hub | AWS Transit Gateway | Centrally connects hundreds of VPCs and on-premises networks via a single hub |
| VPC-to-VPC connectivity | VPC Peering | Private routing between two VPCs — non-transitive and same or cross-account |
| Global DNS & routing | Amazon Route 53 | Highly available DNS with latency-based, geolocation, failover, and weighted routing |
| Global application acceleration | AWS Global Accelerator | Routes traffic via AWS backbone for lower latency — static Anycast IPs, TCP/UDP |
| Content delivery network | Amazon CloudFront | Global CDN for caching and delivering HTTP/HTTPS content at the edge |
| Compute | ||
| Virtual servers | Amazon EC2 | Resizable virtual machines — choose instance family based on workload type |
| Auto scaling | EC2 Auto Scaling | Automatically adjusts EC2 fleet size based on demand, schedules, or custom metrics |
| Load balancing | ALBNLBGWLB | ALB for HTTP/HTTPS layer-7; NLB for TCP/UDP layer-4; GWLB for inline appliances |
| Serverless compute | AWS Lambda | Event-driven code execution — no servers to manage, billed per invocation and duration |
| Container orchestration | Amazon ECS | AWS-native managed Docker container orchestration service |
| Managed Kubernetes | Amazon EKS | Managed Kubernetes control plane — bring your own worker nodes or use Fargate |
| Serverless containers | AWS Fargate | Runs ECS or EKS containers without managing or sizing EC2 instances |
| Managed application deployment | AWS Elastic Beanstalk | Upload code and Beanstalk handles provisioning, scaling, and load balancing |
| Storage | ||
| Object storage | Amazon S3 | Durable, scalable object storage — 11 nines durability, storage class tiering |
| Block storage | Amazon EBS | Persistent block storage attached to EC2 — gp3, io2, st1, sc1 volume types |
| Shared file storage (Linux) | Amazon EFS | Managed NFS file system — elastic, concurrent access from multiple EC2 instances |
| Managed file storage (Windows / HPC) | Amazon FSx | FSx for Windows File Server (SMB) and FSx for Lustre (high-throughput HPC) |
| Hybrid storage bridge | AWS Storage Gateway | Connects on-premises applications to S3 or EBS via File, Volume, or Tape Gateway |
| Long-term archival | Amazon S3 Glacier | Low-cost archival — Instant, Flexible, and Deep Archive retrieval tiers |
| Databases | ||
| Managed relational database | Amazon RDS | MySQL, PostgreSQL, Oracle, SQL Server — managed patching, backups, Multi-AZ |
| Cloud-native relational database | Amazon Aurora | MySQL and PostgreSQL-compatible — up to 5× faster, 15 read replicas, Global Database |
| NoSQL / key-value store | Amazon DynamoDB | Single-digit millisecond performance at any scale — Global Tables for multi-region |
| In-memory cache | Amazon ElastiCache | Redis (persistence, pub/sub, Sorted Sets) or Memcached (simple, multi-threaded) |
| Data warehouse | Amazon Redshift | Petabyte-scale columnar SQL analytics — Redshift Spectrum queries S3 directly |
| Document database | Amazon DocumentDB | MongoDB-compatible managed document database |
| High Availability & Disaster Recovery | ||
| Database automatic failover | RDS Multi-AZAurora Multi-AZ | Synchronous standby replica — automatic failover in 60–120 seconds |
| Database read scaling | RDS Read ReplicasAurora Replicas | Asynchronous read replicas — offload read traffic, cross-region for DR |
| Cross-region object replication | S3 CRR | Replicates S3 objects to another Region for compliance or low-latency access |
| Centralised backup | AWS Backup | Policy-driven backup management across RDS, EBS, EFS, DynamoDB, and more |
| Rapid workload recovery | AWS Elastic Disaster Recovery | Continuously replicates servers for sub-minute RPO and RTO recovery |
| Application Integration | ||
| Asynchronous message queue | Amazon SQS | Standard (at-least-once, best-effort order) or FIFO (exactly-once, strict order) |
| Pub/sub fan-out messaging | Amazon SNS | Push notifications to multiple SQS queues, Lambda, HTTP, or email endpoints |
| Event-driven routing | Amazon EventBridge | Routes events from AWS services or SaaS apps to targets based on rules |
| Distributed workflow orchestration | AWS Step Functions | Visual state machines coordinating Lambda, ECS, and other services in sequence |
| API management | Amazon API Gateway | Creates, secures, and throttles REST, HTTP, and WebSocket APIs at scale |
| Monitoring & Operations | ||
| Metrics, alarms & dashboards | Amazon CloudWatch | Collects metrics from all AWS services, triggers alarms, and renders dashboards |
| Centralised log management | CloudWatch Logs | Aggregates, filters, and retains logs from EC2, Lambda, RDS, and VPC Flow Logs |
| Infrastructure as Code | AWS CloudFormation | Declarative IaC — provisions and updates stacks of AWS resources from templates |
| Systems & patch management | AWS Systems Manager | Patch Manager, Session Manager (no SSH), Parameter Store, and Run Command |
| Architectural recommendations | AWS Trusted Advisor | Checks for cost savings, security gaps, performance issues, and fault-tolerance risks |
| Cost analysis & rightsizing | AWS Cost Explorer | Visualises spend trends, forecasts costs, and surfaces rightsizing recommendations |
| Migration & Hybrid | ||
| Database migration | AWS DMS | Homogeneous and heterogeneous database migrations with continuous replication |
| Petabyte-scale data transfer | AWS Snow Family | Snowcone, Snowball, and Snowmobile for offline bulk data transfer to AWS |
| Server lift-and-shift migration | AWS MGN | Replicates physical and virtual servers continuously to AWS for cutover migration |
| Online data synchronisation | AWS DataSync | Accelerates online data movement between NFS/SMB storage systems and AWS |
Exam formats and passing scores are updated periodically by AWS. Always confirm the current details on the official AWS certification page before booking your exam.
Ready to test yourself?
Do you think you are ready? Put your knowledge to the test with a free, timed practice exam that mirrors the Solutions Architect format — with instant scoring, per-domain breakdowns, and full answer explanations.
Start a practice exam →