SAA-C03 — AWS Certified Solutions Architect – Associate Exam Blueprint

How to Use This Exam Blueprint

Use this independent Exam Blueprint as a practical study map for the AWS Certified Solutions Architect – Associate (SAA-C03) exam. It is designed to help you turn broad exam areas into specific readiness checks: what you should recognize, compare, design, troubleshoot, and eliminate in scenario questions.

Do not treat this as a list of exact exam weights or guaranteed question coverage. Instead, use it to find weak areas before final review.

For each section:

• Mark items as ready, needs review, or uncertain.
• For every uncertain item, write one sentence explaining when to use it and one sentence explaining when not to use it.
• Practice mixed scenarios where security, availability, performance, cost, and operations compete.
• Avoid memorizing service names without understanding the architecture tradeoff.

SAA-C03 Readiness Area Map

High-Value “Can You Do This?” Checklist

Before you sit for SAA-C03, you should be able to do the following without relying on notes.

Architecture judgment

• Convert business requirements into architecture qualities: security, reliability, performance, cost, and operational simplicity.
• Identify the managed AWS service that reduces operational burden compared with self-managed infrastructure.
• Decide when a workload should be stateless, stateful, event-driven, batch-oriented, or streaming.
• Separate high availability, disaster recovery, backup, replication, and scaling.
• Recognize when “lowest cost” conflicts with “highest availability” or “lowest latency.”
• Explain why a design should use multiple Availability Zones.
• Explain when a multi-Region design is justified and when it is unnecessary.
• Choose an edge service when users are globally distributed or static content must be cached close to users.
• Identify single points of failure in compute, networking, storage, and database designs.
• Choose the simplest architecture that satisfies the stated requirements.

AWS service selection

• Choose between EC2, Lambda, containers, and managed platforms.
• Choose between S3, EBS, EFS, and FSx.
• Choose between RDS/Aurora, DynamoDB, ElastiCache, Redshift, OpenSearch Service, and Neptune.
• Choose between ALB, NLB, Gateway Load Balancer, CloudFront, and Route 53.
• Choose between SQS, SNS, EventBridge, Step Functions, and Kinesis.
• Choose between NAT gateway, internet gateway, VPC endpoint, VPN, Direct Connect, VPC peering, and Transit Gateway.
• Choose between CloudWatch, CloudTrail, AWS Config, X-Ray, and Systems Manager for an operational scenario.
• Choose between KMS, Secrets Manager, Systems Manager Parameter Store, IAM policies, and resource policies.

Scenario elimination

• Eliminate answers that expose private resources directly to the internet.
• Eliminate answers that use long-term credentials where roles or temporary credentials are more appropriate.
• Eliminate answers that scale only vertically when horizontal scaling is required.
• Eliminate answers that use a database read replica as a substitute for Multi-AZ availability.
• Eliminate answers that solve asynchronous decoupling with synchronous service calls.
• Eliminate answers that require excessive custom operations when a managed AWS service fits.
• Eliminate answers that improve cost by breaking a stated durability, security, or availability requirement.
• Eliminate answers that use public connectivity when private connectivity is explicitly required.

Core Architecture Decision Points

Secure Architecture Checklist

IAM and access control

Can you do these?

• Explain the difference between an IAM identity policy and an S3 bucket policy.
• Explain why an explicit deny overrides an allow.
• Identify the purpose of a role trust policy.
• Choose IAM roles for EC2, Lambda, ECS tasks, and cross-account access.
• Identify when to use temporary credentials.
• Recognize that SCPs restrict maximum permissions for accounts or organizational units.
• Use conditions conceptually, such as source VPC endpoint, MFA, encryption, or organization membership.
• Avoid using root credentials for routine administrative work.

Example policy-reading readiness:

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:aws:s3:::example-bucket/*",
  "Condition": {
    "StringEquals": {
      "aws:PrincipalOrgID": "o-example"
    }
  }
}

You should be able to say: this allows object reads from a bucket only when the principal meets the organization condition, assuming no other policy blocks the request.

Network security

Checklist:

• Design public and private subnets correctly.
• Place load balancers, NAT gateways, and application instances in appropriate subnet types.
• Keep databases private unless the scenario explicitly requires otherwise.
• Use security groups for instance-level allow rules.
• Use network ACLs when subnet-level stateless filtering is required.
• Use VPC endpoints to keep supported service traffic private.
• Choose AWS WAF for web request filtering.
• Choose AWS KMS where encryption key control or auditability is required.
• Use Secrets Manager or Parameter Store instead of hardcoded secrets.
• Recognize when CloudTrail is required for API audit visibility.

Encryption, secrets, and auditability

Network and Connectivity Readiness

VPC fundamentals

Can you trace this?

• A user reaches a public ALB.
• The ALB sends traffic to private application instances.
• Application instances connect to a private database.
• Application instances retrieve objects from S3 without public internet exposure when required.
• Operations teams access instances without opening broad inbound SSH/RDP access.
• Logs and metrics are sent to monitoring services.
• Failed instances are replaced automatically.

Connectivity decision table

Compute, Scaling, and Load Balancing Checklist

Compute selection

Checklist:

• Choose EC2 when the workload requires server-level control.
• Choose Auto Scaling groups for elastic fleets and self-healing instance replacement.
• Choose Lambda for event-driven workloads when execution model fits.
• Choose containers when packaging, portability, or microservice deployment matters.
• Choose Fargate when the scenario emphasizes avoiding server management.
• Choose Spot only for workloads that tolerate interruption.
• Use launch templates or reusable configuration patterns for repeatable EC2 deployments.
• Store state outside ephemeral compute when instances may be replaced.
• Recognize when a queue protects compute from traffic spikes.

Load balancer selection

Ready checks:

• Match ALB to HTTP/S application routing.
• Match NLB to transport-level traffic.
• Match CloudFront to edge caching and global delivery.
• Use health checks to remove unhealthy targets.
• Design target groups and scaling together.
• Know that load balancing does not replace application or database resiliency.

Storage Architecture Checklist

Storage service selection

Checklist:

• Distinguish object, block, and file storage.
• Choose S3 for object storage, static websites, backups, logs, and data lakes.
• Choose EBS for EC2-attached block storage.
• Choose EFS when multiple compute resources need shared file access.
• Choose FSx when the scenario names Windows file shares or a specific file system requirement.
• Use S3 lifecycle policies to transition or expire objects based on access and retention needs.
• Use S3 versioning when accidental overwrite or deletion protection is needed.
• Use replication when data must be copied across buckets or Regions for a stated purpose.
• Use Object Lock only when write-once-read-many or retention enforcement is required.
• Use S3 event notifications or EventBridge when object changes should trigger processing.

S3 access and protection readiness

Common S3 traps:

• Assuming encryption automatically grants access.
• Assuming public access is required for CloudFront-backed delivery.
• Confusing lifecycle transition with replication.
• Confusing versioning with backup strategy.
• Forgetting that object storage is not block storage for an EC2 boot volume.
• Choosing EFS or EBS when the scenario clearly describes object storage.

Database and Data Platform Checklist

Database service selection

Checklist:

• Choose RDS/Aurora for relational requirements and SQL transactions.
• Choose DynamoDB for key-value access patterns and serverless-style NoSQL needs.
• Identify partition key and access pattern importance for DynamoDB.
• Choose read replicas for read scaling where appropriate.
• Choose Multi-AZ patterns for availability and failover.
• Choose ElastiCache to reduce repeated database reads or handle session/cache needs.
• Choose Redshift for analytical queries over large datasets.
• Choose OpenSearch Service for search use cases.
• Choose DMS when migrating databases with minimal disruption requirements.
• Use backups, snapshots, point-in-time concepts, and restore testing as part of resilience planning.

Database decision traps

Application Integration and Event-Driven Design

Service selection

Can you do this?

• Choose SQS when work should wait in a queue until a consumer processes it.
• Choose SNS when one message should notify multiple subscribers.
• Choose EventBridge when events need routing, filtering, or SaaS/service integration patterns.
• Choose Step Functions when business logic requires explicit workflow states and retries.
• Choose Kinesis when the scenario describes streaming data records.
• Choose DLQs for failed asynchronous processing paths.
• Add idempotency when retries may cause duplicate processing.
• Use queues to absorb traffic spikes and protect downstream services.
• Avoid tightly coupling synchronous services when the scenario asks for resiliency.

Event pattern cues

Resilient Architecture Checklist

Availability and recovery design

Checklist:

• Design web/application tiers across multiple AZs.
• Use load balancer health checks and Auto Scaling replacement.
• Keep application state out of individual instances.
• Use managed database availability features where requirements call for them.
• Use backups and snapshots for recoverability.
• Use S3 versioning and replication when object recovery or geographic copy is required.
• Use Route 53 routing policies for DNS-level failover or routing scenarios.
• Use CloudFront to improve availability and performance for cacheable global content.
• Test whether a design has a single NAT, single instance, single database, or single network dependency.
• Match DR pattern complexity to stated business requirements.

Resiliency scenario checks

High-Performing Architecture Checklist

Performance selection areas

Checklist:

• Add caching when repeated reads are slowing the system and freshness requirements allow it.
• Use CloudFront for cacheable content close to users.
• Use read replicas or caching for read-heavy relational workloads when appropriate.
• Use DynamoDB access-pattern design rather than relational thinking for key-value workloads.
• Use SQS to smooth bursts and prevent overload.
• Use asynchronous processing when users do not need to wait for background work.
• Choose the right storage class and storage type for latency and throughput needs.
• Avoid assuming bigger instances are always the best performance answer.
• Recognize when a managed service automatically handles scaling dimensions that would otherwise be operational work.

Cost-Optimized Architecture Checklist

Cost levers to know

Checklist:

• Choose Spot only for workloads designed for interruption.
• Use lifecycle policies for storage cost optimization.
• Use managed scaling to avoid paying for idle fixed capacity.
• Choose serverless for spiky event-driven workloads when requirements fit.
• Use purchase options conceptually for steady-state workloads.
• Identify NAT, data transfer, idle resources, and overprovisioned compute as cost-review areas.
• Use budgets and cost tools for visibility, not as substitutes for architecture changes.
• Avoid selecting the cheapest answer if it violates durability, availability, or security.

Monitoring, Logging, and Operations Checklist

Observability and governance services

Checklist:

• Choose CloudWatch for metrics, logs, and alarms.
• Choose CloudTrail for API audit trails.
• Choose AWS Config for configuration history and compliance rules.
• Choose X-Ray when tracing application requests is required.
• Choose Systems Manager for operational management without opening broad inbound access.
• Use EventBridge to react to operational events.
• Centralize logs for multi-account or compliance scenarios.
• Alarm on symptoms that affect users, not only infrastructure internals.
• Know the difference between detection, alerting, audit, and remediation.

Migration and Hybrid Architecture Checklist

Can you do this?

• Choose DMS for database migration rather than general file transfer.
• Choose DataSync for file/object transfer rather than application messaging.
• Choose Storage Gateway for hybrid storage access patterns.
• Choose VPN for encrypted internet-based connectivity.
• Choose Direct Connect when dedicated connectivity is the key requirement.
• Choose Transit Gateway when many VPCs and networks need centralized connectivity.
• Identify migration answers that minimize downtime when the scenario requires it.
• Avoid choosing a complex migration tool when a managed service import/export or replication feature directly fits.

Service Selection Quick Reference

Compute and application front end

Data and storage

Integration

Common Weak Areas and Exam Traps

Scenario Practice Prompts

Use these prompts to test whether you can reason like a solutions architect instead of recalling isolated facts.

Secure design prompts

• A Lambda function needs to read from an S3 bucket. What identity should it use, and where are permissions defined?
• An application in a private subnet needs to call AWS APIs without traversing the public internet. What network pattern should you consider?
• A company needs to prevent accounts in an organization from using disallowed services. Is this an IAM policy or an SCP use case?
• A database password is currently stored in application code. Which service pattern improves this?
• Auditors ask who changed a security group. Which logging or audit service is most relevant?

Resilient design prompts

• A web tier runs on one EC2 instance and must survive instance failure. What changes are required?
• A relational database must remain available during an AZ issue. Which managed availability pattern applies?
• A queue consumer occasionally fails after receiving a message. What retry and failure-handling pattern should you review?
• Users in different parts of the world report slow static content downloads. Which edge service should you consider?
• An accidental S3 object delete must be recoverable. Which S3 features should you review?

Performance and cost prompts

• A read-heavy application is overloading its database. Should you consider cache, read replica, data model change, or all of these depending on the scenario?
• A nightly batch job can be restarted if interrupted. Which compute purchase or capacity pattern might reduce cost?
• A workload has unpredictable traffic and spends much of the day idle. Which serverless or scaling options fit?
• Old S3 data is rarely accessed but must be retained. Which lifecycle decision is likely?
• An application performs long synchronous tasks during user checkout. How can decoupling improve performance and reliability?

Final-Week Review Checklist

Final checks:

• I can explain the difference between security, reliability, performance, cost, and operations requirements in a scenario.
• I can choose a service because of a requirement, not because it sounds familiar.
• I can identify when AWS managed services reduce operational overhead.
• I can read policy, network, and architecture descriptions carefully before answering.
• I can eliminate answers that violate private networking, least privilege, or high availability requirements.
• I can explain why the correct answer is better than the second-best answer.
• I have practiced mixed questions, not only single-service flashcards.

Practical Next Step

Turn every unchecked item into a targeted practice task. For each weak topic, review the AWS service decision points, then answer several scenario-based questions that force you to choose between similar services. Focus especially on IAM, VPC networking, storage selection, database availability, decoupling, monitoring, and cost tradeoffs, because these areas often separate memorization from architect-level readiness for SAA-C03.