SAA-C03 tests whether you can design on AWS under a constraint: secure, resilient, fast or cheap. Each domain follows the official task statements (14 in all). This outline lists what each one expects, in plain terms. Tick topics off as you cover them. Your ticks are saved in this browser.
This outline follows the official SAA-C03 exam guide . Check it for the exact wording.
Design secure architectures 30% Who can do what, how traffic is filtered, and how data is protected. This is the largest domain (30%).
Secure access to AWS resources (task 1.1) The shared responsibility model, and how Regions and Availability Zones affect where data lives Locking down the root user, and MFA for root and IAM users A flexible authorization model of IAM users, groups, roles and policies, at least privilege How policies are evaluated: explicit deny, allow, implicit deny; identity, resource, session and boundary policies Role-based access: STS, role switching and cross-account access, external IDs Roles for services (EC2 instance profiles, Lambda execution roles) instead of access keys When to use resource policies (S3, SQS, KMS, Lambda) instead of roles Multi-account security: Organizations, service control policies, Control Tower, RAM Federation: IAM Identity Center, SAML identity providers, directory services, and when to federate a directory with IAM roles Secure workloads and applications (task 1.2) VPC design with public and private subnets, route tables, internet gateways and NAT gateways Security groups vs network ACLs, and controlling ports, protocols and traffic Network segmentation strategies and tiered architectures AWS service endpoints: gateway endpoints, interface endpoints and PrivateLink Edge and application protection: WAF, Shield, Network Firewall, Firewall Manager Threat vectors outside AWS: DDoS, SQL injection, cross-site scripting and how to counter each Application credentials and configuration: Secrets Manager vs Parameter Store Secure application access: Cognito user pools and identity pools, IAM Identity Center Security services and their use cases: GuardDuty, Macie, Inspector, Security Hub, Detective, Config, CloudTrail Securing external connections: Site-to-Site VPN, Client VPN, Direct Connect with encryption Data security controls (task 1.3) Encryption at rest with KMS: AWS managed vs customer managed keys, key policies, grants, multi-Region keys, CloudHSM Encryption at rest behaviour for S3, EBS, RDS, DynamoDB and EFS Encrypting in transit with TLS and ACM certificates, including where certificates must live Rotating keys, secrets and certificates S3 access control: Block Public Access, bucket policies, access points, presigned URLs, origin access control Data access and governance: Lake Formation, Macie classification, tagging Data retention, lifecycle and protection: versioning, MFA Delete, Object Lock, Vault Lock Backups and replication for recovery: AWS Backup, snapshots, S3 replication, cross-account copies Aligning AWS technologies to compliance requirements: Artifact, Audit Manager, Config conformance packs
Design resilient architectures 26% Keeping applications running through failures and load changes, and recovering when they don't (26%).
Scalable and loosely coupled architectures (task 2.1) Horizontal vs vertical scaling, and stateless vs stateful design Amazon SQS standard and FIFO queues, visibility timeout, dead-letter queues, long polling Amazon SNS fan-out, message filtering, and Amazon EventBridge event routing Publish/subscribe and event-driven architecture design AWS Step Functions for workflow orchestration, Standard vs Express API creation and management with API Gateway: endpoint types, throttling, authorizers, caching Serverless patterns with Lambda, Fargate, DynamoDB and AppSync Containers on ECS and EKS, and how to migrate an application into containers Managed integration services: Transfer Family, AppFlow, Amazon MQ, Secrets Manager Load balancing concepts and multi-tier architecture design Caching strategies and edge acceleration with a CDN Storage types (object, file, block) and when to use read replicas Choosing purpose-built services and deciding between serverless, containers and EC2 Highly available and fault-tolerant architectures (task 2.2) Multi-AZ design with ELB and EC2 Auto Scaling, removing single points of failure RDS Multi-AZ vs read replicas, Aurora replicas and Aurora Global Database DynamoDB global tables, point-in-time recovery, and RDS Proxy for failover and connection pooling Route 53 routing policies, health checks and failover strategies Disaster recovery strategies by RTO and RPO: backup and restore, pilot light, warm standby, active/active AWS Backup, Elastic Disaster Recovery, snapshots and S3 replication for durability Immutable infrastructure and automation to keep infrastructure consistent Service quotas and throttling in standby environments Distributed design patterns: retries with backoff, idempotency, circuit breakers Workload visibility with X-Ray, CloudWatch and Health Dashboard, and choosing metrics from business requirements Reliability for legacy applications that can't change Managed AI services in scope (Comprehend, Polly and others) as purpose-built choices 24%
Choosing the storage, compute, database, network and data services that meet performance targets (24%).
High-performing storage (task 3.1) Block vs file vs object storage and their characteristics EBS volume types (gp3, io2, st1, sc1) and instance store Amazon EFS and the Amazon FSx family (Windows, Lustre, ONTAP, OpenZFS) S3 performance: prefixes, multipart upload, byte-range fetches, Transfer Acceleration Hybrid storage: Storage Gateway types, DataSync, Transfer Family Choosing storage that scales to future needs High-performing and elastic compute (task 3.2) EC2 instance families, sizes, Graviton, placement groups and enhanced networking Auto Scaling policies: target tracking, step, scheduled, predictive, and warm pools Choosing scaling metrics and conditions Lambda memory, timeout, concurrency, cold-start options Containers: ECS, EKS and Fargate AWS Batch, EMR, Elastic Beanstalk, Outposts, Local Zones Decoupling with queues and messaging so components scale independently High-performing databases (task 3.3) Database types and services: relational, key-value, document, graph, in-memory, time series, columnar RDS vs Aurora vs DynamoDB, and Aurora Serverless Read replicas, replication and capacity planning (capacity units, instance types, Provisioned IOPS) Connections and proxies: RDS Proxy Caching with ElastiCache (Redis OSS/Valkey, Memcached) and DAX Engine choice and migrations: homogeneous vs heterogeneous, DMS and SCT Read-intensive vs write-intensive access patterns High-performing network architectures (task 3.4) Data ingestion and transformation (task 3.5) Kinesis Data Streams vs Amazon Data Firehose, Managed Service for Apache Flink, MSK Ingestion patterns by frequency, and sizing for speed and volume Data transfer services: DataSync, Storage Gateway, Snow Family, Transfer Family Transforming data with Glue, including CSV to Parquet Querying and processing: Athena, EMR, Redshift, OpenSearch Building and securing data lakes with Lake Formation Visualization with QuickSight
Design cost-optimized architectures 20% Meeting the same requirements for less: purchase options, storage tiers, database choices and data transfer (20%).
Cost-optimized storage (task 4.1) S3 storage classes, Intelligent-Tiering, lifecycle rules and minimum durations Requester Pays and S3 access options that move cost to the consumer Block storage choices: SSD vs HDD, gp3 vs gp2, snapshot and unattached volume cleanup EFS lifecycle and One Zone, FSx options, and the cheapest service for a workload Storage sizing, auto scaling and access patterns Cheapest data transfer into AWS: DataSync, Snow Family, Transfer Family, Storage Gateway Backup and archival strategy, and batch vs individual uploads Cost-optimized compute (task 4.2) Cost-optimized databases (task 4.3) Cost-optimized networks (task 4.4) Cost visibility and governance (tasks 4.1 to 4.4)