AWS Solutions Architect Associate (SAA-C03)

This deck is designed to help you prepare for the AWS Certified Solutions Architect – Associate (SAA-C03) exam by drilling you on the kinds of service-selection and architectural decision questions that come up frequently on the test. The cards focus on choosing the right AWS service for a given scenario, comparing similar-sounding options, and recalling the key features and limits that distinguish one service from another. You'll see questions on storage classes, database scaling options, messaging and streaming services, and auto scaling policies, among other core topics.

It's best suited for learners who already have some hands-on familiarity with AWS and are now consolidating that knowledge into exam-ready recall. If you're early in your study journey, you may want to pair this deck with broader reading or a course, since the questions are intentionally framed as quick-fire "which service fits best?" prompts rather than introductory explanations. If you're closer to your exam date, this deck works well as a final-pass review tool to surface gaps and sharpen your instincts for multiple-choice scenarios.

Because the cards test pattern recognition more than deep understanding, spaced repetition will be your biggest ally. Short, daily review sessions are more effective than occasional marathon cramming, especially as you build up the mental map of which service belongs to which problem. When you get a card wrong, take a moment to think through why the alternative answers are wrong too — this trains you to rule out distractors, which is exactly what the exam asks you to do.

Finally, treat this deck as a checkpoint, not a substitute for hands-on practice. Briefly sketching out the architecture described in each question in the AWS console or even on paper can turn a memorized answer into genuine understanding, which will serve you much better when the real exam presents a scenario phrased in unfamiliar wording.

Amazon S3 is the central object store of the AWS platform, advertising eleven nines of durability (99.999999999%) by automatically spreading data across multiple devices and facilities within a region. A bucket is globally named, but the data it holds is regional, and by default an account can create up to 100 buckets (1,000 after a quota increase). Individual objects can grow to 5 TB, and multipart upload is recommended above 100 MB and required above 5 GB. S3 now offers strong read-after-write, list, and overwrite/delete consistency, which simplifies application design compared to the older eventual-consistency model.

S3 provides a family of storage classes that trade cost against retrieval latency. Standard is for hot data, and S3 Intelligent-Tiering automatically moves objects between tiers when access patterns change with no retrieval charges, making it the right pick for unknown or shifting workloads. For colder data, S3 Glacier Flexible Retrieval (minutes to hours), S3 Glacier Instant Retrieval (milliseconds, very low cost), and S3 Glacier Deep Archive (12-hour retrieval, cheapest of all) cover the long tail. Lifecycle rules transition objects between classes over time so cost follows usage.

Protecting objects in S3 involves a small toolkit. Versioning plus MFA Delete guards against accidental deletion, and S3 Object Lock in Governance or Compliance mode enforces immutability for regulatory retention. Pre-signed URLs give third parties time-limited access to specific objects without making them public. Cross-Region Replication (CRR) and Same-Region Replication (SRR) both require versioning on the source and target buckets. When serving a private static site through CloudFront, an Origin Access Control (OAC) plus a tight bucket policy keeps the bucket non-public while still allowing the distribution to read it. For server-side encryption, you can choose SSE-S3 (S3-managed keys), SSE-KMS (KMS-managed with audit trails), or SSE-C (keys you supply).

Beyond S3, AWS offers shared file and block storage. Amazon EFS provides a shared POSIX file system that many EC2 instances can mount concurrently, ideal for lift-and-shift Linux workloads. FSx for Lustre delivers a high-performance parallel file system tuned for HPC. AWS Storage Gateway bridges on-premises environments with cloud storage through cached or stored volumes and file gateways, while Application Migration Service (MGN) handles block-level VM migration into EC2.

EC2 instance families are lettered to advertise their shape: C is compute-heavy, M is balanced, R is memory-rich, and T is burstable and cheap for variable workloads. Choosing among them is part of architectural fitness, and so is choosing how to pay. Spot Instances offer up to 90% discount but can be reclaimed with a 2-minute interruption notice, which your application can learn about through the instance metadata at the well-known spot/instance-action path or via an EventBridge event. Reserved Instances commit you to a specific instance type for one or three years for roughly a one-third discount, while Savings Plans trade instance-type specificity for family flexibility at a similar discount.

AWS Lambda runs code in response to events without provisioning servers. Each invocation is capped at 15 minutes, and the default regional concurrency limit is 1,000 (raiseable on request). To reach resources inside a VPC, you attach a configuration that includes subnets and security groups; AWS then creates ENIs in those subnets for the function. EventBridge cron or rate rules are the standard way to schedule Lambdas, and Lambda can also be invoked by SQS, SNS, API Gateway, and dozens of other sources.

AWS Fargate applies the same serverless model to containers, removing the need to manage EC2 hosts underneath ECS or EKS. ECS is the AWS-native container orchestrator and EKS is managed Kubernetes, both of which can run on EC2 or on Fargate. For batch workloads such as genomics or rendering, AWS Batch schedules jobs across dynamically provisioned compute and is the right answer when you need queue-driven parallelism. To move existing servers, Application Migration Service (MGN) performs continuous block-level replication and orchestrates cutover. AMIs tie together an EBS snapshot and the launch metadata needed to boot a new instance, and they can be shared across accounts with explicit launch permissions, enabling cross-account image distribution.

Inside a VPC, the choice of how instances reach the internet or AWS services affects both security and cost. A NAT Gateway lets private-subnet resources make outbound calls (for package updates, for example) while remaining unreachable from the internet. Gateway VPC Endpoints are free and route traffic privately to S3 and DynamoDB through the VPC routing table. Interface VPC Endpoints, powered by PrivateLink, provide private connectivity to most other AWS services for an hourly and per-GB price.

Connecting multiple VPCs and on-premises networks quickly grows complex. VPC peering is one-to-one with no transitive routing, so a hub-and-spoke pattern with many VPCs is better served by AWS Transit Gateway. AWS Network Firewall delivers managed stateful inspection inside a VPC, and AWS Firewall Manager centrally applies WAF and firewall rules across an organization. For hybrid DNS, Route 53 Resolver inbound and outbound endpoints let on-premises resolvers query private hosted zones and let VPC resources resolve on-premises names.

Load balancing and global traffic management are layered services. The Application Load Balancer (ALB) operates at layer 7 and supports path- and host-based routing, ideal for microservices and HTTP workloads, and its listener security policy is where you enforce TLS 1.2 or higher. The Network Load Balancer (NLB) operates at layer 4, preserves client source IPs, supports static IPs, and handles TCP and UDP. In front of regional ALBs, AWS Global Accelerator advertises anycast IPs from the AWS edge for cross-region failover and lower first-hop latency. Route 53 supports failover routing, where health-checked primary and secondary records automatically redirect traffic when the primary becomes unhealthy. CloudFront, the CDN, accelerates static and dynamic content at the edge; to force HTTPS you set the Viewer Protocol Policy to HTTPS Only or Redirect HTTP to HTTPS, PriceClass_100 limits costs to North America and Europe edges, and Origin Access Control keeps S3 origins private.

For relational workloads, Amazon RDS offers managed engines like PostgreSQL, MySQL, and SQL Server. Multi-AZ deployments provide high availability through a synchronous standby in another Availability Zone, while Read Replicas are asynchronous copies intended to scale reads. Aurora, the AWS-native engine, stores six copies of your data across three AZs automatically and can typically fail over in under 30 seconds. Aurora Serverless v2 scales capacity in fine-grained ACUs in seconds, making it a strong fit for variable or spiky demand. To encrypt an existing unencrypted RDS instance, you cannot flip a switch in place; you take a snapshot, copy it with encryption enabled, and restore.

DynamoDB is the managed NoSQL key-value and document database. On-Demand capacity mode is ideal for bursty or unpredictable traffic because it charges per request with no provisioning required. For queries on non-key attributes, Global Secondary Indexes (GSI) and Local Secondary Indexes (LSI) provide alternate query patterns, and DynamoDB Global Tables deliver multi-region, active-active replication. For globally distributed SQL, Aurora Global Database is the relational counterpart.

ElastiCache sits in front of databases to absorb reads. Memcached is a simple, multi-threaded cache best for ephemeral key-value use, while Redis (now ElastiCache for Redis) adds persistence, replication, pub/sub, and richer data structures. Amazon Redshift is the petabyte-scale columnar data warehouse, and Amazon OpenSearch Service is the managed OpenSearch cluster for full-text and log analytics.

For data lake analytics, Athena runs SQL directly against files in S3 with no cluster to manage, and the AWS Glue Data Catalog plus crawlers keep the schema discoverable. AWS Glue also runs serverless Spark ETL jobs. Kinesis Data Firehose loads streaming data into S3, Redshift, or OpenSearch without writing consumer code, while Kinesis Data Analytics runs Apache Flink stream processing. Managed Kafka is available as Amazon MSK, and managed Airflow as Amazon MWAA for workflow orchestration.

Application integration on AWS is a layered set of services. Amazon SQS is a managed message queue offering at-least-once delivery; Standard queues deliver in best-effort order with high throughput, while FIFO queues preserve order and exactly-once processing. Amazon SNS provides pub/sub fan-out, pushing messages to many subscribers such as SQS queues, Lambda functions, or HTTP endpoints. EventBridge builds on this with rich rules, a schema registry, and native ingestion of SaaS partner events, so it is the preferred choice when you need filtering or third-party event sources.

For high-volume real-time streams, Kinesis Data Streams captures millions of events per second and lets consumers replay data within a retention window, which makes it suitable for analytics, monitoring, and complex event processing. Kinesis Data Firehose is the zero-admin alternative that loads streams directly into S3, Redshift, or OpenSearch. Amazon MSK delivers managed Apache Kafka clusters for teams that already have Kafka expertise or want Kafka's exact semantics.

API Gateway is the front door for HTTP and REST APIs, handling throttling, authorization, request validation, and integration with Lambda or backend services. Auto Scaling works hand in hand with load balancers and compute fleets: it watches a CloudWatch metric and reacts through alarms and scaling policies. Target-tracking scaling aims to keep a chosen metric, like average CPU, at a target value; step scaling reacts to alarm breaches by adding or removing a fixed number of instances per step. The result is a self-adjusting capacity layer that does not require manual intervention.

AWS identity begins with IAM. An IAM user is a long-lived identity for a person or workload, a group attaches shared policies to multiple users, and a role provides temporary credentials that can be assumed by services, federated users, or other accounts. To give an EC2 instance permission to read from S3, you attach an IAM role through an instance profile rather than embedding keys on the machine. For human SSO, IAM Identity Center federates identities through SAML 2.0 or OIDC. The root account is uniquely powerful and should be protected with hardware MFA, no access keys, and locked-down access.

Encryption and secret management are first-class responsibilities. Secrets Manager handles automatic rotation of database credentials, while SSM Parameter Store is the cheaper option for simple configuration values. Server-side encryption on S3 can use SSE-S3, SSE-KMS, or SSE-C, and KMS gives you a per-key audit trail of decrypt operations through CloudTrail. For cross-account S3 access, the recommended pattern is a bucket policy that grants access to a specific role in the other account, combined with a role trust policy and required IAM permissions in that account.

Threat detection and protection are layered services. AWS WAF filters HTTP traffic at the edge against OWASP-style rules. AWS Shield Standard is automatic for every AWS customer; Shield Advanced adds enhanced DDoS mitigation and cost protection. Amazon GuardDuty applies machine learning to CloudTrail, VPC flow, and DNS logs to surface threats, while Amazon Inspector scans EC2 instances and ECR images for software vulnerabilities. Amazon Macie discovers and classifies PII in S3, and AWS Security Hub aggregates findings from these and other tools into a single dashboard. AWS Chatbot pipes alarms and security alerts into Slack or Microsoft Teams for live incident collaboration.

Governance spans accounts as well as services. AWS Organizations provides consolidated billing, and Service Control Policies (SCPs) set the maximum permissions for any account in an organizational unit. AWS Control Tower builds on Organizations to set up a multi-account landing zone with guardrails and an Account Factory for standardized account provisioning. AWS Config continuously records resource configurations and evaluates them against rules for compliance and change tracking.

Observability in AWS splits naturally between what happened and how the system is behaving. CloudTrail records the API audit trail: who called which API on which resource. By default, events are retained 90 days in the console, and you should ship them to S3 for long-term retention, where a lifecycle rule can move them to Glacier. CloudWatch, by contrast, collects operational metrics and logs and supports alarms, dashboards, and Insights queries for ad-hoc log analysis. For end-to-end latency tracing, AWS X-Ray follows requests across services and surfaces bottlenecks and errors.

For data and infrastructure protection, the line between snapshots, AMIs, and AWS Backup often appears in the exam. An EBS snapshot is a point-in-time copy of a volume, an AMI is a snapshot plus launch metadata, and AWS Backup is a cross-service policy engine that schedules and tracks backups for EBS, RDS, DynamoDB, EFS, and more. CloudFormation Drift Detection compares deployed resources against your template to surface out-of-band changes, and the AWS CDK lets you author IaC in TypeScript or Python that compiles to CloudFormation.

Disaster recovery is described by two numbers. RPO is the maximum data loss you can tolerate, and RTO is the maximum downtime. AWS classifies DR strategies from cheapest and slowest to most expensive and fastest: Backup and Restore (high RPO/RTO, low cost), Pilot Light (minimal always-on core, scaled out at recovery), Warm Standby (a scaled-down but running environment), and Multi-Site Active/Active (full capacity in two regions, near-zero RPO and RTO). Choosing among them is a business decision driven by cost versus the value of avoiding downtime.

Day-to-day cost and operational governance round out the picture. AWS Cost Anomaly Detection uses machine learning to alert on unusual spend, and the AWS Pricing Calculator gives a pre-deployment estimate of monthly bills. Service Quotas are tracked in a dedicated console where you can request increases. To replace SSH bastions, SSM Session Manager provides IAM-controlled, audit-logged shell access through the SSM agent with no inbound ports open. And for cheap long-term log archival, a CloudWatch Logs subscription filter can stream into Kinesis Data Firehose, which writes to S3 with a lifecycle rule transitioning old data into Glacier.