AWS Certified Solutions Architect - Associate (SAA-C03) is the flagship Associate-level certification for AWS architecture design. Rather than asking what each service does, it asks which services you should combine, and how, given a set of requirements and constraints. The right answer is usually the one option, among several that would technically work, that fits the requirements best.
This post is the guide to our 14-part SAA-C03 domain deep-dive series. Before getting into individual topics, it maps out the exam structure, who should take it, and where this certification sits on the AWS career path.
---
Who Is SAA-C03 For?
SAA-C03 is like an architectural design exam. It does not test whether you can lay bricks; it tests whether you can decide what structure to build given a budget, a site, and safety codes. Each question comes with a condition such as "most cost-effective" or "least operational overhead," and that condition is what decides the answer.
This certification is a particularly good fit for the following people.
| Target Audience | Why It Fits | |------|------| | Cloud and infrastructure engineers | Validate the ability to turn requirements into a design by combining AWS services | | Back-end developers | Understand the availability, security, and cost structure of the infrastructure your application runs on | | On-premises systems and network engineers | Translate existing design experience into AWS architecture patterns | | CLF-C02 holders | The next step from knowing the services to making architecture decisions | | Aspiring solutions architects and pre-sales engineers | Gain the criteria for proposing a configuration that fits a customer's requirements |
There is no prerequisite certification, so you can sit the exam without Cloud Practitioner. AWS recommends at least one year of hands-on experience designing cloud solutions with AWS services, but it is not required.
---
Exam at a Glance
| Item | Detail | |------|------| | Exam Code | SAA-C03 | | Full Name | AWS Certified Solutions Architect - Associate | | Level | Associate | | Passing Score | 720 (scale 100–1,000) | | Questions | 65 (50 scored + 15 unscored) | | Duration | 130 minutes | | Exam Fee | $150 USD | | Validity | 3 years | | Question Types | Multiple choice, multiple response | | Languages | English, Japanese, Korean, Spanish, Portuguese (Brazil), and more | | Delivery | Pearson VUE testing center or online proctored exam | | Recommended Experience | At least 1 year designing cloud solutions on AWS (not required) |
The 15 unscored questions are there so AWS can evaluate them for future exams, and they are not identified on the exam. Unanswered questions are scored as incorrect and there is no penalty for guessing, so answer every question. Scoring is compensatory: you do not need to pass each domain, only reach 720 overall.
---
Domain Breakdown
SAA-C03 is made up of four domains. The weights below are the official figures for scored content.
| Domain | Topic | Weight | Deep dives | |------|------|------|------| | Domain 1 | Design Secure Architectures | 30% | 3 posts | | Domain 2 | Design Resilient Architectures | 26% | 2 posts | | Domain 3 | Design High-Performing Architectures | 24% | 5 posts | | Domain 4 | Design Cost-Optimized Architectures | 20% | 4 posts |
Domain 1 (Design Secure Architectures) carries the most weight at 30%. The four domains do not ask about different services, though; they ask about the same services from four angles: security, resilience, performance, and cost. S3 alone shows up in all four, as bucket policies (security), cross-Region replication (resilience), transfer acceleration (performance), and storage classes (cost). Organizing your notes by angle rather than by service works better.
!SAA-C03 exam domain weight breakdown across 4 domains
Domain 1: Design Secure Architectures (30%)
This domain is about designing who can access what, and how workloads and data are protected.
Key topics: IAM users, groups, roles, and policies; multi-account strategy and AWS Organizations; service control policies (SCPs); security groups and network ACLs; AWS WAF and Shield; encryption at rest with KMS; encryption in transit; Secrets Manager; S3 bucket policies.
Exam tip: "An EC2 instance needs access to S3" → attach an IAM role to the instance instead of embedding access keys. Security groups are stateful and have allow rules only; network ACLs are stateless and have both allow and deny rules.
Related posts: Designing Secure Access to AWS Resources, Designing Secure Workloads, Designing Data Security Controls
Domain 2: Design Resilient Architectures (26%)
This domain covers designs that keep the whole system running when a part fails, by coupling components loosely and spreading them across Availability Zones.
Key topics: Loose coupling with SQS, SNS, and EventBridge; Multi-AZ deployments; Elastic Load Balancing and Auto Scaling; Route 53 routing policies and health checks; RDS Multi-AZ and read replicas; disaster recovery strategies (backup and restore, pilot light, warm standby, multi-site); RPO and RTO.
Exam tip: "Requests must not be lost even when traffic spikes" → put an SQS queue between the front end and the processing tier. RDS Multi-AZ is for high availability through failover, while read replicas are for spreading read load; they serve different purposes.
Related posts: Scalable and Loosely Coupled Architectures, Highly Available and Fault-Tolerant Architectures
Domain 3: Design High-Performing Architectures (24%)
This domain is about choosing the storage, compute, database, and network options that match the characteristics of a workload.
Key topics: EBS volume types, EFS, and FSx; EC2 instance types, Lambda, and containers (ECS, EKS, Fargate); choosing among RDS, Aurora, and DynamoDB; caching with ElastiCache and DAX; CloudFront and Global Accelerator; data ingestion and transformation (Kinesis, Glue, Athena).
Exam tip: "Key-value lookups that need millisecond responses" → DynamoDB. "A relational workload with many complex joins" → RDS or Aurora. "Deliver static content quickly to users worldwide" → CloudFront. "Static IP addresses and TCP/UDP acceleration" → Global Accelerator.
Related posts: High-Performance Storage, High-Performance Compute, High-Performance Database Solutions, High-Performance Network Architectures, High-Performance Data Ingestion
Domain 4: Design Cost-Optimized Architectures (20%)
This domain is about choosing the configuration that meets the same requirements at the lowest cost.
Key topics: S3 storage classes and lifecycle policies; EC2 purchasing options (On-Demand, Reserved Instances, Savings Plans, Spot); right-sizing; database cost optimization; NAT gateway and data transfer costs; VPC endpoints; Cost Explorer and AWS Budgets.
Exam tip: "A batch job that can tolerate interruption" → Spot Instances. "A workload that runs steadily for one to three years" → Savings Plans or Reserved Instances. "Objects with unpredictable access patterns" → S3 Intelligent-Tiering.
Related posts: Cost-Optimized Storage, Cost Optimization for Compute, Cost Optimization for Database, Cost Optimization for Network
---
Where SAA-C03 Fits in the AWS Certification Path
The AWS architect path climbs from Foundational to Associate to Professional. SAA-C03 sits in the middle.
| Category | CLF-C02 | SAA-C03 | SAP-C02 | |------|------|------|------| | Level | Foundational | Associate | Professional | | Full Name | Cloud Practitioner | Solutions Architect - Associate | Solutions Architect - Professional | | Main Audience | Any role, including non-technical | Engineers who design AWS solutions | Architects who design complex multi-account and hybrid environments | | Duration | 90 minutes | 130 minutes | 180 minutes | | Questions | 65 | 65 | 75 | | Exam Fee | $100 | $150 | $300 |
The design judgment you build for SAA-C03 extends to larger and more complex environments in the higher-level certifications. To continue on the architect path, move on to the SAP-C02 guide; to broaden toward development or operations, see the DVA-C02 guide and the SOA-C03 guide. If, on the other hand, the AWS service names themselves are unfamiliar, build the foundation first with the Cloud Practitioner guide.
---
Study Roadmap for Beginners
A step-by-step study order for people learning AWS architecture for the first time.
Step 1 (Weeks 1–2): Learn the core services. Start with IAM, VPC, EC2, S3, and RDS. In a practice account, build a VPC yourself and launch instances in public and private subnets.
Step 2 (Weeks 3–4): Resilience and loose coupling. Combine Multi-AZ, load balancers, Auto Scaling, and SQS and SNS, and sketch a structure where the service survives one component going down.
Step 3 (Weeks 5–6): Performance and cost. Put the storage, database, and compute options in a table along two axes: "which workload does it fit?" and "how does the cost change?"
Step 4 (Weeks 7–8): Practice questions and error analysis. Start with the official practice question set on AWS Skill Builder, and for each miss write down why the other options fit the requirements less well.
The most common mistake is skimming past the condition in the question. Often all four options would technically work, and a single phrase such as "most cost-effective," "least operational overhead," or "most highly available" decides the answer. Make a habit of marking that condition first when you read a question.
---
Exam Day Checklist
You take the exam at a Pearson VUE testing center or as an online proctored exam. Before you book, get used to the wording and length of the questions with the official practice question set on AWS Skill Builder.