SAA-C03 cheat sheet

Exam at a glance

Domain weightings

How much of the exam each domain covers. Spend your study time in proportion — the heavier the domain, the more questions you'll see.

Key terms

AWS Well-Architected Framework

The AWS Well-Architected Framework is a set of design principles and best practices organized into pillars — Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. Solutions Architect - Associate questions are framed around these pillars, asking you to choose the design that best satisfies one or more of them.

Amazon VPC

Amazon Virtual Private Cloud (VPC) is a logically isolated section of the AWS Cloud where you launch resources into a virtual network you define. You control subnets, route tables, security groups, and network ACLs, and connect a VPC to the internet, on-premises networks, or other VPCs — the foundation of most secure AWS architectures.

Security Group

A security group is a stateful virtual firewall that controls inbound and outbound traffic for AWS resources such as EC2 instances. Because it is stateful, return traffic for an allowed request is automatically permitted. Security groups allow rules only (no explicit deny), unlike network ACLs which are stateless and support deny rules.

AWS IAM

AWS Identity and Access Management (IAM) lets you control who is authenticated and authorized to use AWS resources. It uses users, groups, roles, and policies, and best practice is to grant least privilege and use roles for temporary, delegated access rather than long-lived credentials — a core theme of the Design Secure Architectures domain.

Amazon S3

Amazon Simple Storage Service (S3) is an object storage service offering high durability and multiple storage classes (Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier tiers) for different access patterns. Lifecycle policies move objects between classes to optimize cost, making S3 central to both high-performing and cost-optimized storage design.

Amazon EBS

Amazon Elastic Block Store (EBS) is a block-storage service providing volumes attached to EC2 instances. Volume types range from general-purpose SSD (gp3) to provisioned-IOPS SSD (io2) for high-performance workloads and throughput-optimized HDD for large sequential access. Choosing the right volume type is a common performance-and-cost trade-off on the exam.

Auto Scaling

Amazon EC2 Auto Scaling automatically adjusts the number of instances in a group to match demand, using scaling policies and health checks to add or replace instances. It underpins both resilient designs (self-healing, multi-AZ) and cost-optimized designs (scaling in when demand drops so you pay only for what you need).

Elastic Load Balancing

Elastic Load Balancing (ELB) distributes incoming traffic across multiple targets such as EC2 instances and containers. The Application Load Balancer operates at layer 7 (HTTP/HTTPS) with content-based routing, while the Network Load Balancer operates at layer 4 for extreme performance. ELB combined with Auto Scaling across Availability Zones is the classic highly available pattern.

Amazon SQS

Amazon Simple Queue Service (SQS) is a fully managed message queue that decouples the components of a distributed system. Producers send messages to a queue and consumers process them independently, so a spike or failure in one component does not overwhelm another — the canonical example of a loosely coupled, resilient architecture.

Amazon RDS

Amazon Relational Database Service (RDS) is a managed service for relational databases (including Amazon Aurora, MySQL, PostgreSQL, and others) that handles patching, backups, and failover. Multi-AZ deployments provide a standby for high availability, while read replicas scale read traffic — both frequently tested resilience and performance options.

Amazon DynamoDB

Amazon DynamoDB is a fully managed NoSQL key-value and document database delivering single-digit-millisecond performance at any scale. It offers on-demand and provisioned capacity modes, and features such as global tables and DynamoDB Accelerator (DAX) caching. Choosing DynamoDB versus a relational database is a recurring design decision on the exam.

Amazon CloudFront

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations close to users to reduce latency. It integrates with S3 and custom origins and with AWS WAF and Shield for edge security. CloudFront appears in both high-performing (low latency) and cost-optimized (reduced origin data transfer) architecture answers.

AWS KMS

AWS Key Management Service (KMS) is a managed service that creates and controls the cryptographic keys used to encrypt data across AWS services. It supports encryption at rest for services like S3, EBS, and RDS, integrates with IAM for key access policies, and enables key rotation — the backbone of the data-security controls in the Design Secure Architectures domain.