AWS SAA-C03 Cheat Sheet 2026: Complete Domain Summary

The AWS Solutions Architect Associate (SAA-C03) is one of the most popular and respected cloud certifications. This cheat sheet covers all four exam domains with the key services, architecture patterns, and decision points you must memorize before exam day. Bookmark this and review it in your final week.

Domain 1: Design Secure Architectures (30%)

The largest domain. You must know how to secure every layer: identity, network, data, and application. Focus on IAM policies, VPC security, encryption, and AWS KMS. Scenario questions will describe a requirement and ask which service or configuration to use.

• IAM: Users, Groups, Roles, Policies. Use roles for cross-account access and EC2 access (never embed keys). Least privilege always.
• Security Groups: Stateful firewall at the resource level. Allow rules only. All rules evaluated before decision.
• NACLs: Stateless firewall at subnet level. Allow and deny rules. Processed in order (lowest number first).
• VPC Endpoints: PrivateLink (interface) or Gateway (S3, DynamoDB). Keep traffic within AWS network.
• KMS: Managed encryption keys. Envelope encryption. Customer Managed Keys vs AWS Managed Keys.
• CloudHSM: Dedicated hardware security module. FIPS 140-2 Level 3. For compliance requiring dedicated HSM.
• Secrets Manager: Rotate and retrieve secrets (DB credentials, API keys). Integrates with RDS, Redshift.
• WAF: Web Application Firewall. Layer 7. SQL injection, XSS, geo-blocking. Attached to ALB, API Gateway, CloudFront.
• Shield: Standard (free, Layer 3/4 DDoS). Advanced (paid, Layer 7, DDoS response team).
• Macie: ML-based S3 data discovery. Finds PII automatically.
• GuardDuty: Threat detection service. Analyzes CloudTrail, VPC Flow Logs, DNS logs.
• Inspector: Automated vulnerability scanning for EC2 and container images.
• Encryption at rest: EBS (KMS), S3 (SSE-S3/SSE-KMS/SSE-C), RDS (KMS), EFS (KMS), DynamoDB (KMS).
• Encryption in transit: TLS/SSL everywhere. ACM (Certificate Manager) for managed certificates.

Domain 2: Design Resilient Architectures (26%)

Resilience means surviving failures. You must know multi-AZ vs multi-region patterns, auto-scaling, load balancing, disaster recovery strategies, and decoupled architectures. The exam loves scenarios about a company that needs to survive an AZ outage or reduce RTO/RPO.

• Multi-AZ: Automatic failover across 2+ AZs. RDS Multi-AZ, ALB across AZs, Auto Scaling Groups.
• Multi-Region: Active-active (Route 53 latency-based routing) or active-passive (Route 53 failover routing). For RPO near zero.
• Auto Scaling: Scale out/in based on CloudWatch alarms. Scale up/down = bigger instance (not the same).
• ALB: HTTP/HTTPS. Path-based and host-based routing. Sticky sessions. Integrates with ECS, Lambda, EC2.
• NLB: TCP/UDP. Ultra-low latency. Static IPs per AZ. Preserve source IP.
• SQS: Decouple components. Standard (at-least-once, unlimited throughput) vs FIFO (exactly-once, 300 msg/s).
• SNS: Pub/sub. Fan-out pattern: SNS → multiple SQS queues. Push to email, SMS, Lambda, HTTP.
• EventBridge: Event bus. Schedule rules (cron). Schema registry. Content-based filtering.
• DR Strategies (in order of cost): Backup & Restore (cheapest, highest RTO) → Pilot Light → Warm Standby → Multi-Site Active-Active (most expensive, lowest RTO).
• S3 Cross-Region Replication: Requires versioning. Replicates to a different region. For DR and compliance.
• RDS Multi-AZ: Synchronous replication to standby in different AZ. Automatic failover. Not for scaling reads.
• RDS Read Replica: Asynchronous replication. For read scaling. Can be in a different region (cross-region read replica).
• Elasticache: Redis (Multi-AZ, replication) vs Memcached (multi-node, no replication). For caching and session state.

Domain 3: Design High-Performing Architectures (22%)

Performance means choosing the right service and configuration for the workload. You must know storage options, database selection, compute optimization, and caching strategies. Expect scenarios describing latency requirements or throughput needs.

• EC2 Instance Types: General (t3, m5), Compute (c5), Memory (r5, x1), Storage (i3), GPU (p4, g5). Pick by workload.
• EBS Volume Types: gp3 (general, 16000 IOPS), io2 Block Express (256K IOPS, highest perf), st1 (throughput), sc1 (cold).
• Instance Store: Ephemeral storage. Fastest I/O. Data lost on stop/termination. For caches, buffers, temp data.
• S3 Transfer Acceleration: Fast file upload over long distances. Uses CloudFront edge locations.
• CloudFront: CDN. Cache at edge. For static content, dynamic content, and video streaming.
• Aurora: 5x MySQL, 3x PostgreSQL throughput. Up to 15 read replicas. Global Database for multi-region (sub-second replication).
• DynamoDB: Single-digit ms latency. DAX for microsecond caching. On-demand vs provisioned capacity.
• ElastiCache: Redis for complex caching, sorted sets, pub/sub. Memcached for simple key-value caching.
• Kinesis Data Streams: Real-time data streaming. Shards = throughput units. For logs, IoT, click streams.
• Step Functions: Orchestrate Lambda and other services. State machines. Retry logic. Long-running workflows.
• Lambda: 15 min max timeout. 10 GB /tmp. Provisioned concurrency for cold start elimination. Memory 128 MB - 10 GB.

Domain 4: Design Cost-Optimized Architectures (22%)

Cost optimization means choosing the cheapest option that meets the requirements. You must know pricing models, Reserved Instances vs Savings Plans, Spot usage, and which storage/database tier is most cost-effective for a given workload.

• Reserved Instances: 1 or 3 year commit. Standard (up to 72% off) vs Convertible (up to 54% off, can change attributes).
• Savings Plans: Commit to $/hour spend. Compute SP (EC2 + Fargate + Lambda) or EC2 Instance SP.
• Spot Instances: Up to 90% off. For batch, stateless, fault-tolerant workloads. 2-minute warning on reclamation.
• S3 Lifecycle Rules: Transition to cheaper tiers over time. Standard → IA → Glacier → Deep Archive.
• S3 Intelligent-Tiering: Auto-moves objects between tiers based on access patterns. Small monitoring fee.
• Cost Explorer: Visualize spending. Forecast future costs. Filter by service, tag, account.
• Budgets: Alert when spending exceeds threshold. Can trigger Lambda via SNS.
• Compute Optimizer: ML-based recommendations for right-sizing EC2, EBS, Lambda.
• NAT Gateway vs NAT Instance: NAT Gateway is managed and more reliable but costs more. NAT Instance is cheaper but you manage it.
• Aurora Serverless: Auto-scales capacity up/down. Pay per use. For unpredictable workloads.
• Fargate vs EC2 for ECS: Fargate = pay per container, no management. EC2 = pay per instance, more control, cheaper at scale.

Storage Decision Tree

Database Selection Guide

Frequently Asked Questions