AWS10 min read
AWS SAA-C03 Cheat Sheet: Key Services by Exam Domain (2026)
Use this as your final-review sheet before the AWS Certified Solutions Architect – Associate exam. It’s organized by the four exam domains, with the one-line decision trigger for each service — because the exam doesn’t ask "what is X," it asks "which one do you pick when."
Design Secure Architectures (30%)
| Service / Feature | Decision trigger |
|---|---|
| IAM roles | EC2/Lambda needs AWS access — never use access keys on compute |
| IAM policies (identity vs resource) | Cross-account or cross-service access → resource policies |
| Service Control Policies (SCPs) | Preventative guardrails across an Organization — deny API actions centrally |
| AWS KMS (SSE-KMS, CMKs) | Encryption with customer-managed keys; CloudHSM when AWS must never hold key material |
| S3 Block Public Access | The first answer to any "prevent public buckets" question |
| AWS WAF | Layer-7 filtering (SQLi, XSS), rate-based rules for HTTP floods |
| AWS Shield Standard / Advanced | DDoS protection; Advanced adds 24/7 response team |
| Amazon GuardDuty | Threat detection (findings) — detective, not preventative |
| AWS Config | Detective compliance — finds misconfigurations after the fact |
| Security groups (stateful) vs NACLs (stateless) | SGs for instances; NACLs for subnet-level stateless filtering (remember return-traffic rules) |
| VPC endpoints (Gateway vs Interface) | Private S3/DynamoDB access → Gateway (free); other services → Interface (PrivateLink, hourly cost) |
Design Resilient Architectures (26%)
| Service / Feature | Decision trigger |
|---|---|
| Multi-AZ (RDS, ALB, NAT) | Survive an AZ failure automatically |
| Auto Scaling groups | Replace failed instances; span ≥2 AZs |
| Application Load Balancer | HTTP routing, inherently multi-AZ — you never need two ALBs |
| Route 53 failover routing | DNS-level failover between regions |
| Amazon S3 Cross-Region Replication | Async copy of S3 objects to another region |
| AWS Backup | Centralized backup policies, incl. cross-account via Organizations |
| RDS Multi-AZ (standby) vs Read Replica | HA/failover → Multi-AZ; read scaling/reporting offload → replica |
| DR strategies | Backup & restore (cheapest, slowest) → Pilot light → Warm standby → Multi-site (priciest, fastest) |
| SQS dead-letter queues | Isolate poison-pill messages that repeatedly fail processing |
Design High-Performing Architectures (24%)
| Service / Feature | Decision trigger |
|---|---|
| Amazon CloudFront | Global content delivery, edge caching, signed URLs for private content |
| ElastiCache (Redis/Memcached) | In-memory caching in front of RDS/DynamoDB |
| DynamoDB DAX | Microsecond reads on DynamoDB without app changes |
| DynamoDB Global Tables | Active-active multi-region DynamoDB |
| RDS Read Replicas | Offload reporting/reads from the primary (minimal app change) |
| Aurora Serverless v2 | Spiky/unpredictable DB workloads; scales to zero when idle |
| Kinesis Data Firehose | Streaming data → S3/Redshift with batching and format conversion, zero consumer management |
| SQS / SNS / EventBridge | Decoupling: queues (polling), topics (fan-out), event bus (routing rules) |
| AWS AppSync | Managed GraphQL — aggregate multiple data sources behind one API |
Design Cost-Optimized Architectures (20%)
| Service / Feature | Decision trigger |
|---|---|
| S3 storage classes | Hot → Standard; infrequent → Standard-IA; archive → Glacier Instant/Flexible/Deep Archive (cheapest, for 7-year retention) |
| S3 Lifecycle policies | Automate transitions and expiry — the answer to any "reduce storage cost over time" question |
| EC2 Spot Instances | Fault-tolerant, interruptible batch work — up to 90% off |
| Savings Plans / Reserved Instances | Steady-state 1–3 year commitments |
| AWS Graviton | 20–40% better price-performance for EC2/RDS — the "cheapest performant" answer |
| RDS Proxy | Connection storms from Lambda/serverless — pools and shares connections |
| gp3 vs gp2/io2 | gp3: cheaper baseline with provisioned IOPS; io2: sustained ultra-high IOPS with a cost premium |
| Instance Scheduler | Dev/test instances that only run business hours |
The five most-tested distinctions
- Preventative vs detective: SCPs and Block Public Access prevent; Config and GuardDuty detect.
- Multi-AZ vs Read Replica: availability vs read scaling. The exam mixes these deliberately.
- Gateway vs Interface endpoints: S3/DynamoDB → Gateway (free); everything else → Interface.
- Firehose vs Data Streams: managed delivery with S3 batching → Firehose; custom consumers → Streams.
- Cheapest that meets constraints: when two answers work, the exam usually wants the most cost-effective one — read for the word "cost-effective."
Frequently asked questions
- What should I memorize for the SAA-C03?
- Don’t memorize — internalize the decision triggers above. The exam presents scenarios; you pick the service that fits the constraints.
- Which S3 storage class is cheapest?
- S3 Glacier Deep Archive — for data accessed once or twice a year with long retention (e.g., 7-year compliance archives).
- What’s the difference between WAF and Shield?
- WAF filters Layer-7 web attacks (SQL injection, XSS, rate limiting). Shield protects against DDoS at Layers 3/4 (Standard, always on) with Advanced adding response-team support.
- How do I remember all the EC2 pricing models?
- On-Demand (no commitment) → Spot (interruptible, cheapest) → Reserved/Savings Plans (1–3 yr commitment, steady workloads). Match the workload pattern to the model.
Test yourself on these with free AWS SAA-C03 sample questions — exam-style with full explanations, no signup.
Take the free sample quiz