AWS

9 units, 29 lessons and 77 questions on AWS. Includes a full-length SAA-C03 mock exam drawn in the published domain weights, marked with a per-domain breakdown. Free, and open without an account.

The exam it prepares for: AWS Certified Solutions Architect – Associate (SAA-C03), 65 questions in 130 minutes, pass 720 of 1000 (scaled).

What is in it

The shape of it

Regions, zones, and what an account actually is.

  • Regions and Availability Zones — A Region is a geographic area with several isolated Availability Zones. Most services are regional; a few, such as IAM and CloudFront, are global. Data does not leave a Region unless you move it.
  • Accounts as a blast radius — An account is the strongest isolation boundary AWS has. Organisations group accounts, and Service Control Policies set the ceiling on what any of them can do.

Identity

The part that is worth learning properly before anything else.

  • Roles rather than keys — A role is assumed and gives temporary credentials. A long-lived access key sits in a file waiting to leak. Anything running on AWS should be using a role.
  • Least privilege in practice — Start from nothing and add what breaks. IAM Access Analyzer can generate a policy from what a principal actually used, which beats guessing.

Compute and storage

Choosing between things that all look like they would work.

  • EC2, ECS, Lambda — EC2 gives you a machine and the duty of caring for it. ECS and EKS run containers. Lambda runs a function per event with no server to mind and a hard execution limit.
  • S3 storage classes — Standard for hot data, Infrequent Access for data read rarely, Glacier tiers for archives, Intelligent-Tiering when you do not know the access pattern.

Networking

The VPC, and the two ways out of it.

  • Public and private subnets — A subnet is public because its route table sends 0.0.0.0/0 to an internet gateway. A private subnet reaches out through a NAT gateway, which costs money per hour and per gigabyte.
  • Security groups against NACLs — A security group is stateful and attaches to a resource; return traffic is allowed automatically. A network ACL is stateless, applies to a whole subnet, and needs rules in both directions.

The bill

Where the money goes, and the lines nobody predicts.

  • Data transfer is the surprise — Traffic into AWS is generally free. Traffic out to the internet is charged, and so is traffic between Availability Zones. An architecture that crosses zones on every request pays for it.
  • Committing for a discount — On-demand is the list price. Savings Plans and Reserved Instances trade a one or three year commitment for a large discount. Spot is far cheaper and can be taken away with two minutes' notice.
  • The Well-Architected Framework — Six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. The value is in the questions it makes you answer.

Domain 1 · Design Secure Architectures

Access to resources, secure workloads, and data protection. The largest domain on the paper: 30% of scored content.

  • Identity across accounts — Roles, not users, are how AWS expects one thing to act as another. An application on EC2 assumes an instance profile; a person from another account assumes a role; IAM Identity Center federates humans from a directory. Long-lived access keys are the fallback of last resort.
  • Network segmentation in a VPC — Security groups are stateful and attach to an ENI; network ACLs are stateless and attach to a subnet. Private subnets reach the internet through a NAT gateway, and reach AWS services without one through VPC endpoints.
  • Protecting data at rest and in transit — KMS holds the keys and logs their use; ACM issues and rotates the certificates that protect data in transit. Which key policy applies, and who can use the key, is a separate question from who can read the object.
  • Secrets, and what edge protection buys — Secrets Manager rotates credentials and costs per secret; Parameter Store is cheaper and does not rotate on its own. Shield Standard is automatic; WAF inspects requests; Shield Advanced adds response support and cost protection.
  • More on secure access — Further practice on identity, endpoints and the shared responsibility model.

Domain 2 · Design Resilient Architectures

Loose coupling, high availability and the disaster recovery strategies. 26% of scored content.

  • Decoupling with queues and topics — SQS holds work until a consumer is ready; SNS fans one message out to many subscribers; EventBridge routes on the content of an event. A queue in front of a slow consumer turns a spike into a backlog rather than an outage.
  • Highly available data tiers — A Multi-AZ RDS deployment is about surviving a zone failure, not about serving more reads; read replicas are the opposite. Aurora separates the two more cleanly than the older engines.
  • Choosing a disaster recovery strategy — Backup and restore, pilot light, warm standby, and multi-site active-active, in ascending order of cost and descending order of recovery time. The requirement is always stated as RPO and RTO.
  • Health checks, failover and self-healing — Route 53 health checks move traffic between Regions; load balancer health checks remove an instance from rotation; Auto Scaling replaces it. Each layer heals a different failure.
  • More on resilience — Further practice on stateless design, replication and graceful degradation.

Domain 3 · Design High-Performing Architectures

Storage, compute, database and network choices made for performance, plus data ingestion. 24% of scored content.

  • Picking the storage service — S3 for objects, EBS for a disk attached to one instance, EFS for a POSIX file system many instances share, FSx for Windows or Lustre workloads. The access pattern decides, not the size.
  • Caching, and where to put it — CloudFront caches at the edge for users far from the origin; ElastiCache caches in the Region for the database; DAX caches in front of DynamoDB. Each removes a different bottleneck.
  • Compute that matches the workload — Lambda for short event-driven work, Fargate for containers without servers, EC2 when you need the host, Batch for queued jobs. The 15-minute Lambda limit and the cold start decide more exam questions than anything else.
  • More on performance — Further practice on throughput, partitioning and data movement.

Domain 4 · Design Cost-Optimized Architectures

Storage, compute, database and network chosen for cost. 20% of scored content, and the domain where the right answer is usually the least clever one.

  • Paying less for compute — On-Demand for the unpredictable, Savings Plans or Reserved Instances for the steady baseline, Spot for the interruptible. Most real savings come from turning things off, not from a better rate.
  • Storage and data transfer costs — Storage classes and lifecycle rules manage the cost of keeping data. Data transfer out of AWS, and between Availability Zones, is the line item most designs forget.
  • Seeing the bill before it arrives — Cost Explorer for what happened, Budgets for alerts before it repeats, cost allocation tags for who spent it, and Compute Optimizer for what is oversized.
  • More on cost — Further practice on the choices that decide a bill.

Open the AWS course · sit the SAA-C03 mock exam · try 10 practice questions first