AWS Certified Solutions Architect – Associate (SAA-C03)
The most widely held cloud architecture certification, testing whether you can design secure, resilient, high-performing and cost-optimised solutions on AWS against the Well-Architected Framework.
- src
- AWS Certification — AWS Certified Solutions Architect – Associate page (aws.amazon.com/certification)
- chk
The SAA-C03 is the most widely held cloud architecture certification, and the most widely misunderstood. It does not test whether you can build things on AWS. It tests whether you can choose between four options that would all work.
What the weights tell you to study
Security is 30%, the single largest domain, and it is not a security exam. That weight is AWS saying that most wrong answers on this exam are wrong because they leak, over-permit or fail to encrypt something — not because they do not function. Resilience follows at 26%, so more than half the marks sit in "will it survive, and is it locked down".
Cost optimisation is the smallest domain at 20% and the one candidates neglect hardest, which is a mistake: cost questions are the most mechanical on the exam. Storage class and instance purchasing model questions have correct answers you can derive rather than recall.
What the exam is actually like
Every option is plausible. Questions are scenarios with four answers that are technically capable of the outcome. One is best against a stated constraint — cheapest, most available, least operational overhead — and finding that constraint in the question stem is the actual skill. Read the last sentence of the stem first.
"Least operational overhead" means managed. When a question uses that phrase, it is pointing at the managed service. This single pattern decides a surprising share of the exam.
15 of the 65 questions are unscored and indistinguishable from the rest. You cannot know which, so spend no time trying — but it does mean a question that seems unfairly obscure may not count.
130 minutes for 65 questions is two minutes each, which is comfortable compared with performance-based exams. Time pressure is not the failure mode here; misreading the constraint is.
Where the marks are lost
VPC design. Subnets, route tables, NAT gateways, security groups versus NACLs — these appear across all four domains rather than in a domain of their own, so a weak VPC model costs marks everywhere. Draw the traffic path by hand until it is automatic.
The other reliable loss is picking the technically superior answer over the one matching the stated constraint. An architecture with better durability is wrong if the question asked for lowest cost.
Before you book
720 out of 1,000 scaled, three years' validity, $150. AWS recommends a year of hands-on experience; it is achievable without that if you build in a free-tier account, because the exam rewards decision-making over muscle memory.
Take timed practice exams rather than reading more. The gap between knowing AWS and answering AWS questions closes only by answering questions.
New to Linux and the command line?
This path assumes fundamentals you may not have yet. Our Foundations Pack is out and free — Linux, the shell and Git, with exercises that mark your work and explain why you got it wrong. We're writing an agents pack next; leave your email if you want to hear when it ships.
One email when the pack launches. No spam, unsubscribe any time.
Exam domains
Design Secure Architectures
30%Design Resilient Architectures
26%Design High-Performing Architectures
24%Design Cost-Optimized Architectures
20%Preparation path
- 1
Read the official exam guide before any course
The exam guide lists the four domains, their weightings and every task statement AWS may test. It is the only authoritative scope document, and reading it first stops you studying services that are explicitly out of scope. Note that Domain 1 alone is 30% of the scored content — security is the largest single block.
~3 hours - 2
Work through the Well-Architected Framework
The exam explicitly validates your ability to design against the Well-Architected Framework, and its six pillars map almost directly onto the four exam domains. Read the security, reliability, performance efficiency and cost optimisation pillars in full — the exam's preferred answer is usually the one the framework recommends.
~15 hours - 3
Build the core services rather than reading about them
Most failures come from candidates who recognise service names but have never wired two together. Build a VPC by hand, put a load balancer in front of an Auto Scaling group, attach an RDS instance in a private subnet, and break each one on purpose. A free tier account covers nearly all of this.
~40 hours - 4
Drill the decision patterns the exam actually tests
Questions are scenario-based and almost never ask what a service does. They ask which of four workable options is cheapest, or most resilient, or most secure. Practise reading the qualifier in the question stem first — 'most cost-effective' and 'highest availability' select different correct answers from identical scenarios.
~20 hours - 5
Sit a timed full-length practice exam
130 minutes for 65 questions is about two minutes each, and the long scenario stems consume that quickly. Take at least one full practice exam under timed conditions before booking. Scoring is compensatory — you need 720 overall and do not have to pass each domain individually.
~8 hours
Frequently asked questions
Career Roadmaps
- Cloud Architect RoadmapA path into cloud architecture as the job it actually is — trade-off analysis, migration of systems you did not write, disaster recovery you have rehearsed, decision records, and influence without formal authority.
- Cloud Security Engineer RoadmapA path into cloud security as an engineering discipline, covering the shared responsibility model, identity, network segmentation, encryption, workload hardening, detection, governance as code, threat modelling and incident response.
- FinOps Engineer RoadmapA career path into cloud financial engineering, covering billing data, cost allocation, unit economics, rate and usage optimisation, forecasting, Kubernetes cost, and policy automation.
- Database Reliability Engineer RoadmapA path into database reliability engineering — replication and consistency, restores you have actually verified, zero-downtime schema migrations, corruption detection, databases on Kubernetes, and RTO and RPO as a contract.