AWS Solutions Architect Associate Foundations Course
A structured AWS SAA-C03 course covering global infrastructure, compute, storage, networking, databases, data services, security, cost optimization, and solution design with linked practice questions.
What you will learn
- Explain AWS global infrastructure, IAM, VPC basics, and well-architected design principles.
- Select compute, storage, and networking services for resilient architectures.
- Choose databases and data services for performance, durability, and scalability.
- Apply security, identity, and cost optimization best practices.
- Solve scenario questions using architectural patterns and test-day strategy.
Before you start
- Basic AWS or cloud experience is helpful
- Familiarity with EC2, S3, and IAM concepts
- English reading ability for SAA-C03 question practice
Lesson 1 Global Infrastructure and Core Architecture
The SAA-C03 exam expects architects to think globally before choosing services. AWS operates in Regions, which are isolated geographic areas containing two or more Availability Zones; each Availability Zone consists of one or more data centers with independent power, cooling, and networking. Edge locations sit closer to users and support Amazon CloudFront, Route 53, and AWS Shield, reducing latency for global traffic.
IAM (Identity and Access Management) controls every action in AWS. A user is a permanent identity for a person or application, a role is a temporary identity that can be assumed by EC2 instances, Lambda functions, or users from another account, and a policy is a JSON document that grants or denies permissions. The principle of least privilege is central to exam answers.
A VPC is a private, logically isolated network inside AWS. Architects divide it into public and private subnets, control traffic with route tables and security groups, and connect to the internet through an internet gateway or NAT gateway. Most SAA scenarios start by mapping which resources live in which subnets and how traffic flows between them.
Two foundational services appear constantly: Amazon EC2 for resizable virtual servers and Amazon S3 for highly durable object storage. EC2 provides full control over the operating system and applications, while S3 is ideal for static assets, backups, and data lakes because it stores objects in buckets and replicates them across Availability Zones by default.
Finally, every architecture should be evaluated against the six AWS Well-Architected Framework pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Exam questions rarely ask you to name the pillars directly, but they reward solutions that automate operations, secure data, avoid single points of failure, use the right resource size, and minimize unnecessary spend.
Architecture drill: choose regions for latency and compliance, use multiple AZs for availability, and use edge locations with CloudFront for global performance. Name the tradeoffs for each choice.
Example
A media company serves product images and short videos to users across Asia, Europe, and the Americas from one Amazon S3 bucket in a single Region. Users far from that Region experience slow page loads even though the server has spare capacity, because every request crosses a long network path to the same origin.
The correct design keeps Amazon S3 as the durable origin and adds Amazon CloudFront to cache content at edge locations close to users. CloudFront answers repeated requests from the nearest edge, which reduces latency, lowers data transfer from the origin, and keeps the bucket private through an origin access policy. Regions and Availability Zones still matter, because the origin and its replicas remain the source of truth for the cached content.
This combination supports the performance efficiency and cost optimization pillars of the AWS Well-Architected Framework: users receive faster responses and most requests never reach the origin. When an exam scenario asks for global low latency with static content, choose CloudFront plus S3 instead of moving every workload to one Region.
Worked example: A global app uses multi-AZ RDS and CloudFront to serve users with low latency.
Lesson 2 Compute, Storage, and Networking
Amazon EC2 instance families map to workload types: general purpose families such as m, compute optimized families such as c, memory optimized families such as r, and storage optimized families such as i and d. For pricing, choose On-Demand for unpredictable work, Reserved Instances or Savings Plans for steady state, and Spot Instances for flexible, interruption-tolerant workloads. An AMI packages the operating system, software, and configuration needed to launch identical instances.
EBS provides block storage attached to EC2. gp3 is a general purpose SSD for most workloads, io2 Block Express or io1 supports high IOPS databases, st1 is throughput-optimized for frequently accessed data, and sc1 is the lowest-cost cold HDD option. Snapshots are stored in S3 and can be used to migrate or restore volumes.
Amazon S3 offers storage classes that trade cost against access requirements: STANDARD for frequent access, STANDARD-IA and ONEZONE-IA for infrequent data, Intelligent-Tiering for changing patterns, Glacier classes for archive, and Glacier Deep Archive for the lowest-cost long-term storage. Lifecycle policies move objects between classes, and versioning protects against accidental overwrites and deletions.
For delivery and DNS, CloudFront caches content at edge locations to reduce latency, while Route 53 offers routing policies such as simple, weighted, latency-based, geolocation, failover, and multi-value answer. In a VPC, route tables decide where traffic goes, an internet gateway enables public connectivity, a NAT gateway lets private instances reach the internet without exposing them, and security groups as a stateful instance firewall and NACLs as a stateless subnet firewall enforce traffic rules.
Finally, Application Load Balancers route HTTP and HTTPS traffic using host or path rules, Network Load Balancers handle millions of TCP and UDP requests at very low latency, and Auto Scaling launches or terminates instances based on load. A well-designed combination keeps instances replaceable and distributes traffic across multiple Availability Zones.
Service drill: EC2 for resizable compute, Lambda for serverless, ECS/EKS for containers, S3 for objects, EBS for block storage, EFS for shared files, and VPC for networking. Match workload to service.
Example
An e-commerce web application currently runs on one large Amazon EC2 instance with a public IP address in a single Availability Zone. Maintenance and traffic spikes cause downtime, and a zone failure would make the whole site unavailable.
The correct design uses a launch template with EC2 instances in private subnets across two Availability Zones, placed behind an Application Load Balancer. An Auto Scaling group replaces unhealthy instances and adjusts capacity with demand, while security groups control allowed traffic and Amazon Route 53 resolves the alias record to the load balancer. Static assets can be stored in Amazon S3, and root volumes on Amazon EBS keep each instance independent.
This architecture is highly available and elastic: traffic can fail over to the healthy zone, and capacity scales automatically without manual intervention. In the exam, reject single-instance answers and look for the design that distributes compute across multiple AZs behind a load balancer with health checks.
Worked example: A serverless API uses API Gateway, Lambda, and DynamoDB.
Lesson 3 Databases and Data Services
Relational workloads commonly use Amazon RDS, which manages engines such as MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB. Multi-AZ deployments provide high availability with a synchronous standby, while Read Replicas improve read performance and support disaster recovery across Regions. Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, with up to 15 replicas and automatic storage scaling.
For key-value and document data, DynamoDB delivers single-digit millisecond latency at any scale and supports serverless capacity modes, global tables, and on-demand backups. ElastiCache adds an in-memory cache using Redis or Memcached to reduce database load, while Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries.
For analytics and data lakes, Amazon S3 is the standard landing zone for raw data. Services such as AWS Glue, Athena, and EMR catalog, query, and process that data without managing servers. A good data lake design separates raw, curated, and analysis zones so schemas can evolve safely.
Disaster recovery language matters on the exam: RTO is the maximum acceptable downtime, and RPO is the maximum acceptable data loss. Backups, snapshots, and Multi-AZ or cross-Region replication are chosen to meet those targets. DMS migrates databases with minimal downtime, and Snowball physically transfers large datasets when network uploads would be too slow.
Modern workloads are often event-driven: SQS decouples components with durable queues, SNS publishes messages to many subscribers, and Lambda runs code in response to events. This pattern lets each service scale independently, smooths traffic spikes, and avoids tightly coupled integrations.
Data drill: RDS for relational, Aurora for compatible high availability, DynamoDB for NoSQL, ElastiCache for caching, and Redshift for analytics. Choose by access pattern and consistency needs.
Example
A retail company runs order processing on a single Amazon RDS instance and wants automatic failover, room to scale, and a clear backup strategy. A single instance cannot meet these requirements because an instance or Availability Zone failure would stop writes and restore time is unpredictable.
The correct design moves the OLTP workload to Amazon Aurora Multi-AZ for automatic failover and six-way replicated storage, adds Amazon DynamoDB for high-scale serverless key-value access, and uses Amazon ElastiCache to offload repeated reads. For analytics, load Amazon Redshift from an Amazon S3 data lake, while automated backups with defined RTO and RPO protect recovery. AWS DMS or AWS Snowball can migrate data with minimal downtime.
Decouple order events with Amazon SQS, Amazon SNS, and AWS Lambda so each service scales independently. In the exam, match the workload to the service: Aurora or RDS for relational data, DynamoDB for serverless scale, Redshift for analytics, ElastiCache for caching, and S3 for the data lake.
Worked example: Session state fits DynamoDB; complex reporting fits Redshift.
Lesson 4 Security, Identity, and Cost Optimization
Security in AWS starts with IAM. Policies can be attached to users, groups, or roles; resource-based policies such as S3 bucket policies grant access to specific resources, and roles are the preferred way to give EC2 or Lambda access to other AWS services. KMS manages customer master keys and enables encryption for data at rest, while AWS Certificate Manager and Secrets Manager handle TLS certificates and application secrets.
Visibility is equally important. CloudTrail records API activity for auditing, GuardDuty continuously detects threats, and Security Hub aggregates findings and checks security standards. WAF filters malicious web requests, Shield protects against DDoS attacks, and AWS Organizations centralizes accounts, service control policies, and consolidated billing.
Use the shared responsibility model to decide who fixes what: AWS secures the physical infrastructure, network, and managed services, while you secure data, applications, operating systems, and permissions. Encryption in transit and at rest, least privilege, and regular rotation of credentials are the recurring themes in scenario answers.
For cost, Cost Explorer visualizes spending and forecasts, Budgets alert teams before costs exceed limits, and Trusted Advisor flags unused resources and security checks. Compare Savings Plans and Reserved Instances when workloads are predictable, and use Spot Instances or serverless services for flexible demand.
Cost optimization also comes from architecture: right-size instances, stop or delete unused resources, move cold data with lifecycle rules, and use tags for chargeback and filtering. The best answer usually reduces cost without weakening security or availability.
Security drill: use IAM roles for services, least privilege, MFA, KMS for encryption, and CloudTrail for audit. For cost, use Savings Plans, Spot, and rightsizing, and review Trusted Advisor.
Example
A retail company stores customer records in Amazon S3 and needs to enforce least privilege while auditing every access. Long-lived access keys and a single administrator account create unnecessary risk because credentials can be shared and actions are difficult to trace.
The correct design uses IAM roles with scoped policies instead of permanent keys, encrypts data with AWS KMS keys and key policies, and records API activity with CloudTrail. GuardDuty detects suspicious behavior, Security Hub centralizes findings, and WAF plus Shield Advanced protects web workloads from common attacks and DDoS events. AWS Organizations and service control policies let the team enforce guardrails across accounts.
For cost, Cost Explorer and budgets track spend, Trusted Advisor highlights idle resources, and Savings Plans or Reserved Instances reduce predictable compute costs. On the exam, match security scenarios to IAM, KMS, CloudTrail, GuardDuty, or WAF and pair cost scenarios with lifecycle rules, budgets, or Savings Plans.
Worked example: An EC2 role grants access to one S3 bucket without long-term keys.
Lesson 5 Solution Design and Exam Strategy
SAA-C03 is a scenario exam: most questions describe a business requirement and ask you to choose the service or architecture that best meets it. Start by identifying the keywords: low latency, high availability, cost-effective, serverless, encryption, or a requirement that the application must not be modified. The correct answer usually maps directly to one AWS service pattern.
Prefer multi-tier designs that separate the web layer, application layer, and data layer, and make compute stateless so any instance can serve any request. Store sessions in ElastiCache or DynamoDB, place state in S3 or databases, and let Auto Scaling replace instances freely.
For high availability, deploy across at least two Availability Zones, use load balancers, and design for zone failure. For disaster recovery, choose backup and restore when cost matters, pilot light when you can accept a small replica, warm standby for faster failover, and multi-site active-active when downtime must be near zero.
Tradeoff questions ask you to weigh cost, security, performance, and operational effort. If the scenario demands strict compliance, choose encryption and audit services even if they cost more; if the goal is cost savings and the data can tolerate loss, choose cheaper storage and less redundancy. Read the requirement twice before eliminating options.
Use an elimination strategy: remove answers that use the wrong service, violate a stated constraint, or create a single point of failure. Manage time by answering questions you know first, flagging uncertain ones, and saving review time for the end. Practice with full timed sets so pacing becomes automatic.
Scenario drill: read keywords like low latency, high availability, cost effective, serverless, and encrypted, then match the architecture. Use multi-tier designs and name tradeoffs before choosing.
Example
A web application must survive both deployment downtime and the loss of an entire Availability Zone. A single large EC2 instance with an attached EBS volume is a single point of failure and cannot scale independently.
The correct architecture is multi-tier and stateless: Route 53 with alias records, an Application Load Balancer across two Availability Zones, an Auto Scaling group using launch templates in private subnets, Aurora Multi-AZ for relational data, DynamoDB for serverless scale, ElastiCache for caching, and S3 with CloudFront for static assets. Decoupling order events with SQS and processing them with Lambda lets each tier scale independently.
On the exam, translate keywords into services: high availability means multiple AZs and automatic failover, low latency means CloudFront or ElastiCache, serverless means Lambda and DynamoDB, and cost reduction means lifecycle rules or Savings Plans. Eliminate single-instance answers, flag long questions, and keep a steady pace of roughly 90 seconds per question.
Worked example: A static site with global users uses S3, CloudFront, and Route 53.