AWS Certified Solutions Architect – Associate (SAA-C03) Exam-Day Cheat Sheet
High-yield architectural comparison matrices, storage tiering lifecycles, database selection tradeoffs, disaster recovery RTO/RPO targets, and VPC networking topologies for the AWS SAA-C03 certification examination. Memorize these core architectural patterns before test day.
📌 Quick Summary / Core Test Principles:SAA-C03 Quick Rules: Storage: S3 Intelligent-Tiering for unpredictable access (no retrieval fee); S3 Standard-IA for min 30-day backups (retrieval fee); S3 Glacier Deep Archive ($0.00099/GB) for 7-10 yr compliance; Databases: Aurora for high-performance SQL (6-way multi-AZ, global db <1s lag); RDS Multi-AZ for synchronous HA (RPO=0, standby cannot read); DynamoDB for high-throughput NoSQL (DAX for microsecond reads); ElastiCache Redis for sorted sets/leaderboards/multi-AZ; Networking: Gateway Endpoints for S3/DynamoDB are FREE (no NAT fee!); Transit Gateway for hub-and-spoke transitive routing; Global Accelerator for Anycast TCP/UDP non-HTTP; Security: SCPs set the maximum boundary across OUs; Security Groups are stateful (instance layer); NACLs are stateless (subnet layer, needs ephemeral ports 1024-65535); DR: Pilot Light keeps live DB replica only, minimal/no compute.
Object Storage
Amazon S3 Storage Classes & Lifecycle Matrix
| Storage Class | Min Duration | Min Size | Retrieval Time | Retrieval Fee | Availability (SLA) | Primary Workload Fit |
|---|---|---|---|---|---|---|
| S3 Standard | None | None | Immediate (ms) | $0 (Free) | 99.99% (99.9%) | Active, frequently accessed web assets, mobile media, and dynamic big data lakes. |
| S3 Intelligent-Tiering | None | None (No auto-tier <128KB) | Immediate (ms) | $0 (Free) | 99.9% (99.0%) | Data with unknown, changing, or unpredictable access patterns with zero retrieval fees. |
| S3 Standard-IA | 30 days | 128 KB | Immediate (ms) | Yes (Per GB) | 99.9% (99.0%) | Long-term data, backups, and disaster recovery files accessed less than once a month. |
| S3 One Zone-IA | 30 days | 128 KB | Immediate (ms) | Yes (Per GB) | 99.5% (99.0%) | Infrequently accessed, easily recreatable secondary backups (saves 20% vs Standard-IA). |
| S3 Glacier Instant | 90 days | 128 KB | Immediate (ms) | Yes (Per GB) | 99.9% (99.0%) | Archived medical images, news footage, or regulatory records accessed once per quarter. |
| S3 Glacier Flexible | 90 days | None | Expedited: 1-5m Standard: 3-5h Bulk: 5-12h | Yes (Per GB) | 99.99% (99.9%) | Regulatory archives, audit logs, and compliance records retrieved infrequently within hours. |
| S3 Glacier Deep Archive | 180 days | None | Standard: 12h Bulk: 48h | Yes (Per GB) | 99.99% (99.9%) | 7-10 year compliance WORM retention (lowest-cost cloud storage at $0.00099/GB-month). |
💡 Pro Tip:All S3 storage classes (except One Zone-IA) provide 99.999999999% (11 9's) durability across >= 3 Availability Zones. Objects < 128 KB do not benefit from IA/Glacier transitions due to minimum charge limits.
Database Systems
AWS Database Engine Selection & Architecture Matrix
| Database Engine | Data Model | Storage & Scaling | High Availability & Failover | Typical Latency | SAA-C03 Decision Trigger |
|---|---|---|---|---|---|
| Amazon Aurora | Relational (MySQL / PostgreSQL) | Auto-scales to 128 TiB; 6-way replication across 3 AZs | Sub-minute failover to read replica; Aurora Global DB for cross-region DR (<1s lag) | Single-digit ms | High-performance enterprise transactional SQL; auto-scaling read replicas; global low latency. |
| Amazon RDS Multi-AZ | Relational (Oracle, MS SQL, MariaDB, etc.) | Provisioned EBS (gp3, io2); manual or auto-increase | Synchronous replication to standby instance in 2nd AZ; automated DNS CNAME failover (60-120s) | Single-digit ms | Standard commercial or open-source relational SQL requiring high availability and zero data loss. |
| Amazon DynamoDB | NoSQL (Key-Value & Document) | Fully managed; On-Demand or Provisioned with auto-scaling | Synchronous multi-AZ replication; Global Tables for multi-region active-active (<1s lag) | Single-digit ms (Microseconds with DAX) | Massive scale, high write throughput, serverless web/mobile backends, session stores, IoT state. |
| Amazon ElastiCache (Redis) | In-Memory Data Store | In-memory RAM; cluster mode with sharding up to 500 nodes | Multi-AZ replication with automatic failover and read replicas; snapshot backups | Sub-millisecond | In-memory caching, gaming leaderboards (sorted sets), pub/sub messaging, session caching. |
| Amazon Redshift | Columnar OLAP Data Warehouse | RA3 nodes with managed storage up to 128 TB/node; Aqua caching | Cluster snapshot replication across AZs/regions; Concurrency Scaling | Seconds (Complex analytical queries) | Petabyte-scale enterprise business intelligence, complex analytical aggregation, data warehousing. |
| Amazon DocumentDB | NoSQL (Document / JSON) | Aurora storage architecture (6 copies across 3 AZs, up to 128 TiB) | Sub-minute failover to read replica; 15 read replicas | Single-digit ms | MongoDB-compatible workloads requiring managed multi-AZ scaling and enterprise backups. |
💡 Pro Tip:Use RDS Multi-AZ for synchronous disaster recovery (standby does not accept read queries); use RDS Read Replicas for asynchronous horizontal read scaling.
Business Continuity
Disaster Recovery (DR) Strategies & RTO/RPO Spectrum
| DR Strategy Tier | RTO Target | RPO Target | Infrastructure in Secondary Region | Relative Cost | Core Implementation Mechanics |
|---|---|---|---|---|---|
| 1. Backup & Restore | Tens of hours | Hours | None (Data backups/snapshots stored in S3/Glacier) | $ (Lowest) | AWS Backup cross-region copy, Amazon S3 Cross-Region Replication, CloudFormation recovery. |
| 2. Pilot Light | Tens of minutes | Minutes | Minimal core running (live database replica only; zero compute) | $$ | Aurora Global Database / RDS cross-region replica running; EC2 launch templates / AMIs pre-staged. |
| 3. Warm Standby | Minutes | Seconds | Scaled-down active fleet running in parallel | $$$ | Scaled-down ASG and minimal RDS instance serving shadow traffic; scales out to 100% on failover. |
| 4. Multi-Site Active-Active | Zero (Real-time) | Zero | Full production capacity running 24/7 across both regions | $$$$ (Highest) | Route 53 Geolocation/Latency routing, Aurora Global Database / DynamoDB Global Tables. |
💡 Pro Tip:Remember the trade-off: As RTO (recovery time) and RPO (data loss) approach zero, operational complexity and infrastructure costs increase exponentially.
Cloud Networking
VPC Interconnectivity & Hybrid Networking Matrix
| Networking Technology | Routing Type | Bandwidth Capability | Data Path & Encryption | Transitive? | Primary Architecture Scenario |
|---|---|---|---|---|---|
| VPC Peering | Point-to-point (Direct) | No bandwidth bottleneck (Uses AWS fabric) | Private AWS backbone (Traffic stays internal) | No (Non-transitive) | Simple, high-throughput 1-to-1 VPC interconnection with zero gateway hourly fees. |
| AWS Transit Gateway | Hub-and-spoke centralized router | Up to 50 Gbps per VPC attachment (ECMP up to mult-hundred Gbps) | Private AWS backbone (Supports Transit Gateway encryption) | Yes (Transitive routing) | Interconnecting 10+ VPCs across accounts and routing shared on-premises Direct Connect/VPNs. |
| AWS Direct Connect | Dedicated physical fiber connection | 1 Gbps, 10 Gbps, or 100 Gbps dedicated ports | Private dedicated Ethernet circuit (Add MACsec / VPN for encryption) | Via Transit Gateway | High-volume hybrid enterprise data transfer requiring consistent sub-10ms latency and zero ISP jitter. |
| AWS Site-to-Site VPN | IPsec tunnel over public internet | Up to 1.25 Gbps per tunnel (Scale via ECMP) | Encrypted IPsec tunnels over public internet | Via Transit Gateway | Quick, cost-effective hybrid connectivity or immediate backup connection for Direct Connect. |
| VPC Gateway Endpoint | VPC Route table entry (Prefix list) | Scales automatically with AWS fabric | Internal AWS private network | No (VPC only) | Free, high-speed private access to Amazon S3 and Amazon DynamoDB without NAT Gateways. |
| VPC Interface Endpoint (PrivateLink) | Elastic Network Interface (ENI) with private IP | Up to 45 Gbps per ENI (Auto-scales) | Internal AWS network (Supports cross-account and Direct Connect) | Yes (Over DX/VPN) | Secure private access to AWS services (SQS, SNS, Secrets Manager, etc.) or SaaS vendor applications. |
💡 Pro Tip:VPC Gateway Endpoints are FREE and only support S3 and DynamoDB; Interface Endpoints (PrivateLink) support all other services but charge hourly plus per-GB data processing fees.
Compute Systems
AWS Compute Selection & Serverless Architecture Matrix
| Compute Platform | Execution Duration | Scaling Velocity | Filesystem Persistence | Pricing Model | SAA-C03 Decision Rule |
|---|---|---|---|---|---|
| Amazon EC2 | Indefinite (24/7/365) | Minutes (Auto Scaling Group launch lifecycle) | Persistent EBS or ephemeral NVMe Instance Store | On-Demand, Savings Plans, Spot Instances | Legacy monolithic applications, custom OS kernels, GPU training, commercial licensed software. |
| AWS Fargate (ECS / EKS) | Indefinite | Seconds to minutes (Container image pull) | Ephemeral task storage (up to 200 GB) or persistent EFS/EBS | Per vCPU-second and per GB-second | Microservices, Docker containers without server management, batch jobs, background workers. |
| AWS Lambda | Max 15 minutes | Milliseconds (Sub-second burst) | Ephemeral /tmp (up to 10 GB) or persistent Amazon EFS mount | Per millisecond of execution and request count | Event-driven microservices, S3 upload processing, API Gateway backends, DynamoDB Stream triggers. |
| AWS Batch | Hours to days | Scales EC2 / Fargate fleets dynamically | EBS or shared Amazon EFS / FSx | Underlying EC2/Fargate costs (Zero Batch service fee) | Containerized scientific batch computing, parameter sweeps, and distributed video transcoding. |
| AWS App Runner | Indefinite | Seconds (Fully managed container scaling) | Ephemeral | Per vCPU-hour and memory consumed | Fully managed PaaS for web applications and APIs directly from container images or source code. |
💡 Pro Tip:Lambda memory allocation (128 MB to 10,240 MB) proportionally scales CPU power and network bandwidth. At 1,769 MB, Lambda provides the equivalent of 1 full vCPU.
Security Governance
AWS Security, IAM & KMS Cryptography Hierarchy
| Security Mechanism | Policy Evaluation Layer | Scope of Authority | Enforcement Point | Common SAA-C03 Exam Rule |
|---|---|---|---|---|
| Service Control Policy (SCP) | AWS Organizations level | Guardrail on member accounts (does NOT grant permissions) | Central root/OU | An explicit Deny in an SCP overrides ALL permissions, even for the account root user. |
| IAM Permission Boundary | IAM Identity level | Sets the maximum boundary for an IAM user or role | Local IAM entity | Prevents delegated administrators from escalating their privileges when creating new roles. |
| Resource-Based Policy | AWS Resource level (S3, SQS, KMS) | Grants access to external principals directly on the resource | Individual resource | Allows cross-account access without the target principal needing to assume an IAM role. |
| VPC Security Group | Instance / ENI level | Stateful packet filter (return traffic automatically allowed) | Virtual network interface | Default: Denies all inbound, allows all outbound. Only Allow rules (No Deny rules supported). |
| VPC Network ACL (NACL) | Subnet level | Stateless packet filter (requires inbound AND outbound return rules) | Subnet boundary | Processes rules in numerical order (lowest first). Supports explicit Allow and Deny rules. |
| AWS KMS Customer Managed Key | Cryptographic key level | Symmetric/Asymmetric encryption backing key with key policy | FIPS 140-2 Level 3 HSM | Enables automatic annual rotation; key policy MUST grant access to the account root user. |
💡 Pro Tip:For cross-account KMS-encrypted S3 access: the caller IAM policy, the target S3 bucket policy, AND the target KMS key policy must ALL explicitly permit the cross-account principal.