About this course map
Four domains, mapped one-for-one to the AWS Certified Solutions Architect – Associate exam guide and taught in the same order, so nothing on the exam is left uncovered.
SAA-C03 is still the current version. Third-party course sellers have begun advertising an SAA-C04, but AWS's own exam guide index lists SAA-C03 and no successor, and AWS has published no retirement date for it. We track that index and will reissue this map the day it changes. Each domain below carries its published weighting, and we give it lab and classroom time in proportion.
The exam is written around the AWS Well-Architected Framework, and almost every question is a short scenario with four defensible-looking answers. The winning answer is usually the one that is most managed, least operationally expensive, and correctly scoped to the stated requirement. The teaching is built for that — you design for a requirement, then are told what changed, and have to say what you would do differently.
Domain 01 — Design Secure Architectures
The largest domain, and the one where a wrong answer is a breach rather than a bill. 30% of the scored exam, across three task statements.
•Designing secure access to AWS resources: IAM users, groups, roles and policies, and choosing the right one for a given actor
•Least privilege in practice, root account protection, and where multi-factor authentication is mandatory rather than advisable
•Role-based access and temporary credentials with AWS STS, role switching and cross-account access
•Multi-account strategy with AWS Organizations, AWS Control Tower and service control policies
•Identity federation: AWS IAM Identity Center, external directory services, and when to federate rather than create accounts
•Resource policies against identity policies, and how the two combine to allow or deny
•Designing secure workloads and applications: VPC construction with subnets, route tables, security groups, network ACLs and NAT gateways
•Network segmentation between public and private tiers, and secure hybrid connectivity over VPN or AWS Direct Connect
•Application and edge protection: AWS WAF, AWS Shield, and defending against DDoS and injection attacks from outside AWS
•Credential and secret handling with AWS Secrets Manager and AWS Systems Manager Parameter Store, and user identity with Amazon Cognito
•Determining data security controls: encryption at rest with AWS KMS, encryption in transit with TLS and AWS Certificate Manager, and key policies
•Data classification, retention, lifecycle, backup and replication, key rotation and certificate renewal, and detective services such as Amazon GuardDuty and Amazon Macie
•The AWS shared responsibility model, and where your obligations start on each service type
Domain 02 — Design Resilient Architectures
Building something that survives a failure you did not plan for. 26% of the scored exam, across two task statements.
•Designing scalable and loosely coupled architectures: multi-tier, microservice and event-driven patterns
•Decoupling with queues and topics — Amazon SQS and Amazon SNS — and orchestrating work with AWS Step Functions
•Serverless compute with AWS Lambda and AWS Fargate, and when a container or an instance is the better answer
•Container orchestration with Amazon ECS and Amazon EKS, and what containerising an application does and does not solve
•API design and management with Amazon API Gateway, and stateless design as the precondition for horizontal scaling
•Horizontal against vertical scaling, load balancing, caching strategies and edge acceleration
•Choosing between object, file and block storage, and matching a purpose-built AWS service to a workload rather than forcing a general one
•Designing highly available and fault-tolerant architectures across Availability Zones and Regions
•Eliminating single points of failure, and failover with Amazon Route 53 routing policies and health checks
•Disaster recovery strategies — backup and restore, pilot light, warm standby, active-active — chosen against a stated RPO and RTO
•Data durability: replication, backup regimes, and storage durability guarantees per service
•Service quotas, throttling, immutable infrastructure, and automation that keeps infrastructure integrity
•Observability with Amazon CloudWatch and AWS X-Ray, and picking metrics that reflect a business requirement
Domain 03 — Design High-Performing Architectures
Meeting the performance requirement without over-buying to get there. 24% of the scored exam, across five task statements.
•High-performing storage: Amazon S3, Amazon EBS and Amazon EFS characteristics, and hybrid storage where data stays partly on premises
•Matching storage configuration to an access pattern, and choosing something that will still scale in two years
•Elastic compute: EC2 instance families and sizes, AWS Batch, Amazon EMR, AWS Lambda and AWS Fargate
•EC2 Auto Scaling and AWS Auto Scaling, scaling metrics, and decoupling components so they scale independently
•High-performing databases: relational, non-relational, in-memory and serverless, including Amazon Aurora and Amazon DynamoDB
•Read replicas, database proxies and connection management, capacity planning and engine migration
•Caching with Amazon ElastiCache and Amazon DynamoDB Accelerator, and where a cache fixes the symptom instead of the cause
•Network performance: VPC topology, subnetting and routing, load balancer selection, and connectivity via VPN, AWS Direct Connect and AWS PrivateLink
•Edge networking with Amazon CloudFront and AWS Global Accelerator, and placing resources near the people using them
•Data ingestion and streaming with Amazon Kinesis, and transfer at scale with AWS DataSync and AWS Storage Gateway
•Data transformation with AWS Glue, format conversion for query efficiency, and building a secure data lake with AWS Lake Formation
•Analysis and visualisation with Amazon Athena and Amazon QuickSight
Domain 04 — Design Cost-Optimized Architectures
The domain candidates under-prepare, and the one your employer notices. 20% of the scored exam, across four task statements.
•Cost-optimised storage: S3 storage classes, lifecycle policies, intelligent tiering and archival to Amazon S3 Glacier
•Block storage type selection, backup and snapshot strategy, and the cheapest correct way to move a given volume of data
•Cost-optimised compute: On-Demand, Reserved Instances, Savings Plans and Spot, and matching a purchasing model to a workload's tolerance for interruption
•Right-sizing instance families and sizes, EC2 hibernation, and consolidating to serverless or containers where it genuinely reduces cost
•Comparing AWS Lambda, Amazon EC2 and AWS Fargate on total cost for a stated usage profile
•Cost-optimised databases: engine and type selection, provisioned against serverless capacity, and retention and snapshot frequency
•Migration between engines and locations, and picking a purpose-built database instead of over-provisioning a general one
•Cost-optimised networking: NAT gateway placement, VPC endpoints, peering and AWS Transit Gateway
•Data transfer charges between Regions, between Availability Zones and out to the internet, and routing to minimise them
•Choosing between AWS Direct Connect, VPN and internet transit on cost as well as performance
•Cost visibility and control: cost allocation tags, consolidated billing, AWS Cost Explorer, AWS Budgets and the AWS Cost and Usage Report
•Reading a bill well enough to find the line that is actually causing the problem
Who should take this
Solutions architects and aspiring architects, systems and network engineers moving to the cloud, DevOps and platform engineers who design as well as operate, and technical leads who have to approve an AWS design rather than build it.
AWS recommends around one year of hands-on experience designing on AWS before sitting this exam. There are no formal prerequisites and no experience audit — you can book it whenever you like — but the exam assumes you have actually built something.
You will need working knowledge of networking, operating systems and general application architecture, and to be comfortable in the AWS console and on a command line. You do not need a prior AWS certification; the Cloud Practitioner is optional, not a step on the way.
The exam
The AWS Certified Solutions Architect – Associate is set and awarded by AWS, and delivered at Pearson VUE test centres or by online proctoring.
•65 questions, of which 50 are scored and 15 are unscored
•130 minutes
•A scaled score of 720 out of 1000 is required to pass
•Multiple choice, with one correct response and three distractors, and multiple response, with two or more correct out of five or more options
•Scored compensatorily across the whole exam — there is no per-domain pass mark
•The certification is valid for three years
The exam fee is paid separately to AWS. We can arrange the booking on your behalf, and you choose your own date. Hacky Security is not an AWS Training Partner, and this course is taught from our own material rather than official AWS courseware.
How we deliver it
Three days, classroom or online live, or at your office for a private group. Roughly half the time is hands-on in a live AWS account we provide, so you are building the architectures rather than watching slides about them.
Domain checkpoints each day, and a full-length 65-question mock under exam conditions on the final afternoon, followed by a walkthrough of why the nearly-right answer was wrong — which is the skill the exam is really testing.
Mapped to the AWS Certified Solutions Architect – Associate exam guide, SAA-C03. Taught from Hacky Security's own curriculum by instructors who architect AWS estates for a living.
