Exam Guide

AWS SAA-C03

Solutions Architect Associate — the full breakdown: format, passing score, the four domains you'll be tested on, plus how to register and the exam-day rules.

At a glance

Passing score
720 / 1000
Questions
65 (50 scored + 15 unscored)
Time
~130 minutes
Cost
$150 USD (50% off if certified)
Delivery
Pearson VUE center or OnVUE online
Languages
EN, JA, KO, ZH-CN, ES, PT-BR, FR, IT

Domain weighting

D1
30%
D2
26%
D3
24%
D4
20%

Bars scaled to D1 (30%) as the longest — relative weight, not question count.

D130%

Design Secure Architectures

Identity, network, and data security — the largest domain. Prove you can lock down who can do what, where traffic can go, and how data stays protected in transit and at rest.

IAM & IdentityNetwork SecurityData ProtectionEncryptionVPC
  • ▸Apply least-privilege IAM policies, roles, and permission boundaries
  • ▸Design secure VPC topologies — subnets, NACLs, security groups, flow logs
  • ▸Encrypt data at rest (KMS, EBS/S3/RDS encryption) and in transit (TLS, mTLS)
  • ▸Secure secrets with Secrets Manager vs Parameter Store vs KMS
D226%

Design Resilient Architectures

High availability, disaster recovery, and decoupling. Show you can keep a workload running through failure — AZ loss, component failure, traffic spikes — and recover within RTO/RPO.

High AvailabilityDisaster RecoveryAuto ScalingLoose CouplingMulti-AZ
  • ▸Multi-AZ and multi-region patterns for compute, storage, and databases
  • ▸DR strategies (backup → pilot light → warm standby → multi-site) vs RTO/RPO
  • ▸Auto Scaling groups, target tracking, and cooldown behavior
  • ▸Decouple with SQS, SNS, EventBridge, and Step Functions to absorb load
D324%

Design High-Performing Architectures

Pick the right compute, storage, database, and networking service for the workload. The exam rewards knowing the performance shape of each service — IOPS, throughput, latency, scale limits.

ComputeStorageDatabasesNetworkingServerlessAnalytics
  • ▸Match compute to workload (EC2 vs Lambda vs Fargate vs Batch) by scaling and cost
  • ▸Select storage by access pattern (S3 tiers, EBS types, EFS, FSx, Instance Store)
  • ▸Choose databases (RDS/Aurora/DynamoDB/ElastiCache/Redshift) by consistency and scale
  • ▸Edge and networking perf — CloudFront, Global Accelerator, Direct Connect, VPC endpoints
D420%

Design Cost-Optimized Architectures

Right-size, reserve, and monitor. The smallest domain but the most directly testable — pricing models, storage tiers, and cost tools all have crisp right-answer shapes.

Pricing ModelsStorage TiersCompute OptionsDatabase CostCost Tools
  • ▸Compare On-Demand, Reserved, Savings Plans, Spot, and capacity reservations
  • ▸Use S3 and EBS lifecycle/tiers to drop storage spend without breaking access patterns
  • ▸Right-size compute and choose managed services to cut operational + infra cost
  • ▸Track and forecast with Cost Explorer, Budgets, Compute Optimizer, and TCW

Scoring

Getting started

Register & schedule

Five steps from sign-in to a booked seat. The whole flow runs through AWS Certification → Pearson VUE.

01

Sign in to AWS Certification

Use aws.training/certification. Your AWS Certification Account name must be in Roman characters and match the ID you'll bring to the exam.

02

Pick SAA-C03

Solutions Architect Associate — confirm the current exam guide (65 questions, 130 min, 720/1000 to pass).

03

Choose delivery

Pearson VUE test center (in person) or Online Proctored / OnVUE (remote, live proctor via webcam).

04

Pay & schedule

$150 USD. Holders of an active AWS certification get 50% off. Pick a date, time, and language.

05

Pick a language

English, Japanese, Korean, Simplified Chinese, Spanish, Portuguese-BR, French, Italian, and more depending on availability.

Delivery

On-site or online?

Two ways to sit the exam — pick what fits your setup. The rules differ on ID, breaks, and what you can do mid-exam.

Test Center

Pearson VUE · in person

in person
  • ▸Arrive 15–30 min before your appointment
  • ▸2 primary IDs, or 1 primary + 1 secondary ID
  • ▸A photo may be taken at check-in
  • ▸Unscheduled breaks allowed — timer keeps running
  • ▸You cannot leave the building during the exam
  • ▸Scratch work: use the provided erasable note board — no personal paper or pens

Online Proctored

OnVUE · remote live proctor

remote
  • ▸Launch up to 30 min early; >15 min late = forfeit
  • ▸1 primary ID (name must match account exactly)
  • ▸Pass the system test + workspace check first
  • ▸Stay on camera the entire time, no standing
  • ▸No breaks — don't leave the camera frame
  • ▸No physical paper or pens — use the on-screen whiteboard/notes only

During testing

Exam-day rules

Applies to both delivery modes. Know these before you walk in (or log in).

  • 01Agree to the Candidate Code of Conduct (5 min). Refusal ends the exam with no refund.
  • 02No penalty for wrong answers — blanks are scored as wrong, so answer every question.
  • 03Navigate freely and flag items for review before submitting.
  • 04No scheduled breaks on any AWS exam, test center or online.
  • 05The Roman-character name on your ID must match your AWS Certification Account exactly.
  • 06Need a name change? Process it at least 2 business days before your exam.

Full rules: aws.amazon.com/certification/policies/during-testing ↗

Online (OnVUE) setup & rules: pearsonvue.com/aws/onvue ↗

Official AWS exam page ↗

Study checklist

Are you ready?

The 14 course sections and, for each, the questions you must be able to answer out loud without notes. If one trips you up, rewatch that lecture before moving on.

DoneMaster fullyImportantKnow-what-it-does
§1

Introduction

Done

2 lectures

  • ▸Cloud computing fundamentals and why move to the cloud
§2

Getting Started With AWS

Done

5 lectures

  • ▸SAA-C03 format: 65 questions / 130 min; pass = 720/1000; multiple-choice + multiple-response
  • ▸The 4 domains + weights: Secure 30% · Resilient 26% · High-Performing 24% · Cost-Optimized 20%
  • ▸Free-tier account setup, the AWS Console, regions vs AZs basics
§3

Compute

Done

28 lectures · 4 labs

  • ▸EC2 instance families: General (M/T) vs Compute (C) vs Memory (R/X) vs Storage (I/D) vs Accelerated (P/G) — match family to workload
  • ▸Purchasing: On-Demand vs Reserved (Standard ≤72% vs Convertible) vs Savings Plans vs Spot (≤90%, 2-min interrupt) vs Dedicated Host/Instance — pick per workload
  • ▸Tenancy: Shared vs Dedicated Instance (isolated HW) vs Dedicated Host (BYOL + socket/core visibility, compliance)
  • ▸Instance Store (ephemeral, lost on stop/terminate, highest IOPS) vs EBS-backed (persistent, survives stop)
  • ▸Placement Groups: Cluster (low latency, 1 AZ, HPC) vs Spread (max 7/AZ, critical HA) vs Partition (big data, HDFS/Kafka)
  • ▸Public vs Private vs Elastic IP — EIP is static, stays yours, charged when NOT attached
  • ▸ENI (move IP/failover) vs ENA (enhanced networking, 10–100 Gbps) vs EFA (HPC, OS-bypass, ultra-low latency)
  • ▸ELB: ALB (L7 HTTP, path/host routing) vs NLB (L4 TCP/UDP, static IP, millions req/s) vs GWLB (L3, security appliances) vs CLB (legacy)
  • ▸Cross-zone load balancing: ALB always ON + free; NLB OFF by default (data charge if on)
  • ▸ELB stickiness (session affinity); health checks; SSL termination
  • ▸ASG: launch template, scaling policies (target tracking / step / scheduled), cooldown, termination policy, health-check replace
  • ▸Lambda (event-driven, 15-min max, cold start, concurrency) · Lambda@Edge (run at CloudFront edge) · Beanstalk (PaaS, AWS manages infra) · Outposts (AWS HW on-prem)
  • ▸Lambda concurrency: reserved (cap a function) vs provisioned (pre-warm, kill cold starts) vs SnapStart (Java cold-start cut); throttle → 429, overflow to SQS/DLQ
  • ▸AWS Batch (managed batch/HPC job queues, runs on Fargate or EC2/Spot) — when over plain EC2 or Lambda (long-running, many parallel jobs)
  • ▸EC2 Hibernation (RAM dumped to encrypted EBS, resume app state) vs Stop/Start (cold boot); ASG predictive scaling + Capacity Rebalancing for Spot
§4

Storage

Done

34 lectures · 1 lab

  • ▸S3 storage classes: Standard vs Standard-IA vs One Zone-IA vs Intelligent-Tiering vs Glacier Instant/Flexible/Deep Archive — pick by access pattern + min-duration (IA 30d, Glacier 90d, Deep 180d)
  • ▸S3 lifecycle: transition rules + expiration; move cold data down the tiers automatically
  • ▸S3 versioning (+ MFA delete) — required before replication works
  • ▸S3 replication: CRR (cross-region, DR/latency) vs SRR (same-region) — async, needs versioning on both sides
  • ▸S3 encryption: SSE-S3 vs SSE-KMS (audit/rotation) vs SSE-C vs client-side; enforce HTTPS via aws:SecureTransport
  • ▸S3 access control: IAM (identity) vs Bucket Policy (cross-account/resource) vs ACL (legacy) vs Block Public Access
  • ▸S3 CORS · Pre-Signed URL (temporary object access without making it public)
  • ▸EBS volume types: gp3/gp2 (general SSD) vs io1/io2 (high IOPS, Multi-Attach) vs st1 (throughput HDD) vs sc1 (cold HDD, cheapest)
  • ▸EBS snapshots (incremental → S3, cross-region copy), encryption, resizing live (Elastic Volumes), DeleteOnTermination
  • ▸EFS (managed NFS, multi-AZ, Linux, auto-scale, IA tier) vs EBS (single-AZ block, 1 instance) vs S3 (object) — when each
  • ▸Storage Gateway: File (NFS/SMB→S3) vs Volume (iSCSI cached/stored) vs Tape (VTL backup) — hybrid on-prem bridge
  • ▸AWS Backup: centralized cross-service backup plans, scheduling, retention, cross-region/cross-account copy
  • ▸FSx flavors: Windows File Server (SMB + AD) vs Lustre (HPC/ML, S3-linked, high throughput) vs NetApp ONTAP vs OpenZFS — match by protocol/workload
  • ▸S3 Transfer Acceleration (edge upload via CloudFront) vs Multipart Upload (large objects, parallel parts) — when each speeds uploads
§5

Security, Identity & Compliance

Master fully

Domain 1 (30%) · 23 lectures · 2 labs

  • ▸IAM policy evaluation: default deny, explicit deny always wins over allow
  • ▸IAM role vs IAM user vs resource-based policy — and cross-account access via roles
  • ▸IAM Identity Center (SSO) + permission sets — when over plain IAM users?
  • ▸KMS: customer-managed vs AWS-managed vs AWS-owned keys; envelope encryption; rotation; multi-region keys
  • ▸KMS vs CloudHSM
  • ▸Directory Service: Managed Microsoft AD vs AD Connector vs Simple AD
  • ▸Cognito user pool (authN) vs identity pool (authZ / temp AWS creds)
  • ▸Secrets Manager (auto-rotation, RDS integration) vs SSM Parameter Store (free, no rotation)
  • ▸WAF (L7, on ALB/CloudFront/API GW) vs Shield Standard (free L3/4) vs Shield Advanced (paid DDoS)
  • ▸GuardDuty (threat detection from logs) vs Inspector (EC2/ECR/Lambda vuln scan) vs Macie (S3 PII)
  • ▸ACM: free public certs, auto-renew; must be in us-east-1 for CloudFront
  • ▸RAM — what can be shared cross-account (VPC subnets, Transit Gateway, etc.)?
  • ▸IAM Access Analyzer — flags resources shared outside your account/Org; validates & generates least-privilege policies
  • ▸Firewall Manager — centrally apply WAF rules, Shield Advanced, Security Groups & Network Firewall across an Organization
  • ▸STS — temporary credentials (AssumeRole, federation); the engine behind cross-account roles & IAM Identity Center
§6

Database

Important

Domains 2 & 3 · 17 lectures · 2 labs

  • ▸Multi-AZ (sync, HA, auto-failover, same region) vs Read Replicas (async, read scaling, cross-region) — and using both
  • ▸RDS backups: automated vs manual snapshots; what RTO and RPO actually mean
  • ▸RDS Proxy: connection pooling, the Lambda use case, faster failover
  • ▸DynamoDB: partition-key design; on-demand vs provisioned (+ auto scaling); DynamoDB Streams
  • ▸LSI (same PK, alt sort, at creation, ≤10GB) vs GSI (different PK/sort, anytime, own capacity)
  • ▸DAX — microsecond caching for read-heavy DynamoDB
  • ▸Aurora: 6 copies / 3 AZs, up to 15 replicas; Serverless v1 vs v2; Aurora Global (cross-region <1s, DR)
  • ▸ElastiCache Redis (persistence, replication, Multi-AZ) vs Memcached (multi-threaded, no persistence)
  • ▸Caching strategies: lazy loading vs write-through; session-store pattern
  • ▸Purpose-built DBs: Neptune (graph), DocumentDB (MongoDB-compatible), Keyspaces (Cassandra), Timestream (time-series/IoT), QLDB (immutable ledger), MemoryDB (durable Redis) — match data model to engine
  • ▸RDS Multi-AZ vs Multi-AZ DB cluster (2 readable standbys) vs Aurora (6 copies/3 AZs) — levels of HA + read scaling
§7

Machine Learning

Know-what-it-does

6 lectures

  • ▸Polly = text→speech · Translate = language translation
  • ▸Comprehend = NLP / sentiment / entities (Comprehend Medical)
  • ▸Rekognition = image/video analysis, face detection, moderation
  • ▸Lex = chatbots (ASR + NLU), powers Alexa
  • ▸Transcribe = speech→text · Textract = doc text extraction · SageMaker = build/train/deploy
  • ▸Bedrock = managed foundation models / GenAI (serverless) · Kendra = intelligent enterprise search · Personalize = recommendations · Forecast = time-series prediction · Fraud Detector = fraud scoring
§8

Management & Governance

Important

17 lectures · 4 labs

  • ▸Organizations: OUs, SCPs (set boundaries — don’t grant), consolidated billing
  • ▸CloudWatch: standard (5min) vs detailed (1min) metrics; EC2 memory/disk need the CloudWatch agent; alarms, Logs Insights
  • ▸CloudTrail (API audit) vs CloudWatch (performance) vs Config (config state + compliance) — the classic triad
  • ▸Config rules + remediation; conformance packs
  • ▸CloudFormation: change sets, drift detection, nested stacks, StackSets (multi-account/region)
  • ▸Trusted Advisor 5 categories (cost, security, fault tolerance, performance, service limits)
  • ▸Systems Manager: Session Manager (no SSH/bastion), Parameter Store, Patch Manager, Run Command
  • ▸Control Tower (landing zone, Account Factory, guardrails + account drift detection) — multi-account governance layered on Organizations
  • ▸Service Catalog (curated/approved product portfolios for self-service) · License Manager (track BYOL) · Health Dashboard (service vs account events)
§9

Networking & Content Delivery

Master fully

Heavily tested · 27 lectures · 5 labs

  • ▸VPC CIDR sizing; public vs private subnet (= route to IGW or not); 5 reserved IPs per subnet
  • ▸Security Groups (stateful, allow-only, instance) vs NACLs (stateless, allow+deny, subnet, ordered)
  • ▸IGW vs NAT Gateway (managed, AZ-resilient, outbound for private) vs NAT Instance
  • ▸VPC Peering (non-transitive, no overlapping CIDR) vs Transit Gateway (hub, transitive)
  • ▸VPC Endpoints: Gateway (S3/DynamoDB, free, route table) vs Interface/PrivateLink (ENI, hourly)
  • ▸VPN (internet, encrypted, fast setup) vs Direct Connect (dedicated, consistent, slow provision); DX+VPN for encryption
  • ▸Route 53 policies — pick one per scenario; alias vs CNAME (alias for zone apex, free, AWS targets)
  • ▸CloudFront caching/TTL; OAC locks the S3 origin; geo restriction; signed URL/cookie
  • ▸CloudFront signed URL vs S3 presigned URL — when each
  • ▸Global Accelerator (anycast IPs, TCP/UDP, network layer) vs CloudFront (HTTP caching)
  • ▸API Gateway: REST vs HTTP vs WebSocket; throttling, caching, authorizers
  • ▸AWS Network Firewall — managed stateful firewall for VPC traffic (Suricata-compatible); centralized inspection VPC via GWLB for 3rd-party appliances
  • ▸PrivateLink / VPC Endpoint Service — expose your service privately to other VPCs/accounts behind an NLB or GWLB (not ALB)
§10

Analytics

Know-what-it-does

16 lectures · 2 labs

  • ▸Kinesis Data Streams (real-time, shards, custom consumers) vs Firehose (near-real-time, managed delivery, no code)
  • ▸Redshift — data warehouse / OLAP / columnar; Redshift Spectrum (query S3)
  • ▸Glue — serverless ETL + Data Catalog + Crawlers
  • ▸Athena — serverless SQL on S3; cost = data scanned (partition + columnar to cut it)
  • ▸The serverless analytics pattern: S3 + Glue + Athena + QuickSight
  • ▸EMR (managed Hadoop/Spark) and OpenSearch (search/log analytics) — what each is for
  • ▸QuickSight (serverless BI dashboards, SPICE in-memory engine) — the visualization layer of the analytics stack
  • ▸Lake Formation (data-lake setup + fine-grained S3/Glue governance) · MSK (managed Apache Kafka) · Kinesis Data Analytics / Managed Flink (SQL/Flink on streams)
§11

Application Integration

Important

SQS/SNS tested · 10 lectures

  • ▸SQS Standard (at-least-once, best-effort order) vs FIFO (exactly-once, ordered)
  • ▸Visibility timeout, dead-letter queue, long polling — what each solves
  • ▸SQS vs SNS vs EventBridge — when to reach for each
  • ▸Fan-out pattern: SNS → multiple SQS queues
  • ▸EventBridge: event bus, rules, cron schedules, SaaS/schema integration
  • ▸Step Functions: orchestration; Standard vs Express
  • ▸Amazon MQ — when (lift-and-shift apps using MQTT/AMQP) over SQS/SNS
  • ▸AppFlow — no-code data flows between SaaS (Salesforce, Slack, Zendesk) and AWS (S3/Redshift)
  • ▸SQS FIFO throughput (300 msg/s, 3000 batched) + message group ID for ordering; SNS FIFO → SQS FIFO fan-out
§12

Containers

Important

7 lectures · 2 labs

  • ▸ECS EC2 launch type (you manage instances) vs Fargate (serverless)
  • ▸Task definition vs service vs task
  • ▸Task placement strategies: binpack, spread, random
  • ▸ECS task role (per-task IAM)
  • ▸EKS (managed Kubernetes) — when over ECS
  • ▸ECR — container registry; Fargate as the serverless-container answer
  • ▸App Runner — fully-managed: deploy a container/web app from image or repo, AWS handles scaling + load balancer + TLS
  • ▸EKS networking: AWS Load Balancer Controller maps K8s Ingress → ALB (L7 path/host) and Service type LoadBalancer → NLB (L4)
  • ▸ECS Anywhere / EKS Anywhere — run the AWS container control-plane experience on-prem
§13

Migration & Transfer

Know-what-it-does

5 lectures

  • ▸Snow Family: Snowcone (8-14TB) / Snowball Edge Storage (210TB) / Compute (28TB, 104 vCPUs) — pick by data size + compute need; >1 week via internet → Snow
  • ▸DMS: homogeneous vs heterogeneous (+ Schema Conversion Tool); CDC for continuous replication; Multi-AZ replication instance
  • ▸DataSync: online on-prem (NFS/SMB/HDFS) → S3/EFS/FSx; EFS cross-region replication via private network; scheduled + auto-verify
  • ▸Transfer Family: managed SFTP/FTPS/FTP/AS2 endpoints → S3/EFS; legacy protocol support, no code change
  • ▸Migration Hub: tracks migrations across tools (DMS, MGN, DataSync) — does NOT migrate; home region; Strategy Recommendations; Orchestrator
  • ▸MGN vs DMS vs DataSync: MGN = server lift-and-shift; DMS = database; DataSync = file/object transfer
§14

AWS Cost Management

Important

Domain 4 (20%) · 2 lectures · 1 reading

  • ▸Cost Explorer (visualize/forecast up to 12 months, anomaly detection, RI/SP recommendations) vs AWS Budgets (ALERT on threshold, Budget Actions)
  • ▸Cost allocation tags (user-defined + AWS-generated, activate in billing console)
  • ▸On-Demand vs Reserved Instances vs Savings Plans vs Spot — pick per workload
  • ▸Consolidated billing (Organizations): volume discounts, shared RIs across accounts
  • ▸Storage cost levers: S3 lifecycle, Intelligent-Tiering (cross-ref Storage)
  • ▸Cost and Usage Report (CUR): most detailed line-item billing data → S3 → Athena/QuickSight for deep analysis
  • ▸Compute Optimizer (ML-based rightsizing) vs Trusted Advisor (broad checks: cost, security, perf, limits)
  • ▸Savings Plans: Compute SP (any family/region/OS + Fargate & Lambda, up to 66%, most flexible) vs EC2 Instance SP (specific family in a region, up to 72%) vs SageMaker SP
  • ▸Reserved Instances: Standard (≤72%, modify only) vs Convertible (≤54%, swap family/OS); Regional (AZ-flexible) vs Zonal (reserves capacity in an AZ)

Don't move on from a §5–§14 section until its quiz is ≥80%. Sources: glossary · practice.

Service index

Every service, by domain

The full map: the four exam domains → their sections → every AWS service in Deep Notes. Tap any service to jump straight to its card.

D130%

Design Secure Architectures

47 services

IAM & Identity· 11

IAMAWS Identity and Access ManagementControl who can access what AWS resourcesSTSAWS Security Token ServiceGenerate temporary security credentialsDirectory ServiceAWS Directory ServiceManaged Microsoft Active Directory, AD Connector, or Simple AD for AWS workloadsIAM Identity CenterAWS IAM Identity Center (SSO)Centralized SSO untuk multiple AWS accountsIAM Access AnalyzerAWS IAM Access AnalyzerDetect resources yang ter-expose ke public / account luar / Org luarAWS RAMAWS Resource Access ManagerShare AWS resources merentas account / OU dalam OrganizationIAM Roles AnywhereAWS IAM Roles AnywhereGive on-prem / non-AWS servers temporary AWS credentials without access keysAWS ArtifactAWS ArtifactDownload AWS compliance reports & accept agreementsCognitoAmazon CognitoUser sign-up/sign-in, federated identity (Google/Facebook), mobile app authRAMAWS Resource Access ManagerShare subnets, Transit Gateway, Route 53 resolver rules cross-accountAWS OrganizationsAWS Organizations + Control Tower + SCPsManage multiple AWS accounts centrally with guardrails

Network Security· 14

Security GroupsVPC Security GroupsInstance-level firewall — control inbound/outbound per EC2/ENINACLsNetwork Access Control ListsSubnet-level firewall, stateless, boleh block IPWAFAWS Web Application FirewallProtect against SQL injection, XSS, rate limitingAWS ShieldAWS Shield Standard & AdvancedDDoS protection Layer 3/4 (Standard) and Layer 7 (Advanced)Network FirewallAWS Network FirewallVPC-level managed firewall — stateful deep packet inspection, domain filtering, IDS/IPSVPC Flow LogsVPC Flow LogsCapture IP traffic metadata to/from ENIs — troubleshoot SG/NACL, security analysis, complianceGuardDutyAmazon GuardDutyAutomated threat detection: crypto-mining, unusual API calls, compromised instancesDetectiveAmazon DetectiveInvestigate and analyze security findings from GuardDuty, Security Hub, MacieInspectorAmazon InspectorFind OS/software vulnerabilities, CVEs, unintended network exposure in EC2, ECR images, LambdaMacieAmazon MacieDiscover and protect sensitive data in S3: PII, credentials, financial data, complianceSecurity HubAWS Security HubCentral view of security findings across accounts + compliance checksFirewall ManagerAWS Firewall ManagerCentrally manage firewall rules across all accounts in an OrganizationPenetration TestingAWS Penetration Testing PolicyFaham polisi AWS untuk security testing & Acceptable Use PolicySecurity StackAWS Security Services — Custom Rules & IntegrationFaham service mana boleh custom rules vs auto, macam mana security services integrate, + keyword cost tolak jawapan ke versi jimat/premium

Data Protection· 8

KMSAWS Key Management ServiceEncrypt data at rest, manage encryption keysSecrets ManagerAWS Secrets ManagerStore dan auto-rotate credentials, API keys, DB passwordsS3 Object LockAmazon S3 Object LockWORM compliance, prevent deletion/modificationS3 Glacier VaultAmazon S3 Glacier Vault Lock & Access PolicyWORM compliance for Glacier archives — enforce retention policies that cannot be changedAmazon RedshiftAmazon Redshift — Encryption & DataShareEncrypt data warehouse at rest (KMS) and in transit (SSL); share data cross-account via DataShareCloudTrailAWS CloudTrailAudit who did what and when — compliance, forensics, account activityACMAWS Certificate ManagerProvision free SSL/TLS certificates for ALB, CloudFront, API GatewayCloudHSMAWS CloudHSMFIPS 140-2 Level 3 compliance, customer-exclusive HSM hardware

VPC & Networking· 11

VPCAmazon Virtual Private CloudIsolated private network — the foundation for all AWS resourcesCIDR & SubnetsIP Addressing & Subnet CalculatorPlan IP address ranges — VPC perlu CIDR sebelum boleh buat subnetsPrivate/Public/Elastic IPEC2 IP Addresses — Private vs Public vs ElasticTentukan macam mana EC2 dialamatkan — internal (Private), internet sementara (Public), atau internet statik yang tak berubah (Elastic)Internet GatewayVPC Internet Gateway (IGW)Connect VPC to internet (bidirectional) — kena ada untuk public subnetNAT GatewayNetwork Address Translation GatewayPrivate subnet instances download patches/call APIs without being exposed to internetRoute TablesVPC Route TablesControl traffic direction: public subnet → IGW, private subnet → NAT GWSG vs NACLSecurity Groups vs Network ACLs — Defence LayersTwo-layer defence: SG guards each EC2, NACL guards each subnetLaluan Packet VPCPerjalanan Satu Packet — VPC Traffic Flow (end-to-end)Faham urutan checkpoint satu packet lalui dari internet sampai EC2 dan balik — kunci untuk semua soalan troubleshoot VPCVPC PeeringVPC Peering ConnectionConnect 2 VPCs privately — same account, cross-account, atau cross-regionTransit GatewayAWS Transit GatewayConnect 3+ VPCs dan on-premises networks melalui satu hub yang transitiveVPC EndpointsVPC Endpoints (Gateway & Interface)Access S3/DynamoDB (free) atau AWS services lain (paid) dari private subnet secara private
D226%

Design Resilient Architectures

27 services

High Availability & Scaling· 10

Region & AZAWS Global Infrastructure — Region, Availability Zone, EdgeFaham geografi AWS — asas semua keputusan HA, DR, latency & data residencyAuto Scaling GroupsAmazon EC2 Auto ScalingAutomatically scale EC2 instances based on loadRDS Multi-AZAmazon RDS Multi-AZ DeploymentHigh availability for RDS — automatic failoverRDS Read ReplicasAmazon RDS Read ReplicasScale read traffic, reporting queries, multi-region read accessRDS ProxyAmazon RDS ProxyConnection pooling for RDS — handle too many connections from Lambda/Auto ScalingGlobal AcceleratorAWS Global AcceleratorRoute global users to nearest healthy endpoint via AWS backboneAuroraAmazon AuroraHigh-performance relational DB, MySQL/PostgreSQL compatible, enterprise HAAurora ServerlessAmazon Aurora ServerlessUnpredictable/intermittent workloads — auto-scale DB capacity, pay per secondDynamoDBAmazon DynamoDBServerless key-value/document store, single-digit ms latency at any scaleDAXAmazon DynamoDB Accelerator (DAX)Read-heavy DynamoDB workloads needing microsecond response times

Backup & Storage Resilience· 8

AWS BackupAWS BackupCentralized backup across EC2, RDS, EFS, DynamoDB, S3S3 Versioning & CRRS3 Versioning + Cross-Region ReplicationProtect against accidental deletion, cross-region DR for S3EBS SnapshotsAmazon EBS SnapshotsPoint-in-time backup of EBS volumes, cross-region DRFSxAmazon FSxManaged file systems: Windows SMB, HPC Lustre, NetApp ONTAP, OpenZFSStorage GatewayAWS Storage GatewayHybrid cloud storage — on-premises apps guna AWS storage secara seamlessDataSyncAWS DataSyncOne-time or recurring data migration from on-premises to S3, EFS, or FSx; also EFS cross-region replicationDMSAWS Database Migration ServiceMigrate databases to AWS — homogeneous (MySQL→RDS MySQL) or heterogeneous (Oracle→Aurora)Snow FamilyAWS Snow FamilyPetabyte-scale data transfer bila internet terlalu lambat/mahal, atau edge computing
D324%

Design High-Performing Architectures

72 services

Compute· 18

EC2Elastic Compute CloudRun any workload, full controlLambdaAWS LambdaServerless, event-drivenElastic BeanstalkAWS Elastic BeanstalkDeploy app tanpa urus serverECSElastic Container ServiceRun & orchestrate Docker containers (AWS-native, bukan Kubernetes)EKSElastic Kubernetes ServiceContainer orchestration guna K8sEKS VariantsEKS Anywhere vs EKS Distro vs ECS AnywhereRun container workloads on-premises with varying levels of AWS integrationAWS LB ControllerAWS Load Balancer ControllerAuto-provision AWS load balancers (ALB/NLB) dari Kubernetes Ingress/Service resourcesEC2 User DataEC2 User Data ScriptsAuto-configure EC2 instance on first bootEC2 HibernationAmazon EC2 HibernationPreserve in-memory state across stop/start — fast resume for memory-intensive appsEC2 MetadataEC2 Instance Metadata Service (IMDS)Get info about the running instance from within the instanceRecycle BinAWS Recycle Bin (AMI & EBS Snapshots)Recover accidentally deleted AMIs and EBS snapshots within a defined retention periodAWS BatchAWS BatchRun batch / long-running compute jobs at scale without managing EC2 infrastructureFargateAWS FargateRun container (ECS/EKS) tanpa urus EC2 langsungECRAmazon Elastic Container RegistrySimpan, version & deploy Docker image secara private dalam AWSInstance StoreAmazon EC2 Instance StoreTemporary block storage physically attached to the host server — highest IOPS, zero costENI/ENA/EFAEC2 Network Interfaces — ENI · ENA · EFANetwork connectivity dan performance — pilih ikut keperluan (standard vs high-throughput vs HPC)Lambda@EdgeAWS Lambda@EdgeRun Lambda functions AT CloudFront edge locations — customize content delivery closer to usersEC2 TenancyEC2 Tenancy & Dedicated HostsPilih tahap isolation hardware — shared vs dedicated instance vs dedicated host

Storage· 10

EBSElastic Block StoreBlock storage, attach ke 1 EC2EBS Volume TypesAmazon EBS — Volume Types & Multi-AttachChoose right EBS type for workload: random I/O vs sequential, IOPS vs throughput, cost vs performanceEFSElastic File SystemShared file storage for multiple EC2 instances simultaneouslyS3Simple Storage ServiceObject storage: images, video, backup, data lake, static websiteS3 Access ControlS3 Access Control & Policies (IAM · Bucket Policy · ACL · BPA)Kawal siapa boleh access bucket/object — pilih antara IAM Policy, Bucket Policy, ACL, atau Block Public AccessS3 GlacierAmazon S3 Glacier (storage classes)Archive jangka panjang, jarang/tak pernah access (compliance, backup lama)S3 Storage ClassesS3 Storage Classes — 7 Main Tiers + Express One ZonePilih S3 class ikut access pattern + retrieval speed + kos (the THE exam storage decision)S3 LifecycleS3 Lifecycle ManagementAutomatically transition objects to cheaper storage classes + expire old objectsS3 CORSS3 Cross-Origin Resource Sharing (CORS)Allow web apps on one domain to access S3 resources on a different domainS3 Pre-Signed URLS3 Pre-Signed URLsGrant temporary time-limited access to a single S3 object without sharing credentials

Messaging & Serverless· 12

SQSSimple Queue ServiceDecouple services, async queueSNSSimple Notification ServicePush notification ke many subscribers (fan-out)KinesisAmazon Kinesis (Data Streams vs Firehose)Ingest & process real-time streaming data (logs, clickstream, IoT, metrics)Kinesis Video StreamsAmazon Kinesis Video Streams (KVS)Ingest, simpan, playback & proses VIDEO/audio live dari beribu kamera/IoT device (CCTV, drone, dashcam, video doorbell) untuk ML/playbackAPI GatewayAmazon API GatewayManage & expose REST, HTTP, dan WebSocket APIsEventBridgeAmazon EventBridgeServerless event bus: decouple services, schedule tasks, react to AWS service changesStep FunctionsAWS Step FunctionsCoordinate multi-step processes with error handling, retry, and branchingAmazon MQAmazon MQMigrate existing ActiveMQ/RabbitMQ message brokers to AWS without code changesKinesis Data FirehoseAmazon Kinesis Data FirehoseCapture and load streaming data to S3, Redshift, OpenSearch, Splunk automaticallyAppFlowAWS AppFlowAutomated no-code data transfer between SaaS apps (Salesforce, ServiceNow, Slack) and AWS servicesAppSyncAWS AppSyncBuild GraphQL APIs with real-time data sync and offline capabilityAmplifyAWS AmplifyBuild and host fullstack web/mobile apps with managed backend services

Analytics & Streaming· 12

RedshiftAmazon RedshiftData warehouse: complex/recurring analytics atas structured data berskala besarQuickSightAmazon QuickSightBusiness intelligence dashboards, data visualization, ML-powered analyticsAthenaAmazon AthenaAd-hoc SQL analysis of data in S3 without loading to a databaseGlueAWS GlueETL jobs, data catalog for data lake, prepare and transform data for analyticsLake FormationAWS Lake FormationFine-grained access control on data lake (row/column/cell) + simplify & accelerate creation of a secure data lakeEMRAmazon EMRProcess petabyte-scale data with Spark, Hadoop, Hive, Presto — full controlOpenSearchAmazon OpenSearch ServiceFull-text search, real-time log/event analytics, dashboard visualisationMSKAmazon MSKReal-time event streaming dengan Kafka API — migrate or build Kafka workloadsKendraAmazon KendraIntelligent enterprise search across diverse document repositoriesData ExchangeAWS Data ExchangeSubscribe to and access third-party datasets for analyticsAWS AI/ML ServicesAWS AI Services — Polly, Rekognition, Lex, Comprehend, Textract, Transcribe, TranslateAI/ML services untuk audio, video, text, image analysis without training modelsSageMakerAmazon SageMakerBuild, train, and deploy custom ML models with full control
D420%

Design Cost-Optimized Architectures

20 services

EC2 Pricing Models· 13

On-DemandEC2 On-Demand InstancesWorkload tak menentu, short-term, testingReserved InstancesEC2 Reserved Instances (RI)Workload steady predictable 24/7 untuk 1-3 tahunSpot InstancesEC2 Spot InstancesBatch jobs, fault-tolerant & stateless workloads, flexible timingSavings PlansAWS Savings Plans (SP)Steady compute spend tapi nak fleksibiliti tukar instance/region — auto-applyCompute OptimizerAWS Compute OptimizerRightsizing recommendations for EC2, Lambda, EBS, ECS on Fargate, Auto Scaling GroupsTrusted AdvisorAWS Trusted AdvisorIdentify idle resources, cost optimization recommendationsAWS BudgetsAWS BudgetsSet cost/usage thresholds and get alerted before overspendingCost ExplorerAWS Cost ExplorerVisualise and analyse AWS costs — understand patterns, get RI/SP recommendationsCost Anomaly DetectionAWS Cost Anomaly DetectionDetect unusual/anomalous AWS spend patterns and alert departments automaticallyInstance SchedulerInstance Scheduler on AWSAuto start/stop EC2 + RDS on a fixed weekday schedule with minimal ops overheadCost & Usage ReportAWS Cost and Usage Report (CUR)Raw line-item billing paling granular untuk custom/deep cost analysisCost Allocation TagsAWS Cost Allocation TagsTrack & group kos ikut team / projek / environmentConsolidated BillingAWS Organizations Consolidated BillingGabung billing banyak account, kongsi volume/RI/SP discount

Generated from the Deep Notes catalog — every card is linked. Browse the full set at Deep Notes.