Training course

This is a free, self-paced reading course for AWS Certified Solutions Architect – Associate (SAA-C03). The exam that asks you to design solutions that are secure, resilient, high-performing, and cost-optimized, the four pillars that mirror the AWS Well-Architected Framework. The difficulty on SAA-C03 is discrimination rather than recall. Almost every question is a scenario in which three of the four options are real services that would genuinely work, and one stated requirement (a latency ceiling, a compliance boundary, an RPO, a budget) is what eliminates them. Memorizing service descriptions does not survive that format. Knowing why the near-miss loses does.

So this course is written around the comparisons rather than around the service list. It is organized as one module per official exam domain, in the order AWS publishes them, and each module carries the domain’s published weight: security is 30% and the largest domain, resilience 26%, performance 24%, and cost optimization 20%. That spread is flatter than most exams, which is worth knowing before you plan your time. There is no domain you can safely skip, and the cost domain is a fifth of the exam despite being the one candidates treat as an afterthought. Every lesson ends with its key terms and suggested further reading, so it works as a reference after the first pass as well as a syllabus during it.

SAA-C03 Associate level 4 modules Domain-weighted Self-paced Free account

What the course covers

Design Secure Architectures

Module 1 · 30%

The largest domain and the single biggest reason candidates fail. IAM in depth (roles, policies, permission boundaries, IAM Identity Center, and cross-account patterns) then data protection with KMS and Secrets Manager, VPC network security through security groups, network ACLs, and VPC endpoints, and the edge and detection layer of AWS WAF, Shield, GuardDuty, Macie, and CloudTrail. The recurring exam pattern here is an answer option that is a real service which almost fits but breaks a stated requirement, so the module works through those boundaries explicitly.

Design Resilient Architectures

Module 2 · 26%

Multi-AZ and multi-Region availability, Auto Scaling, and Elastic Load Balancing patterns; the database availability choices: RDS Multi-AZ against read replicas, Aurora Global Database, DynamoDB Global Tables; decoupling with SQS and SNS; and Route 53 failover and health checks. The module closes on the four canonical disaster-recovery strategies (backup and restore, pilot light, warm standby, active-active) and their RTO and RPO trade-offs, because many questions in this domain turn on the difference between two similar-looking services or between synchronous and asynchronous replication.

Design High-Performing Architectures

Module 3 · 24%

Choosing the right storage for a workload across S3 tiers, EBS volume types, EFS, and FSx; scaling compute with Lambda, Fargate, ECS, EKS, EC2 Auto Scaling, and provisioned concurrency; database performance through ElastiCache, DynamoDB DAX, and read replicas; and networking performance with CloudFront, Global Accelerator, placement groups, and NLB against ALB. Data ingestion at scale (Kinesis, MSK, DataSync, Storage Gateway) sits here too. The recurring theme is the three-way trade-off between latency, throughput, and cost.

Design Cost-Optimized Architectures

Module 4 · 20%

The smallest domain, but the one where practitioner intuition matters most. EC2 purchasing options (On-Demand, Savings Plans, Reserved Instances, Spot, Dedicated Hosts) and the workload shape that makes each one correct; S3 storage classes and lifecycle policies; right-sizing with Compute Optimizer; cost visibility through AWS Budgets and Cost Explorer; and the recurring VPC-cost trap of NAT gateway data transfer that Gateway VPC endpoints for S3 and DynamoDB can eliminate.

How to use it

Read a module, then take the matching portion of the SAA-C03 practice exam rather than waiting until you have finished everything. On a discrimination exam this matters more than usual: reading a domain and immediately testing it is what reveals whether you actually understand a boundary or have only learned a service’s marketing summary. If you want to see the question style before committing to a full set, the free sample questions are a short read. When you review a wrong answer, do not stop at the correct option, find the requirement in the stem that killed the one you picked. That habit is the whole skill the exam measures. The course modules themselves open once you are signed in to a free Certifym account.

The course does not assume you already know AWS deeply, but SAA-C03 does assume roughly a year of hands-on design experience, and reading cannot substitute for that. Pair the modules with a Free Tier account and build the comparisons you read about: put the same object in two S3 classes, front a bucket with CloudFront, watch a NAT gateway accrue data-transfer charges, break an Auto Scaling health check on purpose. For exam logistics (item count, timing, the 720 cut score, the fee, delivery, and renewal) see the SAA-C03 certification guide.

SAA-C03: AWS Certified Solutions Architect - Associate

One module per SAA-C03 exam domain, weighted the way AWS weights them.

A self-paced reading course for AWS Certified Solutions Architect - Associate (SAA-C03), the exam that asks you to design solutions that are secure, resilient, high-performing, and cost-optimized. The course is organized as one module per official exam domain, in the order AWS publishes them, and each module carries the domain's published weight, so the time you spend maps to the time the exam spends.

SAA-C03 is a test of discrimination rather than recall. Almost every question is a scenario in which three of the four options are real services that would genuinely work, and one stated requirement - a latency ceiling, a compliance boundary, a recovery point objective, a budget - is what eliminates them. So the course is written around the comparisons: security groups against network ACLs, Multi-AZ against read replicas, CloudFront against Global Accelerator, Savings Plans against Reserved Instances. Every lesson ends with its key terms and further reading, so it works as a reference after the first pass as well as a syllabus during it.

The course does not assume you already know AWS deeply, but the exam assumes roughly a year of hands-on design experience, and reading cannot substitute for that. Pair the modules with an account of your own and build the comparisons you read about. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by Amazon Web Services, Inc.

Module 1: Design Secure Architectures 30% of exam

The largest domain on SAA-C03 and the single biggest reason candidates fail. The module starts with identity, because in AWS every API call is authorized by IAM before anything else happens: users, roles, policy evaluation logic, cross-account role assumption, organization guardrails, and workforce federation through IAM Identity Center.From there it moves to data protection with KMS, Secrets Manager, and TLS termination; to VPC network security through subnets and routing, security groups against network ACLs, and VPC endpoints; and to the edge and detection layer of AWS WAF, Shield, CloudTrail, Config, GuardDuty, Macie, Inspector, and Security Hub. It closes on Amazon S3 access control, the most publicized class of cloud data exposure. The recurring exam pattern is an answer option that is a real service which almost fits but breaks a stated requirement, so the module works through those boundaries explicitly.

1.1 The shared responsibility model and what SAA-C03 actually asks you to design 5 min Free preview
1.2 IAM identities, policies, and how a request is actually authorized 5 min 🔒
1.3 Role assumption, trust policies, and cross-account access patterns 5 min 🔒
1.4 AWS Organizations, service control policies, and permission boundaries 5 min 🔒
1.5 IAM Identity Center, workforce federation, and application identity 5 min 🔒
1.6 AWS KMS, key types, and encryption at rest 5 min 🔒
1.7 Secrets Manager, Parameter Store, and credential rotation 5 min 🔒
1.8 Encryption in transit, ACM, and where TLS terminates 5 min 🔒
1.9 VPC design: subnets, route tables, and gateways 5 min 🔒
1.10 Security groups against network ACLs 5 min 🔒
1.11 VPC endpoints, PrivateLink, and keeping traffic off the internet 5 min 🔒
1.12 Securing hybrid connectivity: VPN, Direct Connect, and Transit Gateway 5 min 🔒
1.13 Edge protection: AWS WAF, Shield, and CloudFront security controls 5 min 🔒
1.14 Detection and audit: CloudTrail, Config, GuardDuty, Macie, Inspector, Security Hub 5 min 🔒
1.15 Controlling access to data in Amazon S3 5 min 🔒

Module 2: Design Resilient Architectures 26% of exam

Availability, durability, and recovery, framed by the two numbers that turn a business requirement into a design: recovery time objective and recovery point objective. The module opens with Regions and Availability Zones and with loose coupling, then covers Elastic Load Balancing, EC2 Auto Scaling, and the messaging services - SQS, SNS, and EventBridge - that let components fail independently.The database half works through the comparisons the exam tests hardest: RDS Multi-AZ against read replicas, Aurora clusters and Aurora Global Database, and DynamoDB Global Tables. It finishes with S3 replication and Object Lock, Route 53 routing policies and health-checked failover, AWS Backup, and the four canonical disaster recovery strategies with the recovery objectives each one actually delivers.

2.1 Regions, Availability Zones, and what high availability means on this exam 5 min 🔒
2.2 Loose coupling, stateless design, and where session state belongs 5 min 🔒
2.3 Elastic Load Balancing: choosing between ALB, NLB, and GWLB 5 min 🔒
2.4 EC2 Auto Scaling groups, health checks, and self-healing fleets 5 min 🔒
2.5 Amazon SQS: queue types, visibility timeout, and dead-letter queues 5 min 🔒
2.6 SNS, EventBridge, and event-driven fan-out 5 min 🔒
2.7 RDS Multi-AZ against read replicas 5 min Free preview
2.8 Aurora clusters, endpoints, and Aurora Global Database 5 min 🔒
2.9 DynamoDB durability, Global Tables, and backups 5 min 🔒
2.10 S3 durability, versioning, and cross-Region replication 5 min 🔒
2.11 Route 53 routing policies, health checks, and DNS failover 5 min 🔒
2.12 Backups, snapshots, and AWS Backup 5 min 🔒
2.13 The four disaster recovery strategies and their RTO and RPO 5 min 🔒

Module 3: Design High-Performing Architectures 24% of exam

Selecting the right resource for a workload, where the recurring theme is the three-way trade-off between latency, throughput, and cost. Storage comes first: block against file against object, S3 storage classes and access patterns, EBS volume types and the three limits that can bind a storage-bound instance, and the EFS and FSx family.Compute follows - instance families and Graviton, Lambda concurrency and cold starts, containers on ECS, EKS, and Fargate, and the four scaling policy types. The module then covers caching with ElastiCache and DAX, choosing among AWS's purpose-built databases, CloudFront against Global Accelerator, network-level tuning through placement groups and enhanced networking, and ingesting data at scale with Kinesis, DataSync, Storage Gateway, and the Snow Family.

3.1 Choosing between block, file, and object storage 5 min 🔒
3.2 S3 storage classes and matching them to an access pattern 5 min 🔒
3.3 EBS volume types, IOPS, and throughput 5 min 🔒
3.4 EFS and the FSx family: choosing a shared file system 5 min 🔒
3.5 Choosing compute: instance families, Graviton, and the serverless question 5 min 🔒
3.6 Lambda, containers, and scaling without servers 5 min 🔒
3.7 Scaling policies: target tracking, step, scheduled, and predictive 5 min 🔒
3.8 Caching with ElastiCache and DynamoDB DAX 5 min 🔒
3.9 Choosing a purpose-built database 5 min 🔒
3.10 CloudFront against Global Accelerator 5 min 🔒
3.11 Network performance: placement groups, enhanced networking, and load balancer choice 5 min 🔒
3.12 Ingesting and moving data at scale 5 min 🔒

Module 4: Design Cost-Optimized Architectures 20% of exam

The smallest domain, but the one where practitioner intuition matters most, and the one candidates most often under-prepare. The exam never asks for a price; it asks which dimension a service charges on and which architectural change removes the charge.The module covers the EC2 purchasing options - On-Demand, Savings Plans, Reserved Instances, Spot, and Dedicated Hosts - and the workload shape that makes each one correct, then designing for Spot interruption. It works through storage cost in S3, EBS, EFS, and backups, including the hidden accumulation in a versioned bucket; the data transfer rules and the recurring NAT gateway trap that gateway VPC endpoints eliminate; database and analytics cost; serverless economics against committed capacity; right-sizing and scheduling; and the tagging, budgets, and reporting that keep spend attributable.

4.1 How AWS pricing works and where cost questions come from 5 min 🔒
4.2 EC2 purchasing options: On-Demand, Savings Plans, Reserved Instances, and Dedicated Hosts 5 min 🔒
4.3 Spot Instances and designing for interruption 5 min 🔒
4.4 Optimizing storage cost in Amazon S3 5 min 🔒
4.5 Cost-optimizing EBS, EFS, and backups 5 min 🔒
4.6 Data transfer charges and the NAT gateway trap 5 min 🔒
4.7 Cost-optimizing databases and analytics 5 min 🔒
4.8 Serverless economics and the build-or-manage decision 5 min 🔒
4.9 Right-sizing, scheduling, and eliminating idle capacity 5 min 🔒
4.10 Cost visibility, allocation, and governance 5 min 🔒

Frequently asked questions about the SAA-C03 training course

Is the SAA-C03 training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official SAA-C03 exam domain, in the order AWS publishes them, with each module weighted to the domain’s published percentage: Design Secure Architectures 30%, Design Resilient Architectures 26%, Design High-Performing Architectures 24%, and Design Cost-Optimized Architectures 20%. Within each module the material is broken into short lessons, followed by key terms and further reading.

Does this replace AWS’s official training?

No. AWS publishes the official SAA-C03 exam guide and free digital training on AWS Skill Builder, and those are the authoritative sources. This course is an independent study companion, written to be read quickly and to slot alongside scenario practice, not a substitute for the official exam guide.

Do I need AWS experience before starting?

For the course, no. For the exam, yes: AWS describes the target candidate as having at least a year of hands-on experience designing cloud solutions with AWS compute, storage, database, and networking services. If you are new to AWS entirely, start with the CLF-C02 training course to build the service vocabulary first, then come back here for the design judgment.

What should I do after finishing the course?

Move to the SAA-C03 practice exam and work scenario sets until you are clearing the mark consistently in all four domains rather than carrying a weak cost or resilience score on a strong security score. Then book through Pearson VUE or PSI.

Is the course current with the latest SAA-C03 outline?

The course is built against the current SAA-C03 exam guide and its four published domains and weightings. AWS can revise the exam guide, and it periodically retires an exam version in favor of a new code; verify the current guide on the AWS certification site before you schedule.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Amazon Web Services, Inc. AWS, Amazon Web Services, and AWS Certified Solutions Architect are trademarks of Amazon.com, Inc. or its affiliates. Use of these marks is solely to identify the certification for which these study materials are intended. The SAA-C03 exam guide and its domain structure are the property of Amazon Web Services, Inc.; candidates should download the official, current exam guide directly from aws.amazon.com and review the free digital training on AWS Skill Builder.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual AWS training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by Amazon Web Services and may change; always verify current details on the AWS certification site before scheduling your exam.