Skip to content
AWS Solutions Architect
~/justmeandlinux

Learn/SAA-C03

AWS Solutions Architect

Every requirement the exam can phrase, and the one service that answers it. You will be asked to produce the answer, not spot it.

0% mastered
Start lesson 1
25 lessons · 286 exercises · 311 facts to master
01

Foundations

  1. 01 Regions, Availability Zones and the shape of AWS “Highly available” means multi-AZ. Only a Region-wide failure justifies multi-Region. Global infrastructure · 11 facts · ~5 min Start →
  2. 02 VPC, subnets and route tables A subnet is public if — and only if — its route table sends 0.0.0.0/0 to an internet gateway. VPC · 11 facts · ~6 min Start →
  3. 03 Getting out: internet gateway, NAT, egress-only The NAT gateway sits in a public subnet. The private route table points at it. Reverse those two and nothing gets out. VPC · 11 facts · ~5 min Start →
  4. 04 Security groups vs network ACLs Security groups are stateful and allow-only. NACLs are stateless, ordered, and can deny. Network security · 11 facts · ~5 min Start →
  5. 05 IAM: users, roles and why you almost never use keys When something inside AWS needs to call AWS, give it a role. Never an access key. IAM · 13 facts · ~6 min Start →
02

Compute & scaling

  1. 06 Choosing compute: EC2, Lambda, containers Event-driven and under 15 minutes → Lambda. Needs an operating system you control → EC2. Containers with nothing to patch → Fargate. Compute · 12 facts · ~6 min Start →
  2. 07 Paying for EC2: On-Demand, Spot, Reserved, Savings Plans Commit for steady baseline load. Bid for anything interruptible. Pay full price only for the unpredictable part on top. Cost · 12 facts · ~6 min Start →
  3. 08 Auto Scaling groups and health checks An Auto Scaling group does two jobs, and people only remember one: it scales, and it replaces anything that fails a health check. Scaling · 12 facts · ~5 min Start →
  4. 09 Load balancing: ALB vs NLB vs Gateway Routing on hostnames, paths or headers means ALB. Extreme throughput, static IPs or non-HTTP protocols means NLB. Load balancing · 13 facts · ~5 min Start →
03

Storage & data

  1. 10 EBS, EFS, FSx and instance store One instance attaches a disk → EBS. Many instances share files → EFS. Windows or SMB → FSx. Storage · 12 facts · ~6 min Start →
  2. 11 S3: durability, versioning and consistency S3 gives eleven nines of durability by replicating across at least three Availability Zones — but nothing protects you from your own delete except versioning. S3 · 12 facts · ~6 min Start →
  3. 12 S3 storage classes and lifecycle rules Every class stores the same data just as durably. You are only ever choosing how fast you can get it back and how much you pay to keep it versus read it. S3 · 13 facts · ~6 min Start →
  4. 13 RDS, Aurora and DynamoDB Fixed schema and joins → RDS. Same, but needing far more speed and scale → Aurora. Key-value at any scale with single-digit millisecond reads → DynamoDB. Databases · 13 facts · ~7 min Start →
  5. 14 Multi-AZ, read replicas and multi-Region Multi-AZ is for availability and its standby serves nobody. Read replicas are for performance and do not fail over automatically. Databases · 12 facts · ~6 min Start →
  6. 15 Caching: ElastiCache, DAX and the read path In front of a relational database use ElastiCache. In front of DynamoDB use DAX. Memcached is only ever the answer when the question says the cache is disposable. Caching · 13 facts · ~5 min Start →
04

Connect & deliver

  1. 16 The edge: CloudFront, Route 53, Global Accelerator Cacheable content → CloudFront. Non-HTTP or static-IP global routing → Global Accelerator. Choosing which endpoint to send someone to → Route 53. Edge · 13 facts · ~6 min Start →
  2. 17 Decoupling: SQS, SNS, EventBridge and Step Functions A queue has one logical consumer pulling work. A topic fans out to many subscribers at once. Needing both is the fan-out pattern: SNS in front of several SQS queues. Integration · 13 facts · ~6 min Start →
  3. 18 KMS, Secrets Manager, Parameter Store and ACM If it must rotate automatically, it is Secrets Manager. If it is just configuration that happens to be sensitive, it is Parameter Store — and free. Encryption · 13 facts · ~6 min Start →
  4. 19 S3 access: policies, Block Public Access, presigned URLs Grant broad access with a bucket policy, temporary access to one object with a presigned URL, and stop the whole class of mistakes with Block Public Access. S3 · 13 facts · ~6 min Start →
  5. 20 VPC endpoints and PrivateLink Gateway endpoints are free and serve only S3 and DynamoDB. Everything else is an interface endpoint, which costs per hour and per GB. VPC · 12 facts · ~5 min Start →
  6. 21 Peering, Transit Gateway, VPN and Direct Connect VPC peering is not transitive and does not scale. Once there are more than a handful of networks, the answer is Transit Gateway. Networking · 13 facts · ~6 min Start →
05

Operate & optimise

  1. 22 CloudWatch, CloudTrail, Config and the detective services CloudWatch watches how it is performing. CloudTrail records who called which API. Config records what the configuration was and whether it complies. Monitoring · 14 facts · ~5 min Start →
  2. 23 Backup and disaster recovery: RPO, RTO and the four strategies RPO is how much data you can afford to lose. RTO is how long you can afford to be down. Find both in the question and the strategy chooses itself. Resilience · 13 facts · ~6 min Start →
  3. 24 Getting data in: Snow, DataSync, Storage Gateway, DMS If the data would take longer to send over the wire than to ship on a disk, ship the disk. That is the entire Snow family argument. Migration · 13 facts · ~5 min Start →
  4. 25 Cost management, and where the bill actually goes Data transfer into AWS is free. Data transfer out, and between Availability Zones, is where the surprises are. Cost · 13 facts · ~5 min Start →