Last-Minute SAA-C03 Revision Notes: A Pragmatic Cram Sheet

The night before your AWS Solutions Architect Associate exam isn’t for deep dives—it’s for reinforcement. This page collects the high-signal concepts, architectural patterns, and service selection logic that turn 60 minutes of review into passing score.

*Why this matters.* The exam blueprint (SAA-C03) allocates 24% to Resilient Architectures, 28% to High-Performing Architectures, 26% to Security, and 20% to Cost Optimization[^1]. The questions consistently test your ability to choose between services based on cost, performance, and operational overhead—not to recite definitions.

Core Service Matrix

Compute & Containers

**EC2**: When you need OS-level control, license mobility, or long-running stable workloads. Instance types vary; know burstable (T3), compute optimized (C6g), memory optimized (R6g), and GPU (P4).

**Lambda**: Stateless, event-driven, up to 15‑minute timeout. Ideal for image processing, API backends, and glue logic. Watch out for cold starts—provisioned concurrency if latency sensitive.

**ECS/EKS**: Container orchestration. ECS is deeply integrated with AWS; use Fargate for serverless containers, EC2 launch type for more control.

**Elastic Beanstalk**: PaaS for quick deployment; abstracts underlying resources but still gives visibility.

Storage

**S3**: Durability 11 9’s. Understand storage classes: S3 Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive. Lifecycle policies transition between classes. Use S3 Transfer Acceleration for fast uploads over public internet.

**EBS**: Block storage. GP3 (general purpose SSD) is default burstable; gp2 also exists. Provisioned IOPS (io1/io2) for high-performance databases. Throughput Optimized HDD (st1) for big data. Cold HDD (sc1) for infrequent. Snapshots are incremental and can be copied across regions.

**EFS**: NFS file share for Linux, scales automatically, can be mounted across AZs. EFS Infrequent Access for less-accessed data.

**FSx**: Windows File Server (SMB) or Lustre for HPC.

Databases

**RDS**: Managed relational. Multi-AZ (synchronous standby) for high availability, Read Replicas for read scaling (up to 5). Automated backups with retention up to 35 days. Supported engines: Aurora, MySQL, PostgreSQL, MariaDB, Oracle, SQL Server.

**Aurora**: MySQL/PostgreSQL-compatible, with 5x throughput of standard MySQL. Serverless option for intermittent workloads. Aurora Global Database for cross-region DR with <1 second lag. Backtrack to rewind without restore.

**DynamoDB**: NoSQL, single-digit millisecond latency. Key concepts: partition key, sort key, LSI (local, same partition), GSI (global, different partition). On-demand or provisioned capacity; pay-per-request. DynamoDB Accelerator (DAX) for microsecond read caching. Time to Live (TTL) for automatic expiry.

**ElastiCache**: Memcached (multi-threaded, simple caching) or Redis (rich data structures, replication, pub/sub). Use for session stores, leaderboards, and caching DB queries.

**Redshift**: Columnar data warehouse for analytics, with Redshift Spectrum to query directly from S3.

Networking & Content Delivery

**VPC**: Know CIDRs, subnets (public/private), route tables, internet gateways, NAT gateways (managed, AZ-specific vs. NAT instance self-managed). Security Groups (stateful, allow rules only) vs. NACLs (stateless, allow/deny at subnet level).

**VPC Endpoints**: Gateway endpoints (S3, DynamoDB) free and private connectivity; Interface endpoints (other services) powered by PrivateLink, cost hourly.

**Route 53**: DNS service. Routing policies: Simple, Weighted, Latency, Failover, Geolocation, Geoproximity, Multi-Value Answer. Private hosted zones for internal domains. Health checks tie to failover.

**CloudFront**: CDN with global edge locations. Integrates with S3, ALB, and Lambda@Edge. Signed URLs/Cookies for restricted content. OAC (Origin Access Control) for S3. Understand cache behaviors, TTL, invalidation.

**Global Accelerator**: Routes traffic over AWS global network, improves performance for global apps, provides static anycast IPs.

Security & Identity

**IAM**: Users, Groups, Roles (temporary credentials). Policies (JSON) evaluate explicit deny > explicit allow > implicit deny. IAM Roles for EC2, Lambda, cross-account access. Know the difference between IAM users and directory-based federation via SAML 2.0.

**Cognito**: User pools (authentication) and identity pools (authorization, AWS credentials). OIDC/SAML for social identity providers.

**KMS**: Symmetric keys (AES-256) for encryption at rest. Envelope encryption with data key. KMS grants for cross-account access.

**ACM**: SSL/TLS certificates, free, auto-renewal. Must be in us-east-1 for CloudFront.

**Shield**: Standard (free, protects against common L3/L4 DDoS) / Advanced (costly, additional L7 mitigation and cost protection). WAF protects against SQL injection, XSS; integrates with CloudFront, ALB, API Gateway.

Management & Governance

**CloudWatch**: Metrics, logs, events. Standard resolution 1 min, detailed 1 sec. Logs groups → streams. CloudWatch Alarms trigger actions (auto scaling, SNS). Logs Insights for querying.

**CloudTrail**: Records API calls for auditing. Enable multi-region trail and log file integrity validation.

**AWS Config**: Resource compliance, timeline of configuration changes. Rules for desired states (e.g., S3 bucket public). Send to SNS/Lambda for remediation.

**Organizations & Control Tower**: Multi-account management. SCPs to restrict permissions at OU level. Consolidated billing for volume discounts. AWS Control Tower sets up Landing Zones with guardrails.

Application Integration & Decoupling

**SQS**: Always decouple. Standard (at-least-once, high throughput) vs. FIFO (exactly-once, limited TPS). Visibility timeout, dead-letter queues (DLQs), long polling (reduce cost). SQS + ASG for scaling.

**SNS**: Pub/sub. Fanout to SQS, Lambda, email, SMS, HTTP. FIFO topics for ordering. Message filtering based on attributes.

**EventBridge**: Serverless event bus, extends CloudWatch Events with SaaS integrations. Schema registry.

**Step Functions**: Visual workflows for serverless orchestration. Standard (exactly-once) and Express (high event rate) types. Use for complex error handling.

**API Gateway**: REST APIs (works with Lambda, HTTP, Mock) and HTTP APIs (cheaper, simpler). Throttling, caching, CORS, and API keys. Cognito authorizer or Lambda authorizer.

Architectural Patterns You’ll See Repeatedly

High Availability & Disaster Recovery

**Multi-AZ**: RDS, ElastiCache Redis, and load balancers span AZs automatically. Use Auto Scaling groups across AZs to handle AZ failure.

**DR Strategies**: Order by RTO/RPO. Backup & Restore (cheapest): S3 cross-region replication, RDS snapshots to DR region. Pilot Light: core services running but scaled down. Warm Standby: scaled-down but functional stack, further reduces RTO. Multi-Site Active/Active: full production stack, using Route 53 weighted routing or Global Accelerator for failover—only option for near‑zero RTO[^2].

**S3 Cross-Region Replication**: Replicates objects automatically, versioning enabled needed. Can replicate to different storage class. Use for compliance and DR. S3 Multi-Region Access Points for multi-region request routing.

Decoupling for Scale

Process with SQS→Lambda or SNS→SQS→Lambda. Use dead-letter queues to capture failures; configure CloudWatch Alarms on DLQ depth.

Real-time stream with Kinesis Data Streams; retains 24h (default) up to 365 days. Kinesis Data Firehose for near real‑time loading into S3, Redshift, OpenSearch.

Asynchronous processing with API Gateway → SQS → Lambda, avoiding throttling.

Caching

**CloudFront**: Edge caching for static and dynamic content. Use Cache-Control headers, origin shield for reducing load on origin.

**ElastiCache**: In-memory cache. Use Redis for leaderboards, caching DB queries, session store. Use Memcached for simple object caching. Lazy loading vs. write‑through patterns.

**DAX**: Dedicated cache for DynamoDB, reduces read latency to microseconds. Doesn’t require code changes if using DynamoDB APIs.

Cost Optimization Essentials

**Right‑sizing**: Compute Optimizer recommends instances. Use Savings Plans (Compute and EC2 Instance) or Reserved Instances for predictable workloads.

**S3 lifecycle policies**: Transition objects to cheaper tiers and expire old versions.

**Auto Scaling**: Schedule and dynamic scaling to match demand; avoid over-provisioning.

**Spot Instances**: For fault‑tolerant workloads (up to 90% off), combine with Auto Scaling groups using mixed instances policies.

**Consolidated billing** and SCPs to manage costs across accounts.

**AWS Budgets** and Cost Explorer to track spend.

Signal vs. Noise: What NOT to Memorize Last Day

Do not spend time memorizing instance types by name—focus on use‑case categories.

Skip exact limits (e.g., 5 VPCs per region); exam expects you to know scalable limits but not precise numbers.

Avoid deep dive into niche services like OpsWorks, Sumerian, or MediaConvert unless you have seen them in practice exams.

Instead, review the common pitfalls list:

1. **Security Groups vs NACLs**: SGs are stateful, allow only; return traffic automatically allowed. NACLs are stateless, require both inbound and outbound rules.

2. **NAT Gateway**: Placed in public subnet, route private subnets’ 0.0.0.0/0 to it for outbound internet only. Not for inbound.

3. **S3 bucket policies vs IAM**: Bucket policy controls access to bucket itself; IAM policy applies to principal. Bucket policies are necessary for cross-account access and public access configuration.

4. **Route 53 alias records**: Free, can point to AWS resources (ALB, CloudFront, S3 website redirect), support apex domain (root). CNAME cannot be used at apex.

5. **Database failover**: Multi-AZ RDS uses synchronous replication and fails over to standby, keeping the same endpoint (CNAME) — no app changes needed. Multi-AZ Aurora keeps read replicas in different AZs; if writer fails, one replica becomes writer.

6. **IAM roles vs temporary credentials**: Best practice: avoid long‑term access keys, use roles for EC2/Lambda. STS for temporary credentials.

The Night‑Before Checklist

1. Re‑read the official exam guide for SAA-C03[^1] to remind yourself of domain weightings.

2. Skim the AWS Well‑Architected Framework whitepaper’s five pillars[^3] — especially security and cost optimization.

3. Review at least 3–5 practice questions covering VPC design, storage class selection, disaster recovery, and decoupling.

4. Write down the services you consistently mistake for one another (e.g., SQS vs Kinesis, RDS vs DynamoDB, Redshift vs Athena) and create a one‑liner distinction.

5. Get a full night’s sleep.

The exam rewards architectural reasoning, not rote knowledge. With these revision notes, you’ll walk into the test center with a crisp mental model of AWS services and the patterns that solve real‑world problems.

[^1]: AWS Certified Solutions Architect – Associate (SAA-C03) Exam Guide, AWS Training and Certification.

[^2]: Disaster Recovery of Workloads on AWS: Recovery in the Cloud, AWS Whitepaper.

[^3]: AWS Well-Architected Framework, AWS Whitepaper.