What’s Actually on the AWS Solutions Architect Associate Exam Right Now?

The AWS Solutions Architect Associate (SAA‑C03) is no longer a trivia test. Over the past few months, a clear pattern has emerged from Reddit’s r/AWSCertifications, the AWS Training & Certification Slack, and study groups on Discord: **the exam now prizes architectural judgment over memorization.**

If you’re preparing to sit for the exam soon, here’s exactly what recent test‑takers say you’ll see — and the topics where the bar has been quietly raised.

---

The Exam’s Anatomy Right Now

Candidates describe a subtle but important shift from “which service does X” to **“given constraints Y and Z, which combination of services solves the problem with the least operational overhead?”**

Expect 65 questions in 130 minutes. The distribution is still heavily weighted toward **Design Resilient Architectures** (30%) and **Design High‑Performing Architectures** (28%). But within those domains, the emphasis has moved.

1. IAM and Organizations Are Not an Afterthought Anymore

If you browse recent pass/fail threads, one theme jumps out: **multi‑account governance.** You’ll see scenarios where a company has 20 or 50 accounts under AWS Organizations. Questions won’t ask you to define an SCP; they’ll ask things like:

“A developer accidentally deleted a VPC Flow Log. How would you prevent this across all accounts while still allowing full EC2 access?”

“Which combination of SCPs, permission boundaries, and IAM roles delivers a specific guardrail *and* still lets a data scientist spin up a SageMaker notebook?”

Some candidates noted that **permission boundaries** showed up far more often than practice tests suggested. You need to know when an SCP alone is insufficient because it can’t restrict actions in the management account.

2. Serverless First, but With a Catch

Lambda, API Gateway, Step Functions, and EventBridge are mainstream. The exam no longer asks “What is Lambda?” Instead, it presents a migration scenario:

“An on‑premises monolithic .NET application runs 12 hours a day, has unpredictable idle time, and state must be preserved. How do you move it to AWS with minimal refactoring?”

The answer, according to a handful of July and August test‑takers, is usually **not** pure Lambda. It’s Amazon ECS with Fargate, or a hybrid with SQS for decoupling. The exam tests your ability to reject serverless when it’s not the right fit — a sign of maturity in the certification.

3. Storage Deep Links: S3 + Glacier + FSx

Simple “S3 IA vs. Glacier” questions are rare now. Instead, the exam chains storage with data‑analysis requirements:

A medical imaging company must keep 10‑year archives, occasionally retrieve studies within 5 minutes, and run Hadoop jobs on the latest 90 days. Which S3 storage classes and lifecycle rules minimize cost while meeting the RTO?

Recent threads cite **S3 Intelligent‑Tiering** as a red herring in such questions (it only auto‑tiers between IA tiers, not Glacier). Real exam questions expect you to explicitly design lifecycle policies that transition from S3 Standard → S3 Standard‑IA → S3 Glacier Deep Archive, and then use S3 Batch Operations to restore objects when needed.

Additionally, **FSx for Windows File Server** and **FSx for Lustre** appear in lift‑and‑shift and HPC contexts respectively. One Redditor mentioned a question where a legacy Windows application required a shared file system with Active Directory integration, and the correct answer was not Storage Gateway but FSx with an AWS Managed AD connector.

4. Networking That Demands Deep Familiarity

VPC fundamentals still appear, but the complexity has moved to hybrid connectivity:

VPC Peering vs. Transit Gateway — you’ll get questions with 5 or 6 VPCs that need isolated inter‑region communication. The trap is picking peering (manually creating a full mesh is an operational nightmare) when Transit Gateway with inter‑region peering attachments is the correct scalable answer.

**AWS PrivateLink** vs. **VPC Endpoint** (gateway vs. interface). Questions now explicitly mention “on‑premises” and “HTTPS” to steer you away from a gateway endpoint (only supports S3 and DynamoDB).

**Route 53 Resolver DNS Firewall** and **Route 53 Resolver outbound endpoints** appeared in 3 out of 5 recent “I passed!” posts. You must understand when to use each to forward DNS queries from on‑premises to the cloud and vice versa.

5. Cost Optimization Is Often the Tie‑breaker

When two architectures both meet the functional requirement, look for the one with the **fewer committed resources.** According to a July 2024 thread on r/AWSCertifications, the exam frequently offers two valid technical solutions; the deciding factor is cost. Know:

**Compute Savings Plans** vs. **Reserved Instances** (which one applies to Lambda? — Savings Plans).

**S3 Storage Lens** and **AWS Cost Explorer** as tools to identify cost anomalies.

When **Spot Instances** are appropriate (fault‑tolerant, stateless workloads) and when they are not (stateful databases).

---

Question Formats You Will See

**“Most operationally efficient”** — appears in nearly half of all scenario questions. This signals “managed services” (Aurora Serverless, DynamoDB, ECS Fargate) over self‑managed alternatives.

**“Least possible changes”** — a hint to preserve the existing architecture as much as possible. You may need to add a CloudFront distribution or turn on S3 Transfer Acceleration rather than redesign the entire ingestion pipeline.

**Multi‑choice with multiple must‑pick options** — some questions now have 3 out of 5 choices, and you must select all correct ones to get credit. No partial scores.

---

How Sapior Thinks About This

We’re seeing engineers bring these exact scenarios into their cloud infrastructure code on Sapior. The move toward architectural thinking means your IaC stacks must bake in SCPs, organization‑level controls, and cost‑efficient tiering from day one — not as an afterthought. If you’re building internal developer platforms, treat the SAA‑C03 topics as a blueprint for what a mature multi‑account environment looks like.

The certification’s relevance goes beyond a badge. It’s now an accurate litmus test for whether you can design secure, cost‑aware, and resilient systems on modern AWS. Just ask the people who passed it last week.