Let’s be real: you don’t need another tutorial defining what an EC2 instance is. If you are targeting the AWS Certified Solutions Architect – Associate (SAA-C03), you likely already know the primitives. The SAA-C03 isn’t just a vocabulary test; it’s a test of your ability to arbitrate trade-offs under constraints.
This AWS SAA-C03 Cheat Sheet is “vibecoded”—stripped of the documentation fluff and optimized for the high-entropy concepts that actually trip up experienced engineers. We are focusing on the sharp edges: complex networking, consistency models, and the specific anti-patterns that AWS penalizes in exam scenarios.
Table of Contents
1. Identity & Security: The Policy Evaluation Logic
Security is the highest weighted domain. The exam loves to test the intersection of Identity-based policies, Resource-based policies, and Service Control Policies (SCPs).
IAM Policy Evaluation Flow
Memorize this evaluation order. If you get this wrong, you fail the security questions.
- Explicit Deny: Overrides everything.
- SCP (Organizations): Filters permissions; does not grant them.
- Resource-based Policies: (e.g., S3 Bucket Policy).
- Identity-based Policies: (e.g., IAM User/Role).
- Implicit Deny: The default state if nothing is explicitly allowed.
Senior Staff Tip: A common “gotcha” on SAA-C03 is Cross-Account access. Even if an IAM Role in Account A has
s3:*, it cannot access a bucket in Account B unless Account B’s Bucket Policy explicitly grants access to that Role AR. Both sides must agree.
KMS Envelope Encryption
You don’t encrypt data with the Customer Master Key (CMK/KMS Key). You encrypt data with a Data Key (DK). The CMK encrypts the DK.
- GenerateDataKey: Returns a plaintext key (to encrypt data) and an encrypted key (to store with data).
- Decrypt: You send the encrypted DK to KMS; KMS uses the CMK to return the plaintext DK.
2. Networking: The Transit Gateway & Hybrid Era
The SAA-C03 has moved heavy into hybrid connectivity. Legacy VPC Peering is still tested, but AWS Transit Gateway (TGW) is the answer for scale.
Connectivity Decision Matrix
| Requirement | AWS Service | Why? |
|---|---|---|
| High Bandwidth, Private, Consistent | Direct Connect (DX) | Dedicate fiber. No internet jitter. |
| Quick Deployment, Encrypted, Cheap | Site-to-Site VPN | Uses public internet. Quick setup. |
| Transitive Routing (Many VPCs) | Transit Gateway | Hub-and-spoke topology. Solves the mesh peeling limits. |
| SaaS exposure via Private IP | PrivateLink (VPC Endpoint) | Keeps traffic on AWS backbone. No IGW needed. |
Route 53 Routing Policies
Don’t confuse Latency-based (performance) with Geolocation (compliance/GDPR).
- Failover: Active-Passive (Primary/Secondary).
- Multivalue Answer: Poor man’s load balancing (returns multiple random IPs).
- Geoproximity: Bias traffic based on physical distance (requires Traffic Flow).
3. Storage: Performance & Consistency Nuances
You know S3 and EBS. But do you know how they break?
S3 Consistency Model
Since Dec 2020, S3 is Strongly Consistent for all PUTs and DELETEs.
Old exam dumps might say “Eventual Consistency”—they are wrong. Update your mental model.
EBS Volume Types (The “io2 vs gp3” War)
The exam will ask you to optimize for cost vs. IOPS.
- gp3: The default. You can scale IOPS and Throughput independent of storage size.
- io2 Block Express: Sub-millisecond latency. Use for Mission Critical DBs (SAP HANA, Oracle). Expensive.
- st1/sc1: HDD based. Throughput optimized. Great for Big Data/Log processing. Cannot be boot volumes.
EFS vs FSx
IF workload == "Linux specific" AND "Shared File System":
Use **Amazon EFS** (POSIX compliant, grew/shrinks auto)
IF workload == "Windows" OR "SMB" OR "Active Directory":
Use **FSx for Windows File Server**
IF workload == "HPC" OR "Lustre":
Use **FSx for Lustre** (S3 backed high-performance filesystem)
4. Decoupling & Serverless Architecture
Microservices are the heart of modern AWS architecture. The exam focuses on how to buffer and process asynchronous data.
SQS vs SNS vs EventBridge
- SQS (Simple Queue Service): Pull-based. Use for buffering to prevent downstream throttling.
Limit: Standard = Unlimited throughput. FIFO = 300/s (or 3000/s with batching). - SNS (Simple Notification Service): Push-based. Fan-out architecture (One message -> SQS, Lambda, Email).
- EventBridge: The modern bus. Content-based filtering and schema registry. Use for SaaS integrations and decoupled event routing.
Pro-Tip: If the exam asks about maintaining order in a distributed system, the answer is almost always SQS FIFO groups. If it asks about “filtering events before processing,” look for EventBridge.
Frequently Asked Questions (FAQ)
What is the difference between Global Accelerator and CloudFront?
CloudFront caches content at the edge (great for static HTTP/S content). Global Accelerator uses the AWS global network to improve performance for TCP/UDP traffic (great for gaming, VoIP, or non-HTTP protocols) by proxying packets to the nearest edge location. It does not cache.
When should I use Kinesis Data Streams vs. Firehose?
Use Data Streams when you need custom processing, real-time analytics, or replay capability (data stored for 1-365 days). Use Firehose when you just need to load data into S3, Redshift, or OpenSearch with zero administration (load & dump).
How do I handle “Database Migration” questions?
Look for AWS DMS (Database Migration Service). If the schema is different (e.g., Oracle to Aurora PostgreSQL), you must combine DMS with the SCT (Schema Conversion Tool).
Conclusion
This AWS SAA-C03 Cheat Sheet covers the structural pillars of the exam. Remember, the SAA-C03 is looking for the “AWS Way”—which usually means decoupled, stateless, and managed services over monolithic EC2 setups. When in doubt on the exam: De-couple it (SQS), Cache it (ElastiCache/CloudFront), and Secure it (IAM/KMS).
For deep dives into specific limits, always verify with the AWS General Reference. Thank you for reading the DevopsRoles page!