AWS Certified Solutions Architect – Associate (SAA-C03) study board

AWS Certified Solutions Architect – Associate (SAA-C03): hand-drawn mind map, 1,470 flashcards and 1,042 practice questions. Free preview, $29.99 one-time.

Exam version: Follows AWS's current exam guide for SAA-C03 (AWS Documentation edition, copyright 2026). Checked 23 October 2026; AWS has announced no successor.

What you get

• 32 hand-drawn sheets: every exam objective on its own sheet, in reading order
• 1,470 flashcards written from the cards on the map, that come back just before you'd forget
• 1,042 original practice questions, each graded with the answer explained
• A Treemap of every card the flashcards and practice questions cover, painted by the score you have earned on it, so you can see what is left
• Bookmarks and sticky notes, saved to your account
• One payment of $29.99: no subscription, no expiry date

Who it is for

People studying for AWS Certified Solutions Architect – Associate (SAA-C03) on their own who learn best by seeing how topics connect, and who want one place to read the map, recall it with flashcards, prove it on practice questions and see their progress on a Treemap.

Who it is not for

It is not a hands-on lab, not a full video course and not a replacement for practising on real equipment or software.

Free preview: what is on the board

• Start here
  • How to use this map
    • Big idea: every SAA question is a design review
    • One task statement per sitting
    • Getting around the AWS map
    • Reading an AWS card
    • Marks on the AWS map
    • One service, four angles
    • Qualifiers that pick the answer
  • The exam at a glance
    • Big idea: the exam grades designs, not facts
    • SAA-C03 format and scoring
    • Where the SAA-C03 marks are
    • Six pillars as the answer filter
    • How the domains map to pillars
    • How do you read a long SAA stem?
    • Which outline this board follows
    • Check yourself: reading SAA stems
• Design Secure Architectures (30%)
  • 1.1a Identities, roles and federation
    • Big idea: no long-term keys, ever
    • Which identity should make the call?
    • Root user and MFA
    • Users, groups, roles and policies
    • How AWS decides allow or deny
    • Roles in action: STS and switching
    • Federation and directories
    • Check yourself: identities and roles
  • 1.1b Multi-account access and guardrails
    • Big idea: accounts are the strongest wall
    • Which guardrail fits?
    • Shared responsibility and global layout
    • AWS Organizations and guardrails
    • Reaching across accounts
    • Check yourself: multi-account guardrails
  • 1.2a VPC security and private connectivity
    • Big idea: nothing in a private subnet is reachable
    • Which network control fits?
    • A three-tier VPC with private data
    • Security groups and network ACLs
    • Segmentation with subnets and routes
    • Service endpoints and PrivateLink
    • Securing links to the data centre
    • Check yourself: VPC security
  • 1.2b Protecting applications and secrets
  • 1.3a Encryption and key management
  • 1.3b Data governance, retention and recovery
• Design Resilient Architectures (26%)
  • 2.1a Loose coupling and messaging
  • 2.1b Scaling, load balancing and tiers
  • 2.1c Containers, serverless and services
  • 2.2a Global infrastructure and failover
  • 2.2b Disaster recovery and durability
  • 2.2c Automation, visibility, legacy apps
• Design High-Performing Architectures (24%)
  • 3.1 Storage for performance and scale
  • 3.2a Compute services and sizing
  • 3.2b Elastic scaling and decoupling
  • 3.3a Choosing a database
  • 3.3b Scaling, connections and caching
  • 3.4a Edge services and placement
  • 3.4b Network design and connectivity
  • 3.5a Ingestion, streaming and transfer
  • 3.5b Data lakes, ETL and analytics
• Design Cost-Optimized Architectures (20%)
  • 4.1a Choosing and tiering storage
  • 4.1b Moving, protecting and sizing storage
  • 4.1c Seeing and steering spend
  • 4.2a Paying less for the same compute
  • 4.2b Right service, size and scaling
  • 4.3a Choosing and sizing the database
  • 4.3b Running databases for less
  • 4.4a Data transfer, NAT and endpoints
  • 4.4b Connections, routing and delivery

Sample flashcard

On AWS, which identity service should your own staff use to sign in, and which should your app's customers use?

Staff sign in through IAM Identity Center linked to the corporate identity provider; an app's customers sign in through an Amazon Cognito user pool.

Sample practice question

A logistics company runs a nightly reconciliation job on 20 Amazon EC2 instances in an Auto Scaling group. The job reads input files from an S3 bucket and writes results to an Amazon DynamoDB table. Today each instance reads an access key pair from a properties file baked into the AMI. A security review requires that no long-term credentials exist on the instances, and the operations team has only two people. Which solution meets these requirements with the LEAST operational overhead?

• A. Move the key pair into a SecureString parameter in Systems Manager Parameter Store and have the job fetch it on each instance at startup
• B. Create an IAM role scoped to the bucket and table, attach it through an instance profile in the launch template, and delete the keys
• C. Create an IAM user for each instance from a launch script, scope it to the bucket and table, and rotate its keys with a monthly cron job
• D. Store the key pair in AWS Secrets Manager with a scheduled rotation function, and have the job read the current secret before each run

Answer: B. An instance profile hands the role's temporary credentials to the instances through the instance metadata service, and the SDK refreshes them automatically, so no long-term secret remains. Parameter Store and Secrets Manager hide the key better, but it is still a long-term access key, and rotation adds work. Per-instance IAM users multiply the keys to manage, which is the opposite of the requirement.

Questions

Do I download the AWS Certified Solutions Architect – Associate (SAA-C03) board?

No. Boards open on the website in your browser, on a computer or a phone, once you sign in. Your flashcard progress, bookmarks and test results are saved to your account.

How long do I keep access?

It is a one-time purchase with no subscription and no expiry date.

Can I try it before I buy?

Yes. Every board has a free preview: the introduction, the first three sheets of the first domain and ten sample questions, with no account needed.

What if the exam changes?

This board follows one exam version (SAA-C03). Check that it matches the exam you are booking before you buy.

What is the refund policy?

You can ask for a refund within 7 days of buying, with no reason needed. Details are in the Refund Policy.

AWS Certified Solutions Architect – Associate (SAA-C03) · All study boards · About

Terms · Privacy · Refunds · Contact

BoardITGuy is not affiliated with or endorsed by ISC2, ISACA, Cisco, CompTIA or Amazon Web Services. Product names are trademarks of their owners and are used only to say which exam a board is for.