Play free

AWS · Certification path · SAA-C03

SAA-C03: Solutions Architect - Associate

60 stages in study order, about 25.5 hours to complete, drawn from Networking, Data engineering, Security and Core architecture. Each stage names the section of the SAA-C03 exam guide it practises.

Open the path in the game The exam guide

The path, in study order

60 stages5 free without buying

  1. 1Volumes That FitFreeCore architecture · Architecture World 1 · Task 3.1, Task 4.1
  2. 2Shared by ManyCore architecture · Architecture World 1 · Task 3.1, Task 4.1
  3. 3Objects at ScaleCore architecture · Architecture World 1 · Task 3.1, Task 4.1
  4. 4Bridge to the HarbourCore architecture · Architecture World 1 · Task 3.1, Task 4.1
  5. 5Back It UpCore architecture · Architecture World 1 · Task 1.3, Task 2.2, Task 4.1, Task 4.3
  6. 6Storage DeskCore architecture · Architecture World 1 · Task 3.1
  7. 7Pick the EngineCore architecture · Architecture World 2 · Task 3.3, Task 4.3
  8. 8Survive the ZoneCore architecture · Architecture World 2 · Task 2.2, Task 3.3
  9. 9Aurora's WayCore architecture · Architecture World 2 · Task 2.2, Task 3.3, Task 4.3
  10. 10Capacity UnitsCore architecture · Architecture World 2 · Task 3.3, Task 4.3
  11. 11Cache ItCore architecture · Architecture World 2 · Task 3.3, Task 4.3
  12. 12Database DeskCore architecture · Architecture World 2 · Task 3.3
  13. 13Pick the ComputeCore architecture · Architecture World 3 · Task 3.2, Task 4.2
  14. 14Balance the LoadCore architecture · Architecture World 3 · Task 2.1, Task 2.2, Task 4.2
  15. 15Scale on a SignalCore architecture · Architecture World 3 · Task 2.1, Task 3.2, Task 4.2
  16. 16Lose a ZoneCore architecture · Architecture World 3 · Task 2.2
  17. 17Across RegionsCore architecture · Architecture World 3 · Task 2.2, Task 1.3
  18. 18Fleet DeskCore architecture · Architecture World 3 · Task 2.2, Task 3.2
  19. 19Queue or TopicCore architecture · Architecture World 5 · Task 2.1, Task 3.2
  20. 20Scale on the BacklogCore architecture · Architecture World 5 · Task 2.1, Task 3.2
  21. 21Fan OutCore architecture · Architecture World 5 · Task 2.1
  22. 22Functions Under LoadCore architecture · Architecture World 5 · Task 2.1, Task 3.2, Task 4.2
  23. 23Front DoorCore architecture · Architecture World 5 · Task 2.1
  24. 24Decoupling DeskCore architecture · Architecture World 5 · Task 2.1
  25. 25Pick the PlatformCore architecture · Architecture World 4 · Task 2.1, Task 3.2, Task 4.2
  26. 26Task and ServiceCore architecture · Architecture World 4 · Task 2.1, Task 3.2
  27. 27Containers That ScaleCore architecture · Architecture World 4 · Task 2.1, Task 3.2, Task 4.2
  28. 28Pay Less, Size RightCore architecture · Architecture World 6 · Task 4.1, Task 4.2, Task 4.3
  29. 29Modernise ItCore architecture · Architecture World 6 · Task 2.1
  30. 30Open for BusinessFreeNetworking · World 1 · Task 1.2, Task 3.4
  31. 31Private but ConnectedFreeNetworking · World 1 · Task 1.2, Task 4.4
  32. 32Guard RailsNetworking · World 1 · Task 1.2
  33. 33Shortcut to S3Networking · World 1 · Task 1.2, Task 4.4
  34. 34Across the FenceNetworking · World 2 · Task 3.4, Task 4.4
  35. 35Hub and SpokeNetworking · World 2 · Task 3.4, Task 4.4
  36. 36Tunnel VisionNetworking · World 2 · Task 1.2, Task 3.4
  37. 37Dedicated LineNetworking · World 2 · Task 1.2, Task 3.4, Task 4.4
  38. 38Service BridgeNetworking · World 2 · Task 3.4
  39. 39Two RegionsNetworking · World 3 · Task 2.2, Task 3.4
  40. 40Global EdgeNetworking · World 4 · Task 3.4
  41. 41Shape the FilesFreeData engineering · Data World 1 · Task 3.5
  42. 42Keep, Tier, ExpireData engineering · Data World 1 · Task 4.1
  43. 43Right PipeData engineering · Data World 2 · Task 3.5
  44. 44Pick the StreamData engineering · Data World 3 · Task 3.5, Task 2.1
  45. 45Land It in S3Data engineering · Data World 3 · Task 3.5
  46. 46Queue ItData engineering · Data World 3 · Task 2.1
  47. 47Lock the DataData engineering · Data World 4 · Task 1.3
  48. 48Pick the StoreData engineering · Data World 5 · Task 3.3, Task 4.3
  49. 49Deny WinsFreeSecurity · Security World 1 · Task 1.1
  50. 50Trust Both WaysSecurity · Security World 1 · Task 1.1
  51. 51Who Are YouSecurity · Security World 1 · Task 1.1, Task 1.2
  52. 52Fence the OrgSecurity · Security World 2 · Task 1.1
  53. 53Key Policy FirstSecurity · Security World 3 · Task 1.3
  54. 54At Rest EverywhereSecurity · Security World 3 · Task 1.3
  55. 55On the WireSecurity · Security World 3 · Task 1.3
  56. 56Hold the LineSecurity · Security World 3 · Task 1.3
  57. 57Secrets and MasksSecurity · Security World 3 · Task 1.2
  58. 58Front DoorSecurity · Security World 4 · Task 1.2
  59. 59Weather the StormSecurity · Security World 4 · Task 1.2
  60. 60Finding RunSecurity · Security World 5 · Task 1.2

Articles on SAA-C03

One topic each, from the documentation, ending at a stage you can play

SAA-C03 · Networking

How a private subnet reaches the internet: the NAT gateway, hop by hop

A NAT gateway lets private instances start connections out while nothing on the internet starts one in. Follow every hop, and see the address the far end sees.

Ends at Private but Connected Free at release6 min read · video coming

SAA-C03 · Networking

Security group or network ACL: which one dropped the packet?

Security groups are stateful and only allow. Network ACLs are stateless, numbered and can deny. Follow one HTTPS request to see which layer drops what.

Ends at Guard Rails Paid5 min read · video coming

SAA-C03 · Networking

What actually makes a subnet public

Not its name, not a public IP, not the gateway alone. The subnet's route table decides, and the main route table decides for every subnet you forgot.

Ends at Open for BusinessFree5 min read · video coming

SAA-C03 · Networking

Why can't my private subnet reach S3? Gateway and interface endpoints

With no internet gateway or NAT, a private subnet can still reach AWS services. A gateway endpoint adds a route; an interface endpoint adds an address.

Ends at Shortcut to S3 Paid5 min read · video coming

SOA-C03 · Core architecture

gp3, io2, st1 or sc1: choosing an EBS volume by the numbers

gp3 includes 3,000 IOPS at any size, io2 is the sub-millisecond volume, st1 sells throughput by the TiB, and the instance sets the last ceiling.

Ends at Volumes That FitFree5 min read · video coming

SCS-C03 · Security

How AWS decides a request: why an explicit deny always wins

Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.

Ends at Deny WinsFree5 min read · video coming

SCS-C03 · Security

Identity policy or bucket policy: which one has to allow?

In one account, either side can allow. Across accounts, both must. An account principal only delegates, and Block Public Access overrides a public policy.

Ends at Deny WinsFree6 min read · video coming

DEA-C01 · Data engineering

Why Athena reads 1.2 TB to answer a four-column query

Athena bills the bytes it scans. Text is read whole; Parquet and ORC read only the columns a query names. How format, compression and file size set the bill.

Ends at Shape the FilesFree5 min read · video coming

Every article on SAA-C03

Guide sections the path practises

SectionAs the guide words itStages
Task 1.1Design secure access to AWS resources4
Task 1.2Design secure workloads and applications11
Task 1.3Determine appropriate data security controls7
Task 2.1Design scalable and loosely coupled architectures14
Task 2.2Design highly available and/or fault-tolerant architectures8
Task 3.1Determine high-performing and/or scalable storage solutions5
Task 3.2Design high-performing and elastic compute solutions9
Task 3.3Determine high-performing database solutions7
Task 3.4Determine high-performing and/or scalable network architectures8
Task 3.5Determine high-performing data ingestion and transformation solutions4
Task 4.1Design cost-optimized storage solutions7
Task 4.2Design cost-optimized compute solutions7
Task 4.3Design cost-optimized database solutions7
Task 4.4Design cost-optimized network architectures5

A domain and a path are separate products. What you own is the union of what you bought, so a stage you already own is never sold to you twice: the game offers the cheapest way to unlock the stage in front of you. Path $15, exam $150.