Domain 1: Architecture Design and Implementation Built for the Cloud
- Amazon SQS decouples producers from consumers so each scales independently; standard queues offer at-least-once delivery and best-effort ordering, while FIFO queues guarantee exactly-once processing and strict ordering within a message group.
- SQS FIFO uses MessageGroupId to preserve ordering per group (e.g., per customer) while allowing parallel processing across groups; ContentBasedDeduplication or a MessageDeduplicationId enforces exactly-once over a 5-minute window. With Amazon Kinesis, the partition key decides the shard and therefore the ordering scope.
- SNS fan-out publishes one message to a topic that delivers to multiple subscribers (SQS queues, Lambda, HTTP); EventBridge routes events with content-based filtering rules and supports cross-account and cross-Region event buses for event forwarding between accounts and Regions.
- Store session and application state in an external store such as Amazon DynamoDB, Amazon S3, or Amazon ElastiCache so any instance behind a load balancer can serve any request, keeping the compute tier stateless and horizontally scalable.
- Serverless data pipelines combine Amazon Kinesis Data Streams for ingestion, AWS Lambda or AWS Glue for transformation, and Amazon Athena for SQL queries on data in S3; multi-step workflows that need durable execution, retries, and long waits use AWS Step Functions or durable Lambda functions.
- Container orchestration for microservices uses Amazon ECS or Amazon EKS, with AWS Fargate removing host management (Fargate tasks use awsvpc network mode); Amazon VPC Lattice and ECS Service Connect handle service-to-service communication, and Amazon ECR image scanning and lifecycle policies manage container images.
- Auto scaling for serverless and container workloads uses Lambda concurrency controls (provisioned concurrency removes cold starts), the Kubernetes Horizontal Pod Autoscaler for pods, Cluster Autoscaler for nodes, ECS service auto scaling, and AWS Application Auto Scaling.
- Choose ingress by traffic type: Application Load Balancer for HTTP routing, Network Load Balancer for layer 4 traffic, the AWS Load Balancer Controller to provision them from EKS, and Amazon API Gateway for managed APIs, including WebSocket APIs for real-time publish-subscribe patterns.
- Edge architectures meet latency targets with CloudFront Functions for lightweight viewer request and response logic and Lambda@Edge for heavier processing; CloudFront origin access control (OAC) secures S3 origins.
- Multi-tenant designs choose between siloed and pooled resources and enforce tenant isolation with Amazon Cognito tenant context, row-level security in the database, and tenant-specific encryption keys.
- Generative AI integrations use Amazon Bedrock, including multi-account deployment patterns; AI agents that call tools are built with Amazon Bedrock AgentCore, and RAG designs use Amazon Bedrock Knowledge Bases to ingest content into a vector store and retrieve relevant passages at query time.
- Amazon SageMaker AI endpoints host ML models for inference; the exam tests inference architecture, while model training, fine-tuning, and data science workflows are out of scope for the target candidate.
- Hybrid connectivity pairs AWS Direct Connect with AWS VPN for redundancy and failover through AWS Transit Gateway; hybrid compute options are Amazon EKS Anywhere, Amazon ECS Anywhere, AWS Outposts, and AWS Local Zones, and AWS DataSync, AWS Storage Gateway, and AWS Transfer Family synchronize hybrid data.
- Route 53 Resolver inbound endpoints let on-premises resolve AWS private DNS; outbound endpoints plus forwarding rules let VPC resources resolve on-premises domains over Direct Connect or VPN, supporting split-horizon DNS and conditional forwarding.
- Transit Gateway is the hub-and-spoke router for connecting many VPCs and on-premises networks; AWS PrivateLink exposes a service privately across VPCs and accounts without peering or internet exposure, and Amazon VPC IP Address Manager (IPAM) plans address space and subnet strategies, including IPv6 adoption and dual-stack migration.
- Network security layers AWS Network Firewall and Gateway Load Balancers for traffic inspection, AWS WAF for application layer protection (SQL injection, XSS, rate-based rules), security groups and network ACLs for filtering, and VPC Flow Logs for visibility; Route 53 routing policies and AWS Global Accelerator route global multi-Region traffic.
- Data lake and lakehouse designs store data in Amazon S3 with AWS Lake Formation permissions, Apache Iceberg tables, and Amazon Redshift Spectrum queries; the AWS Glue Data Catalog, Lake Formation, and AWS Clean Rooms support cataloging and cross-account data sharing, and Amazon EMR, Amazon Redshift, Amazon MSK, and Amazon AppFlow cover real-time and batch analytics.
- Select databases by access pattern, consistency, and scale (Amazon RDS, Aurora, DynamoDB, Redshift); scale for availability with RDS Multi-AZ (synchronous standby, not read scaling), read replicas (asynchronous read scaling), Aurora Global Database, and DynamoDB global tables, and cache with ElastiCache or DynamoDB Accelerator (DAX) for microsecond DynamoDB reads.
Domain 2: Security, Compliance, and Governance
- AWS IAM Identity Center provides centralized workforce SSO and permission sets across all accounts, and integrates with external IdPs via SAML 2.0 and SCIM for automated user and group provisioning.
- Amazon Cognito user pools authenticate application users and issue OAuth 2.0 and OpenID Connect tokens, while identity pools exchange those identities for temporary AWS credentials; Amazon EKS Pod Identity gives Kubernetes pods IAM permissions.
- Cross-account access is best done with IAM roles and sts:AssumeRole; for third-party access, require an ExternalId condition to prevent the confused-deputy problem. Permissions boundaries, session policies, and attribute-based access control (ABAC) on tags refine least privilege.
- IAM Roles Anywhere gives workloads running outside AWS, in hybrid and multi-cloud environments, temporary AWS credentials instead of long-term access keys.
- Data perimeter controls combine VPC endpoint policies, IAM Access Analyzer to validate external access, and AWS Verified Access for application access without a VPN.
- Encrypt at rest with AWS KMS customer managed keys and automatic key rotation; KMS multi-Region keys share the same key material and key ID across Regions, enabling encrypt in one Region and decrypt in another for cross-Region DR and global tables.
- Encrypt in transit with TLS (including TLS 1.3) using certificates from AWS Certificate Manager (ACM) or AWS Private CA, and enforce it on S3 with a bucket policy that denies requests where aws:SecureTransport is false; AWS CloudHSM provides dedicated hardware security modules when regulations require them.
- SAP-C03 adds post-quantum cryptography strategies, for example AWS KMS with the Module-Lattice Digital Signature Algorithm (ML-DSA) and the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM).
- AWS Control Tower automates landing zone setup with a multi-account baseline, guardrails (controls) built on SCPs and AWS Config rules, and automated account provisioning through Account Factory within an AWS Organizations OU structure.
- Service Control Policies (SCPs) set the maximum available permissions for principals in member accounts and never grant permissions; they do not apply to the management account or to service-linked roles. Resource control policies (RCPs) set the maximum permissions on resources across the organization.
- An SCP using a Deny with aws:RequestedRegion (StringNotEquals to allowed Regions) enforces Region restrictions org-wide for data residency; pair it with exceptions for global services such as IAM, CloudFront, and Route 53.
- An organization CloudTrail trail logs events for all member accounts into a central S3 bucket and cannot be modified or deleted by member accounts; AWS Config aggregators, Amazon GuardDuty, Amazon Security Lake, AWS Security Hub, and CloudWatch Logs complete centralized logging, including AI model invocations and responses.
- A delegated administrator account lets you run org-wide services such as GuardDuty, Security Hub, and Config from a dedicated security account instead of the management account, and AWS RAM shares resources such as Transit Gateways, subnets, and Route 53 Resolver rules across accounts.
- AWS Config rules (with conformance packs for org-wide rule collections) and AWS Security Hub CSPM automate compliance monitoring, while Amazon Inspector and AWS Systems Manager Patch Manager automate vulnerability scanning and patching.
- Compliance designs cover data protection (encryption, access controls, audit logging), data sovereignty and residency through Region-specific deployments and transfer restrictions, audit trails for regulated workloads including AI services, evidence collection with AWS Artifact, and risk assessment through threat modeling.
- Amazon Bedrock Guardrails implement content filtering and compliance controls for generative AI, and Amazon Bedrock AgentCore Identity implements access controls for generative and agentic AI applications.
- Human oversight workflows put approval steps in front of AI operations, for example an AWS Step Functions workflow that pauses for a human approval before the next action runs.
Domain 3: Cost-Optimized Architecture Design
- Compute Savings Plans offer flexible discounts across EC2, Fargate, and Lambda regardless of instance family or Region in exchange for a 1- or 3-year hourly spend commitment; EC2 Instance Savings Plans and Reserved Instances give deeper discounts but lock to a family or Region.
- Spot Instances provide up to about 90 percent savings for fault-tolerant, interruptible workloads; design for the 2-minute interruption notice with checkpointing, use Spot via EC2 Fleet or Auto Scaling mixed-instances policies, and use AWS Fargate Spot for interruptible containers.
- Cost-optimized designs match the service to the workload, for example Graviton-based instances, AWS Step Functions Standard versus Express Workflows, and AWS Lambda functions.
- AWS Compute Optimizer recommends rightsizing from utilization metrics, and scheduled scaling plus target tracking policies keep capacity close to demand.
- For AI/ML workloads on Amazon Bedrock and Amazon SageMaker AI, control cost by selecting the appropriate service tier, batching requests, and caching; route inference across Regions only where cross-Region inference fits the data transfer and residency requirements.
- Tune CloudFront cache behaviors and policies to raise the cache-hit ratio, and add CloudFront Origin Shield as a central caching layer, so cacheable responses are served from the edge instead of repeatedly hitting and scaling the origin.
- Gateway VPC endpoints for S3 and DynamoDB are free and route traffic without a NAT gateway; interface endpoints (PrivateLink) incur hourly and data charges, Transit Gateway adds data processing charges, and Availability Zone-aware designs cut inter-AZ transfer.
- S3 Cross-Region Replication requires versioning on source and destination buckets; replication is asynchronous and by default does not replicate existing objects, delete markers, or objects already replicated, so replicate only the data the recovery or latency goal needs.
- Cost allocation starts with a tagging strategy (business unit, project, environment) enforced through tag policies, SCPs, and AWS Config rules; AWS Cost Categories, split cost allocation, and Amazon Bedrock token usage monitoring support chargeback and showback.
- AWS Cost Explorer and AWS Cost and Usage Reports analyze detailed billing data, AWS Budgets alerts on thresholds, and AWS Cost Anomaly Detection flags unexpected spend.
- S3 Lifecycle rules transition objects from Standard to Standard-IA, then S3 Glacier storage classes, and expire them; S3 Intelligent-Tiering moves objects automatically based on access with no retrieval fees, and Amazon EFS lifecycle policies tier infrequently accessed files.
- Choose EBS volume types and IOPS to fit the workload (gp3, gp2, Provisioned IOPS); gp3 lets you provision IOPS and throughput independently of volume size.
- DynamoDB on-demand mode suits unpredictable traffic, while provisioned mode with auto scaling is cheaper for steady workloads; Amazon RDS reserved DB instances, Aurora Serverless v2 (fine-grained scaling for variable load), Aurora I/O-Optimized, and Database Savings Plans reduce database cost.
- AWS Backup and Amazon Data Lifecycle Manager apply cost-optimized retention to backups and snapshots, and cost-effective observability uses log filtering, metric aggregation, and retention optimization.
Domain 4: Resilience, Migration, and Business Continuity
- The 7 Rs migration strategies are Retire, Retain, Rehost (lift-and-shift), Relocate, Repurchase (move to SaaS), Replatform (lift-tinker-shift), and Refactor/Re-architect (redesign cloud-native).
- Discovery and portfolio assessment map server inventory and dependencies so applications can be grouped into migration waves.
- AWS Transform MGN (previously known as AWS Application Migration Service) is the rehosting tool: continuous block-level replication to a staging area, test launches, then a short orchestrated cutover with minimal downtime; AWS Transform also supports rehosting and modernization.
- AWS Database Migration Service (DMS) migrates databases with minimal downtime; the full-load-and-cdc task type does a full copy then keeps changes synchronized via change data capture until cutover.
- AWS Schema Conversion Tool (SCT) converts schema and procedural code for heterogeneous migrations (e.g., Oracle or SQL Server to Aurora PostgreSQL); homogeneous migrations need only DMS. Refactoring a commercial database to Aurora with DMS plus SCT removes commercial licensing.
- AWS DataSync transfers large file and object datasets over the network or Direct Connect to S3, EFS, or FSx with encryption, scheduling, and integrity verification; AWS Transfer Family provides managed SFTP, FTPS, and FTP endpoints for partner file exchange.
- Replatforming moves workloads onto managed services such as Amazon RDS, Aurora, Amazon ECS, or AWS Lambda to reduce operational overhead, and refactoring decomposes monoliths into microservices or serverless functions incrementally with the strangler fig pattern; SAP-C03 also covers modernizing mainframes, applications, and databases.
- The four DR strategies in order of increasing cost and decreasing RTO/RPO are Backup and Restore, Pilot Light, Warm Standby, and Multi-Site Active/Active; choose by the business RTO, RPO, and cost.
- AWS Elastic Disaster Recovery uses continuous replication so workloads can recover quickly after an incident.
- AWS Resilience Hub assesses applications against resilience targets and supports DR testing and validation, and AWS Systems Manager runbooks automate recovery procedures.
- Multi-Region DR replicates data and fails over with Amazon Route 53 health checks and failover routing, AWS Global Accelerator, and Amazon Application Recovery Controller; Aurora Global Database supports cross-Region DR with fast promotion of a secondary Region.
- Multi-cluster container strategies on Amazon EKS or Amazon ECS provide high availability and disaster recovery for containerized workloads; within a Region, deploy across multiple Availability Zones behind Elastic Load Balancing.
- AWS Backup centralizes backup governance with cross-account backup policies, and DynamoDB point-in-time recovery restores a table to any second within its recovery period of up to 35 days.
- Protect data against ransomware and accidental deletion with Amazon S3 Object Lock, Amazon EBS snapshot lock, and AWS Backup Vault Lock.
- AWS Fault Injection Service runs chaos engineering experiments from experiment templates against a steady-state hypothesis, and with Route 53 health checks it supports failover tests that measure recovery time.
Domain 5: Operational Excellence and Automation
- Infrastructure as code uses declarative AWS CloudFormation templates or the AWS CDK, which defines infrastructure in a programming language.
- Policy as code validates and enforces rules before and after deployment with CloudFormation Hooks, CDK aspects, AWS Config rules, and SCPs, and remediates drift.
- Keep secrets out of templates by referencing AWS Secrets Manager or Systems Manager Parameter Store, and deploy stacks to many accounts and Regions with CloudFormation StackSets.
- CI/CD pipelines orchestrate build and deployment with AWS CodePipeline, AWS CodeBuild, AWS CodeDeploy, and AWS CodeCommit, and multi-account pipelines use role delegation and artifact promotion through CodePipeline cross-account deployments.
- DevSecOps pipelines scan for vulnerabilities and sign artifacts, for example with Amazon Inspector and Amazon ECR image scanning.
- Amazon Bedrock Evaluations evaluate AI/ML applications and validate their outputs before release.
- Deployment strategies with rollback include blue/green, canary, and rolling deployments.
- CloudWatch covers metrics, logs, and alarms, AWS X-Ray provides distributed tracing, and AWS Distro for OpenTelemetry standardizes instrumentation; Amazon ECS and Amazon EKS workloads are monitored with Container Insights.
- Multi-account log aggregation uses CloudWatch Logs cross-account subscriptions into a central account with archives in S3 archival storage tiers, and alerting combines CloudWatch alarms, Amazon SNS, and AWS Systems Manager.
- AI/ML monitoring tracks model performance, AI agent performance, inference latency, and model drift.
- CloudWatch Synthetics runs synthetic transactions and CloudWatch RUM collects real user monitoring data, and service-level objectives with measurable indicators and alerts are built with CloudWatch Application Signals.
- Use EventBridge rules or CloudWatch alarms to trigger Lambda functions or Systems Manager Automation runbooks for health responses, patching, remediation, and scaling, and watch Service Quotas as part of capacity planning; AWS Config rules can run automatic SSM Automation remediation.
- Controlled remediation applies safety constraints such as circuit breakers, rate limits, bulkhead patterns, and retries with exponential backoff.
- Auto Scaling target tracking keeps a metric (e.g., average CPU at 50 percent) at target, scheduled scaling handles known peaks, and predictive scaling provisions ahead of forecasted load for cyclical traffic.
- Automated failure recovery relies on health checks and replacement, for example Auto Scaling health checks replacing instances, Amazon ECS replacing failed tasks, and AWS Lambda retry policies.
AWS SAP-C03 exam tips
- Read the last sentence of each scenario first - it states the actual requirement (lowest cost, least operational overhead, highest availability, minimal downtime) that distinguishes the one best answer from several technically valid options.
- Multiple-response questions have two or more correct responses out of five or more options, and you must select all correct responses to get credit; unanswered questions are scored as incorrect and there is no penalty for guessing, so answer every question.
- Weight your study by the SAP-C03 domains: Domains 1 and 2 are 25% each, Domain 5 is 20%, and Domains 3 and 4 are 15% each. Security and governance is now a domain of its own, and cost optimization and operational excellence each have their own domain.
- Study the content SAP-C03 adds: Amazon Bedrock, AgentCore, Knowledge Bases and RAG, SageMaker AI inference, Bedrock Guardrails and Evaluations, AI/ML cost and monitoring, IPv6, lakehouse and Clean Rooms, IAM Roles Anywhere and EKS Pod Identity, post-quantum KMS, AWS Artifact, multi-cluster container DR, pipeline security scanning, and CloudWatch Synthetics and RUM.
- Drop services removed from the in-scope list, such as AWS IoT, Amazon WorkSpaces and AppStream 2.0, Media Services, Lightsail, Pinpoint, SES, Amplify, App Runner, AWS Batch, and the individual AI services that Bedrock and SageMaker AI replace.
- With 75 questions in 180 minutes you have roughly 2.4 minutes each; flag long multi-part scenarios, answer the quick ones first, and budget time to revisit flagged questions.
Study guide FAQ
When does SAP-C03 replace SAP-C02?
SAP-C02 is in use until November 16, 2026 and SAP-C03 is in use beginning November 17, 2026. Both lead to the same credential, AWS Certified Solutions Architect - Professional.
What score do I need to pass the SAP-C03 exam?
Results are reported as a scaled score of 100-1,000 and the minimum passing score is 720. The exam uses compensatory scoring, so you do not need to pass each section; you need to pass only the overall exam.
How is the exam structured and how long is it?
You have 180 minutes for 75 questions: 65 scored and 10 unscored questions that AWS uses to evaluate future items and that are not identified on the exam. Questions are multiple choice (one correct response out of four) or multiple response (two or more correct responses out of five or more options).
What changed from SAP-C02?
The four SAP-C02 domains became five, with separate domains for security, cost, and operational excellence. SAP-C03 adds AI and ML integration, responsible AI controls, IPv6, lakehouse designs, post-quantum cryptography, and AI cost and monitoring skills, removes application upgrade path, delegating to AWS, and migration-tool security from the blueprint text (AWS notes they may still be implicit in other skills), and consolidates many SAP-C02 skills into broader tasks.
What experience is expected, and what is out of scope?
The target candidate has 2 or more years of experience using AWS services to design and implement cloud solutions. Out of scope are in-depth operating system knowledge, AI/ML model training and fine-tuning, security incident forensics, and application code development and debugging.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- AWS Certified Solutions Architect - Professional (SAP-C03) exam guideBlueprint revised SAP-C03 (in use from November 17, 2026) · link and content verified 13 November 2026Five content domains and weightings: "Content Domain 1: Architecture Design and Implementation Built for the Cloud (25% of scored content)", "Content Domain 2: Security, Compliance, and Governance (25% of scored content)", "Content Domain 3: Cost-Optimized Architecture Design (15% of scored content)", "Content Domain 4: Resilience, Migration, and Business Continuity (15% of scored content)", "Content Domain 5: Operational Excellence and Automation (20% of scored content)". "The exam includes 65 questions that affect your score." "The exam includes 10 unscored questions that do not affect your score." "The minimum passing score is 720."
- Comparison of SAP-C02 and SAP-C03 (exam guide)link and content verified 13 November 2026"the SAP-C02 exam (in use until November 16, 2026) and the SAP-C03 exam (in use beginning November 17, 2026)"; the side-by-side domain table, the content added (AI and ML integration among it), the content removed and the recategorization of SAP-C02 tasks into SAP-C03 tasks.