SMEC

Detailed Syllabus

Course Name : AWS Certified Solutions

Architect(SAA-C03)
Domain 1: Design Secure Architectures
Task Statement 1: Design secure access to AWS resources.
Knowledge of:
• Access controls and management across multiple accounts
• AWS federated access and identity services (for example, AWS Identity and Access
Management [IAM], AWS Single Sign-On [AWS SSO])
• AWS global infrastructure (for example, Availability Zones, AWS Regions) • AWS security best
practices (for example, the principle of least privilege)
• Applying AWS security best practices to IAM users and root users (for example,
multi-factorauthentication [MFA])
• Designing a flexible authorization model that includes IAM users, groups, roles, and policies
• Designing a role-based access control strategy (for example, AWS Security Token Service
[AWS STS], role switching, cross-account access)
• Designing a security strategy for multiple AWS accounts (for example, AWS Control
Tower, servicecontrol policies [SCPs])
• Determining the appropriate use of resource policies for AWS services
• Determining when to federate a directory service with IAM roles

Task Statement 2: Design secureworkloads and applications.

Knowledge of:
• Application configuration and credentials security
• AWS service endpoints
• Control ports, protocols, and network traffic on AWS
• Secure application access
• Security services with appropriate use cases (for example, Amazon Cognito, Amazon
GuardDuty,Amazon Macie)
• Threat vectors external to AWS (for example, DDoS, SQL injection)Skills in:
• Designing VPC architectures with security components (for example, security groups,
route tables,network ACLs, NAT gateways)
• Determining network segmentation strategies (for example, using public subnets and
private subnets)

Page 1

[Link]
 SMEC

• The orchestration of containers (for example, Amazon Elastic Container Service

[Amazon ECS],Amazon Elastic Kubernetes Service [Amazon EKS])
• When to use read replicas
• Workflow orchestration (for example, AWS Step Functions)

Skills in:
• Designing event-driven, micro service, and/or multi-tier architectures based on
requirements
• Determining scaling strategies for components used in an architecture design
• Determining the AWS services required to achieve loose coupling based on requirements
• Determining when to use containers
• Determining when to use serverless technologies and patterns
• Recommending appropriate compute, storage, networking, and database
technologies based onrequirements
• Using purpose-built AWS services for workloads

Task Statement 2: Design highly available and/or fault-tolerant architectures.

Knowledge of:
• AWS global infrastructure (for example, Availability Zones, AWS Regions, Amazon Route 53)
• AWS managed services with appropriate use cases (for example, Amazon
Comprehend, AmazonPolly)
• Basic networking concepts (for example, route tables)
• Disaster recovery (DR) strategies (for example, backup and restore, pilot light, warm
standby, active- active failover, recovery point objective [RPO], recovery time objective
[RTO])
• Distributed design patterns
• Failover strategies
• Immutable infrastructure
• Load balancing concepts (for example, Application Load Balancer)
• Proxy concepts (for example, Amazon RDS Proxy)
• Service quotas and throttling (for example, how to configure the service quotas for a
workload in astandby environment)
• Storage options and characteristics (for example, durability, replication)
• Workload visibility (for example, AWS X-Ray)Skills in:
• Determining automation strategies to ensure infrastructure integrity
• Determining the AWS services required to provide a highly available and/or fault-tolerant
architecture across AWS Regions or Availability Zones

Page 2

[Link]
 SMEC

• Integrating AWS services to secure applications (for example, AWS Shield, AWS WAF,
AWS SSO,AWS Secrets Manager)
• Securing external network connections to and from the AWS Cloud (for example, VPN,
AWS DirectConnect)

Task Statement 3: Determine appropriate data security controls.

Knowledge of:
• Data access and governance
• Data recovery
• Data retention and classification
• Encryption and appropriate key managementSkills in:
• Aligning AWS technologies to meet compliance requirements
• Encrypting data at rest (for example, AWS Key Management Service [AWS KMS])
• Encrypting data in transit (for example, AWS Certificate Manager [ACM] using TLS)
• Implementing access policies for encryption keys
• Implementing data backups and replications
• Implementing policies for data access, lifecycle, and protection
• Rotating encryption keys and renewing certificates

Domain 2: Design Resilient Architectures

Task Statement 1: Design scalable and loosely coupled architectures.
Knowledge of:
• API creation and management (for example, Amazon API Gateway, REST API)
• AWS managed services with appropriate use cases (for example, AWS Transfer Family,
AmazonSimple Queue Service [Amazon SQS], Secrets Manager)
• Caching strategies
• Design principles for microservices (for example, stateless workloads compared with
statefulworkloads)
• Event-driven architectures
• Horizontal scaling and vertical scaling
• How to appropriately use edge accelerators (for example, content delivery network [CDN])
• How to migrate applications into containers
• Load balancing concepts (for example, Application Load Balancer)
• Multi-tier architectures
• Queuing and messaging concepts (for example, publish/subscribe)
• Serverless technologies and patterns (for example, AWS Fargate, AWS Lambda)
• Storage types with associated characteristics (for example, object, file, block)

Page 3

[Link]
 SMEC

• Identifying metrics based on business requirements to deliver a highly available solution

• Implementing designs to mitigate single points of failure
• Implementing strategies to ensure the durability and availability of data (for example,
backups)
• Selecting an appropriate DR strategy to meet business requirements
• Using AWS services that improve the reliability of legacy applications and applications not
built for thecloud (for example, when application changes are not possible)
• Using purpose-built AWS services for workloads

Domain 3: Design High-Performing Architectures

Task Statement 1: Determine high-performing and/or scalable storage solutions.
Knowledge of:
• Hybrid storage solutions to meet business requirements
• Storage services with appropriate use cases (for example, Amazon S3, Amazon Elastic File
System [Amazon EFS], Amazon Elastic Block Store [Amazon EBS])
• Storage types with associated characteristics (for example, object, file, block) Skills in:
• Determining storage services and configurations that meet performance demands
• Determining storage services that can scale to accommodate future needs

Task Statement 2: Design high-performing and elastic compute solutions.

Knowledge of:
• AWS compute services with appropriate use cases (for example, AWS Batch, Amazon EMR,
Fargate)
• Distributed computing concepts supported by AWS global infrastructure and edge services
• Queuing and messaging concepts (for example, publish/subscribe)
• Scalability capabilities with appropriate use cases (for example, Amazon EC2 Auto Scaling,
AWS Auto Scaling)
• Serverless technologies and patterns (for example, Lambda, Fargate)
• The orchestration of containers (for example, Amazon ECS, Amazon EKS) Skills in: •
Decouplingworkloads so that components can scale independently
• Identifying metrics and conditions to perform scaling actions
• Selecting the appropriate compute options and features (for example, EC2 instance
types) to meetbusiness requirements
• Selecting the appropriate resource type and size (for example, the amount of Lambda
memory) to meet business requirements

Page 4

[Link]
 SMEC

Task Statement 3: Determine high-performing database solutions.

Knowledge of:
• AWS global infrastructure (for example, Availability Zones, AWS Regions)
• Caching strategies and services (for example, Amazon ElastiCache)
• Data access patterns (for example, read-intensive compared with write-intensive)
• Database capacity planning (for example, capacity units, instance types, Provisioned IOPS)
• Database connections and proxies
• Database engines with appropriate use cases (for example, heterogeneous migrations,
homogeneous migrations)
• Database replication (for example, read replicas)
• Database types and services (for example, serverless, relational compared with non-
relational, in-memory)
Skills in:
• Configuring read replicas to meet business requirements
• Designing database architectures
• Determining an appropriate database engine (for example, MySQL compared with
PostgreSQL)
• Determining an appropriate database type (for example, Amazon Aurora, Amazon
DynamoDB)
• Integrating caching to meet business requirements

Task Statement 4: Determine high-performing and/or scalable network architectures.

Knowledge of: •Edge networking services with appropriate use cases (for example, Amazon
CloudFront, AWS Global Accelerator)
• How to design network architecture (for example, subnet tiers, routing, IP addressing)
• Load balancing concepts (for example, Application Load Balancer)
• Network connection options (for example, AWS VPN, Direct Connect, AWS PrivateLink) Skills
in:

 Creating a network topology for various architectures (for example, global, hybrid,
multi-tier)
 Determining network configurations that can scale to accommodate future needs
Determining the appropriate placement of resources to meet business requirements
 Selecting the appropriate load balancing strategy

Page 5

[Link]
 SMEC

Task Statement 5: Determine high-performing data ingestion and transformation

solutions.
Knowledge of:

• Data analytics and visualization services with appropriate use cases (for example,
Amazon Athena,AWS Lake Formation, Amazon Quick Sight)
• Data ingestion patterns (for example, frequency)
• Data transfer services with appropriate use cases (for example, AWS Data Sync, AWS
StorageGateway)
• Data transformation services with appropriate use cases (for example, AWS Glue)
• Secure access to ingestion access points
• Sizes and speeds needed to meet business requirements
• Streaming data services with appropriate use cases (for example, Amazon Kinesis) Skills in:

 Building and securing data lakes

 Designing data streaming architectures
 Designing data transfer solutions
 Implementing visualization strategies
 Selecting appropriate compute options for data processing (for example, Amazon
EMR)
 Selecting appropriate configurations for ingestion
 Transforming data between formats (for example, .csv to .parquet)

Knowledge of:
• Access options (for example, an S3 bucket with Requester Pays object storage)

• AWS cost management service features (for example, cost allocation tags, multi-account
billing)

• AWS cost management tools with appropriate use cases (for example, AWS Cost
Explorer, AWSBudgets, AWS Cost and Usage Report)
• AWS storage services with appropriate use cases (for example, Amazon FSx, Amazon EFS,
AmazonS3, Amazon EBS)
• Backup strategies

• Block storage options (for example, hard disk drive [HDD] volume types, solid state drive

Page 6

[Link]
 SMEC

[SSD] volume types)

• Data lifecycles
• Hybrid storage options (for example, DataSync, Transfer Family, Storage Gateway)
• Storage access patterns
• Storage tiering (for example, cold tiering for object storage)
• Storage types with associated characteristics (for example, object, file, block)
Knowledge of:
• AWS cost management service features (for example, cost allocation tags, multi-account
billing)
• AWS cost management tools with appropriate use cases (for example, Cost Explorer, AWS
Budgets, AWS Cost and Usage Report)
• AWS global infrastructure (for example, Availability Zones, AWS Regions)
• AWS purchasing options (for example, Spot Instances, Reserved Instances, Savings Plans)
• Distributed compute strategies (for example, edge processing)
• Hybrid compute options (for example, AWS Outposts, AWS Snowball Edge)
• Instance types, families, and sizes (for example, memory optimized, compute optimized,
virtualization)
• Optimization of compute utilization (for example, containers, serverless computing,
microservices)
• Scaling strategies (for example, auto scaling, hibernation)
• Configuring appropriate NAT gateway types for a network (for example, a single shared NAT
gateway compared with NAT gateways for each Availability Zone)
• Configuring appropriate network connections (for example, Direct Connect compared
with VPN compared with internet)
• Configuring appropriate network routes to minimize network transfer costs (for
example, Region toRegion, Availability Zone to Availability Zone, private to public,
Global Accelerator, VPC endpoints)
• Determining strategic needs for content delivery networks (CDNs) and edge caching
• Reviewing existing workloads for network optimizations
• Selecting an appropriate throttling strategy
• Selecting the appropriate bandwidth allocation for a network device (for example, a
single VPNcompared with multiple VPNs, Direct Connect speed)

Page 7

[Link]