The AWS Well-Architected Framework

AWS Solutions Architect Associate SAA-C03

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Solutions Architect Associate (SAA-C03) Exam Study Strategies and Exam Tips for SAA-C03 The AWS Well-Architected Framework

2 Domain 1: Design Secure Architectures (30%)

1.1 IAM Fundamentals — Users, Groups, Roles, and Policies 1.2 AWS Organizations, SCPs, and Multi-Account Strategy 1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints 1.4 Encryption, KMS, and Secrets Management 1.5 AWS WAF, Shield, and Network Firewall 1.6 GuardDuty, Inspector, Macie, and Security Hub 1.7 The Shared Responsibility Model for Solutions Architects 1.8 Data Protection, Compliance, and Audit Services

3 Domain 2: Design Resilient Architectures (26%)

2.1 Elastic Load Balancing (ELB) — ALB, NLB, and GWLB 2.2 EC2 Auto Scaling — Dynamic, Predictive, and Scheduled 2.3 Multi-AZ and Multi-Region Architectures 2.4 Disaster Recovery Strategies — RTO and RPO 2.5 Decoupling with SQS, SNS, and EventBridge 2.6 AWS Step Functions and Workflow Orchestration

4 Domain 3: Design High-Performing Architectures (24%)

3.1 EC2 Instance Types, Purchasing Options, and Placement Groups 3.2 Lambda, Serverless Compute, and Container Services 3.3 Amazon S3 - Storage Classes, Lifecycle, and Performance 3.4 Block and File Storage - EBS, EFS, and FSx 3.5 Database Services - RDS, Aurora, DynamoDB, and More 3.6 CloudFront, Route 53, and Global Accelerator 3.7 Data Ingestion and Transformation - Kinesis, Glue, and EMR

5 Domain 4: Design Cost-Optimized Architectures (20%)

4.1 Compute Cost Optimization — Right-Sizing, RIs, Savings Plans, and Spot 4.2 Storage Cost Optimization — S3 Tiers, EBS, and Data Transfer 4.3 Database Cost Optimization 4.4 AWS Cost Management and Monitoring Tools

6 VPC and Networking Deep Dive

5.1 VPC Architecture — Subnets, Route Tables, and Gateways 5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect 5.3 Amazon API Gateway 5.4 CloudFormation and Infrastructure as Code 5.5 AWS PrivateLink and Endpoint Services

7 Migration, Transfer, and Hybrid Services

6.1 The 7 Rs of Cloud Migration 6.2 AWS Snow Family — Snowball Edge Devices 6.3 CloudWatch, CloudTrail, and AWS Config 6.4 Amazon Cognito and Identity Federation 6.5 AWS DataSync and Transfer Family

8 Serverless Architecture and Application Services

7.1 Serverless Architecture Patterns 7.2 Advanced SQS Patterns — DLQ, Backpressure, and FIFO 7.3 Analytics Services — Athena, OpenSearch, and QuickSight 7.4 Container Orchestration — ECS, EKS, and ECR

9 Advanced Topics and Exam Scenarios

8.1 Advanced IAM — Permission Boundaries, Federation, and Cross-Account 8.2 Caching Strategies and ElastiCache Patterns 8.3 Hybrid Architecture — DNS, Storage, and Compute 8.4 SAA-C03 Scenario Practice — Putting It All Together

The AWS Well-Architected Framework

Key Takeaways Explain This Topic AI

The AWS Well-Architected Framework has six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

Four SAA-C03 domains map directly to four pillars: Security, Reliability, Performance Efficiency, and Cost Optimization.

The Well-Architected Tool is a free AWS Console service for reviewing workloads against best practices and producing a prioritized improvement plan.

Design principles include 'stop guessing capacity', 'test at production scale', 'automate experimentation', and 'improve through game days'.

Understanding pillar trade-offs (e.g., reliability vs cost) is what lets you choose the BEST answer when several options technically work.

Last updated: June 2026

Quick Answer: The AWS Well-Architected Framework has six pillars - Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. The four SAA-C03 domains map to the Security, Reliability, Performance Efficiency, and Cost Optimization pillars.

The AWS Well-Architected Framework (WAF) is the conceptual backbone of the SAA-C03. The exam is essentially a test of whether you can apply these pillars to scenarios, so internalizing them turns ambiguous questions into structured decisions.

The Six Pillars and Their Exam Mapping

Pillar Core question it answers SAA-C03 mapping
Operational Excellence Can we run and improve systems well? Indirectly (more SysOps/DevOps)
Security Are data and systems protected? Domain 1 (30%)
Reliability Does it recover and meet demand? Domain 2 (26%)
Performance Efficiency Are resources used efficiently? Domain 3 (24%)
Cost Optimization Are we avoiding unnecessary spend? Domain 4 (20%)
Sustainability Is environmental impact minimized? Indirectly tested

On the Exam: Four of six pillars line up one-to-one with the four domains. Operational Excellence and Sustainability still inform answers (for example, choosing managed services or right-sizing) but are not standalone domains.

General Design Principles

These principles cut across all pillars and frequently appear as the reasoning behind a correct answer:

Stop guessing capacity - use Auto Scaling to match demand instead of over-provisioning.

Test at production scale - spin up a full-scale environment on demand, then tear it down to save cost.

Automate to ease experimentation - use AWS CloudFormation or the AWS Cloud Development Kit (CDK) for infrastructure as code.

Allow evolutionary architectures - design loosely coupled systems that change safely.

Drive decisions with data - use Amazon CloudWatch metrics, not intuition.

Improve through game days - rehearse failure to validate resilience.

Security Pillar Deep Dive (Domain 1)

The security pillar rests on a strong identity foundation, traceability, security at all layers, automation, and encryption everywhere. Map its design principles to services you will see repeatedly:

AWS IAM and AWS STS - least-privilege identities and short-lived credentials.

AWS KMS and AWS Certificate Manager - encryption at rest and in transit.

AWS WAF, AWS Shield, Amazon GuardDuty - perimeter and threat detection.

AWS CloudTrail and Amazon Macie - traceability and sensitive-data discovery.

Reliability Pillar Deep Dive (Domain 2)

Reliability is about recovering from disruption and scaling to demand. Key services and facts: Amazon S3 offers 99.999999999% (eleven 9s) durability; RDS Multi-AZ provides automatic failover to a synchronous standby; Route 53 health checks enable DNS failover; Elastic Load Balancing routes only to healthy targets. The four disaster recovery strategies trade RTO/RPO against cost.

DR strategy RTO/RPO Relative cost
Backup and restore Hours Lowest
Pilot light Tens of minutes Low
Warm standby Minutes Medium
Multi-site active/active Near zero Highest
Performance Efficiency and Cost Optimization Pillars

Performance Efficiency (Domain 3) favors the right tool: Lambda for event-driven spikes, DynamoDB for single-digit-millisecond key-value access, ElastiCache to offload read-heavy databases, and CloudFront to cut latency at the edge. Cost Optimization (Domain 4) is about matching spend to need: Spot Instances cut compute cost up to 90% for fault-tolerant work, Reserved Instances and Savings Plans reward commitment, and S3 Intelligent-Tiering moves objects between access tiers automatically. Tooling: AWS Cost Explorer and AWS Budgets.

Operational Excellence and Sustainability

Operational Excellence centers on operations as code and frequent small reversible changes using CloudFormation, AWS Config, CloudWatch, AWS Systems Manager, and AWS X-Ray. Sustainability asks you to minimize provisioned resources: right-size, prefer managed and serverless services that pack workloads efficiently, and pick Regions with lower carbon intensity. Neither is its own domain, but their logic justifies answers in the four tested domains.

The Well-Architected Tool

The AWS Well-Architected Tool is a free Console service that walks a workload through pillar questions, flags high- and medium-risk issues , and produces a prioritized improvement plan you can track over time. It is for architecture review , not compliance auditing.

On the Exam: If a question describes reviewing an existing workload against best practices, the answer is the Well-Architected Tool. For continuous configuration compliance use AWS Config; for audit evidence collection use AWS Audit Manager. Do not confuse the three.

Using Pillars to Break Ties

The practical payoff of the framework is tie-breaking. When two options both satisfy the stated requirement, ask which pillar the qualifier invokes and let that pillar's design principles decide. A 'most resilient' qualifier invokes Reliability, which prefers redundancy across Availability Zones and automatic failover even at higher cost. A 'most cost-effective' qualifier invokes Cost Optimization, which tolerates a slightly higher RTO to save money - so backup-and-restore may beat warm standby. The pillars are deliberately in tension: maximizing reliability raises cost, and maximizing cost savings can reduce performance headroom.

Recognizing which pillar the question is optimizing for converts a vague comparison into a rule-based choice.

Pillar Trade-Off Examples

Consider how the same scenario flips answers depending on the qualifier:

A batch image-processing job that can tolerate interruption: under Cost Optimization, Spot Instances are ideal; under Reliability with a hard deadline, On-Demand or a mix is safer.

A read-heavy product catalog: under Performance Efficiency, add Amazon ElastiCache or DynamoDB Accelerator; under Cost Optimization with modest traffic, a single cached RDS read replica may suffice.

Storing infrequently accessed compliance archives: under Cost Optimization, transition to S3 Glacier classes via lifecycle rules; under a fast-retrieval requirement, S3 Standard-Infrequent Access fits better.

Common Framework Traps on the Exam

First, do not assume more pillars satisfied equals a better answer - the question optimizes for one. Second, remember that managed and serverless services usually score well across Operational Excellence, Reliability, and Sustainability simultaneously, which is why 'least operational overhead' answers so often point to Lambda, Fargate, Aurora, or DynamoDB. Third, the Well-Architected Tool itself never changes your architecture; it only reports risks, so an answer claiming it 'automatically remediates' issues is wrong. Keeping these distinctions sharp lets the framework do the heavy lifting on otherwise ambiguous scenario questions.