- Learn AWS
- SAA
AWS certification
AWS Solutions Architect – Associate
The SAA exam is a design exam. Most questions are a short scenario with four architectures that would all technically work, and the one that is right is the one that meets the constraint the scenario put in the second sentence. So knowing what a service does is where preparation starts, not where it finishes.
Below are the 29 AWS services in this library the exam asks about, ranked by how heavily it leans on each. These weights are this library’s own reading, not AWS’s — AWS’s published exam guide is still the document to plan around. What they are good for is order: revise down the list rather than through the alphabet.
Asked about constantly
- AWS Auto ScalingKeeps the right number of EC2 instances running. It replaces the ones that fail, and adds or removes instances as the load changes.
- AWS EC2Virtual machines you choose, size and run yourself: the most flexible compute on AWS, and the most work.
- AWS LambdaRuns your code in response to events, with no servers to manage. You pay per request and by the millisecond, and a run lasts 15 minutes at most.
- AWS API GatewayA managed front door for APIs: REST, HTTP and WebSocket APIs that take each call, check who is calling, throttle it, and pass it to Lambda, another service or any HTTP backend.
- AWS CloudFrontA content delivery network: copies of your files are cached at edge locations near viewers, and requests that miss go back to your origin over the AWS network.
- AWS Direct ConnectA private network connection from your premises into AWS through a Direct Connect location, reaching your VPCs and AWS services without crossing the internet.
- AWS ELBSpreads incoming traffic across healthy targets in several Availability Zones, with four kinds of load balancer: Application, Network, Gateway and Classic.
- AWS Internet GatewayThe door between a VPC and the internet. A subnet whose route table points at it is a public subnet.
- AWS NAT GatewayLets instances in private subnets connect out, while nothing outside can start a connection to them.
- AWS Route 53AWS's DNS service. It registers domains, answers queries for them with a choice of routing policies, and sends traffic away from endpoints that fail their health checks.
- AWS Site-to-Site VPNEncrypted IPsec tunnels over the internet between your own network and your VPCs, two to a connection, ending on a virtual private gateway or a transit gateway.
- AWS VPCYour own private network in AWS: its address range, a subnet in each Availability Zone, and the rules for what reaches what.
- AWS EBSBlock storage volumes for EC2 instances: a disk that outlives the instance, lives in one Availability Zone, and is backed up with snapshots.
- AWS EFSA shared NFS file system that grows and shrinks by itself, mounted at once by many instances, containers and functions across the zones of a Region.
- AWS S3Object storage for any amount of data: files kept as objects in buckets, designed for eleven nines of durability, and private until you grant access.
- AWS S3 GlacierThree S3 storage classes for archives: Instant Retrieval, read in milliseconds; Flexible Retrieval, restored in minutes to hours; and Deep Archive, the lowest cost, restored within 12 to 48 hours.
- AWS DynamoDBA serverless key-value and document database with single-digit millisecond responses at any scale, and DAX, its in-memory cache, for microseconds.
- AWS ElastiCacheA managed in-memory cache, Valkey, Redis OSS or Memcached, that answers repeated reads from memory so the database behind it does less.
- AWS RDS and AuroraManaged relational databases: six engines run for you, plus Aurora, AWS's own MySQL- and PostgreSQL-compatible engine, with standbys, replicas and backups built in.
- AWS IAMWho can do what to which AWS resource, and under what conditions. Every request to AWS is checked against it.
- AWS KMSCreates and guards the keys that encrypt your data, lets a policy decide every use of them, and hands out data keys for envelope encryption.
- AWS Secrets ManagerStores database passwords, API keys and tokens, hands the current one to applications when they run, and rotates them on a schedule.
- AWS ShieldDDoS protection: Shield Standard guards every AWS customer against common network and transport layer attacks at no extra charge, and Shield Advanced adds more for the resources you choose.
- AWS WAFA web application firewall that inspects the HTTP and HTTPS requests reaching CloudFront, a load balancer or an API, and allows, blocks or counts each one by your rules.
- AWS SNSPublish once to a topic, and SNS pushes a copy to every subscriber: SQS queues, Lambda functions, HTTPS endpoints, email, SMS and mobile apps.
- AWS SQSA queue between the part of your system that creates work and the part that does it, so a slow or broken consumer never costs you the work.
- AWS CloudTrailA record of the actions taken in your AWS account by people, roles and services: who did what, to which resource, when and from where.
- AWS CloudWatchMetrics, logs, alarms and dashboards for your AWS resources and applications, with alarms that notify people or act on their own.
Asked about regularly
Then learn the shapes
Exam scenarios are not built service by service. They are built out of a small number of architectures with the names changed, and recognising which one a scenario is describing narrows four plausible answers down to one. There are 16 of them, each with the phrases in a brief that point at it.
AWS architecture patterns →Questions
- Which AWS services does the Solutions Architect – Associate exam cover?
- More than any one page can list, but the weight is not spread evenly — a handful of services carry most of the questions. This page ranks the 29 services in the library that the SAA exam asks about, heaviest first, so revision can follow the weight rather than the alphabet.
- Is reading about services enough to pass SAA?
- On its own, no. The exam asks you to choose between services under constraints, not to recite what each one does — most questions are a short scenario with four designs that would all technically work. That is why the service pages end in traps and an exam-style question, and why the practice scenarios ask you to produce an architecture rather than pick one.
- How should I revise for SAA?
- Learn the service, learn what it is mistaken for, learn the shape it belongs to, then design against a brief and have the design marked. Knowing that SQS decouples is not the same as recognising "must never reject an order" in a paragraph of business requirements and knowing what to draw.
- Are these weights official?
- No, and nothing here should be read as AWS's own exam guide — that is published by AWS and is the document to plan around. These weights are this library's reading of how heavily each exam leans on each service, used to put revision in a sensible order. Every fact on the service pages themselves is checked against AWS's own documentation, and each page lists the pages it was checked against.
Other AWS certifications
Practise the part the exam actually tests
Read a scenario, build the architecture on a canvas, and have it scored against what the scenario requires — with the reason behind every requirement, which is the part that transfers to a question you have not seen.
Browse the scenarios