Course · Intermediate

AWS Solutions Architect – Associate

Learn to design AWS systems that are secure, resilient, fast and cheap to run, the four things the Solutions Architect – Associate exam tests, by building them with the AWS CLI and Python and then reasoning through the trade-offs in exam-style questions.

Start the course See the syllabus

51 itemsLast updated October 2026

aws-solutions-architect-associate / at a glance

  • 11modules
  • 29lessons
  • 12labs and projects
  • 565practice questions

The Solutions Architect – Associate exam does not ask you to recite service limits. It gives you a scenario, a set of requirements, and four answers that all work, and asks which one fits best: the most secure, the most resilient, the fastest, or the cheapest. This course teaches that judgement.

Each module explains how a group of services actually works, then has you build it from the command line with the AWS CLI and short Python (boto3) scripts, so the console is never the only way you know how to do something. Every lesson and lab ends with practice questions written in the exam’s scenario style, and the course closes with a capstone project and a full-length, 65-question practice exam weighted like the real one.

The exam’s four domains, and where the course covers them:

Domain Weight Modules
Design secure architectures 30% 2, 3, 5, 8
Design resilient architectures 26% 4, 6, 7, 9
Design high-performing architectures 24% 3, 4, 5, 6
Design cost-optimized architectures 20% 4, 5, 10

AWS changes services and exam versions over time. Before you book, read the current exam guide linked above; if it has changed, tell us and we will update the course.

This edition

What's new as of October 2026

  • Governing many accounts with resource control policies, declarative policies and centralized root access, alongside SCPs
  • Regional NAT gateways, VPC Block Public Access, VPC Lattice and CloudFront VPC origins in the networking module
  • Graviton5 instances, Auto Scaling group deletion protection, EKS Auto Mode, Lambda SnapStart and durable functions, and ECS Express Mode now that App Runner is closed to new customers
  • S3's 50 TB maximum object size, S3 Tables and S3 Vectors, larger gp3 volumes, and the Snow family closing to new customers
  • Aurora DSQL, Aurora Serverless v2 scaling to zero, DynamoDB multi-Region strong consistency, ElastiCache for Valkey, and 1 MiB SQS messages
  • Exportable ACM certificates and shorter certificate lifetimes, the new Security Hub, and GuardDuty Extended Threat Detection
  • ARC Region switch and Route 53 accelerated recovery for disaster recovery, and a new lesson and lab on monitoring and automated recovery
  • Database Savings Plans and the public IPv4 charge in the cost module, plus a cost guardrails lab
  • A new serverless API lab, a CloudFormation capstone project, and a 65-question practice exam the length of the real one

Prepares you for

AWS Certified Solutions Architect – Associate (SAA-C03)

Every module maps to the domains in AWS's published exam guide.

You book and take the exam yourself with AWS. We do not run exams or sell exam vouchers. Pontelon is not affiliated with, endorsed by, or an authorized training partner of AWS. Practice questions are our own, written against the published exam guide, never leaked exam content. Certification names are trademarks of their owners.

Outcomes

By the end, you can

  • Choose between AWS services for compute, storage, databases and messaging by the requirement, not by habit
  • Design a VPC with public and private tiers, and control traffic with security groups, network ACLs, endpoints and routing
  • Secure an account with IAM roles, least-privilege policies, encryption with KMS, and managed secrets
  • Build for failure with multiple Availability Zones, load balancing, auto scaling, decoupled queues, backups and a disaster recovery plan you can state as an RTO and RPO
  • Make systems faster with caching, read replicas, the right storage class and a content delivery network
  • Cut cost with the right pricing model, storage lifecycle rules, right-sizing and serverless where it fits
  • Read an exam scenario, find the one requirement that decides it, and rule out the distractors

Syllabus

Modules, lessons and labs

Work through them in order: each one builds on the last, and each module ends with a checkpoint. Module 1 (2 items) is open to everyone. After that, sign in and pass each lesson's questions (70% or better) to unlock the next one. Your progress is saved to your account.

  1. Module 1

    Getting started

    How the course and the exam work, and a sandbox account that cannot surprise you with a bill.

    1. Course orientation: how this course works and how the exam is builtLesson · 10 questions
    2. Lab: make your sandbox account safe to learn inLab · 10 questions

  2. Module 2

    Identity and access management

    Where resources run, who may touch them, and how to govern many accounts from one place.

    1. Global infrastructure, shared responsibility and the Well-Architected FrameworkLesson · 10 questions
    2. IAM principals, policies and how a request is evaluatedLesson · 10 questions
    3. Multi-account governance: Organizations, SCPs, RCPs and Control TowerLesson · 10 questions
    4. Lab: build a least-privilege role and prove itLab · 10 questions
    5. Module 2 checkpoint: identity and access managementModule checkpoint · 10 questions

  3. Module 3

    Networking

    VPC design, the two firewalls, private connectivity, and the DNS and edge services in front of it all.

    1. VPC fundamentals: address space, subnets and routingLesson · 10 questions
    2. VPC security: security groups, network ACLs and guardrailsLesson · 10 questions
    3. VPC connectivity: endpoints, peering, Transit Gateway and hybrid linksLesson · 10 questions
    4. Lab: build a two-AZ VPC from the command lineLab · 10 questions
    5. DNS and the edge: Route 53, CloudFront and Global AcceleratorLesson · 10 questions
    6. Module 3 checkpoint: networkingModule checkpoint · 10 questions

  4. Module 4

    Compute

    EC2, load balancing and Auto Scaling, then Lambda and containers, with a serverless API you build yourself.

    1. EC2 in depthLesson · 10 questions
    2. Load balancing and Auto ScalingLesson · 10 questions
    3. Serverless and containersLesson · 10 questions
    4. Lab: a load-balanced, self-healing web tierLab · 10 questions
    5. Lab: a serverless API with Lambda, API Gateway and DynamoDBLab · 10 questions
    6. Module 4 checkpoint: computeModule checkpoint · 10 questions

  5. Module 5

    Storage

    S3 from fundamentals to locking it down, block and file storage, and moving and backing up data.

    1. S3 fundamentals: classes, lifecycle, versioning and replicationLesson · 10 questions
    2. S3 security and data protectionLesson · 10 questions
    3. Block and file storage: EBS, instance store, EFS and FSxLesson · 10 questions
    4. Hybrid storage, data transfer and AWS BackupLesson · 10 questions
    5. Lab: a private, versioned, self-tidying S3 bucketLab · 10 questions
    6. Module 5 checkpoint: storageModule checkpoint · 10 questions

  6. Module 6

    Databases

    Relational, DynamoDB and caching: picking the database by its access pattern, not by habit.

    1. Relational databases: RDS and AuroraLesson · 10 questions
    2. Amazon DynamoDBLesson · 10 questions
    3. Caching and purpose-built databasesLesson · 10 questions
    4. Lab: design and query a DynamoDB tableLab · 10 questions
    5. Module 6 checkpoint: databasesModule checkpoint · 10 questions

  7. Module 7

    Integration and messaging

    Queues, topics, events, streams and workflows that let parts of a system fail without taking the rest down.

    1. Queues and topics: SQS and SNSLesson · 10 questions
    2. Events, streams and workflowsLesson · 10 questions
    3. Lab: fan out orders with SNS and SQSLab · 10 questions
    4. Module 7 checkpoint: integration and messagingModule checkpoint · 10 questions

  8. Module 8

    Security

    Encryption with KMS, secrets and certificates, and the services that detect and block attacks.

    1. KMS and data protectionLesson · 10 questions
    2. Secrets, certificates and application identityLesson · 10 questions
    3. Threat detection and edge protectionLesson · 10 questions
    4. Lab: envelope encryption with KMS, and a secret in Parameter StoreLab · 10 questions
    5. Module 8 checkpoint: securityModule checkpoint · 10 questions

  9. Module 9

    Resilience and operations

    Designing for failure, recovering across Regions, and the monitoring that tells you before your users do.

    1. Designing for failureLesson · 10 questions
    2. Multi-Region design and traffic routingLesson · 10 questions
    3. Monitoring and automated recoveryLesson · 10 questions
    4. Lab: alarms, a composite alarm and Logs InsightsLab · 10 questions
    5. Module 9 checkpoint: resilience and operationsModule checkpoint · 10 questions

  10. Module 10

    Cost optimization

    Pricing models and architecture choices that cut the bill without cutting reliability.

    1. Pricing models for computeLesson · 10 questions
    2. Cost-optimized architectureLesson · 10 questions
    3. Lab: cost guardrails from the command lineLab · 10 questions
    4. Module 10 checkpoint: cost optimizationModule checkpoint · 10 questions

  11. Module 11

    Capstone and exam

    Build a three-tier architecture end to end, then sit a full-length practice exam.

    1. Capstone: a three-tier web application with CloudFormationCapstone project · 10 questions
    2. Exam strategy and a domain-by-domain reviewLesson · 10 questions
    3. Full-length practice examModule checkpoint · 65 questions

Want it taught live, or to your team?

The course is free: module 1 to anyone, the rest with a free account. We also run it with an instructor, for a cohort or against your own systems. Ask us for the format and price.

Ask about this course