AWS Certified Solutions Architect Associate (SAA-C03) Course

Learn how IAM handles authentication and authorization, create users, groups, and roles, apply identity-based and resource-based policies, and manage access via the console, CLI, and API.

Create an individual IAM user, assign admin permissions via a group, and log in to the console, avoiding the root account.

Learn AWS IAM authentication methods, from console login with username and password to programmatic access via access keys, and implement multi-factor authentication with something you know and have.

Explore how IAM policy evaluation determines access by starting with denies, evaluating explicit denies, SCPs, resource-based and identity-based policies, permissions boundaries, and session policies to yield effective permissions.

Explore the IAM policy structure, reading JSON policies to allow or deny specific API actions, and learn how ARNs, bucket and object levels, and wildcards define scope.

Explore the IAM policy simulator to test user permissions across AWS services, view inline and attached policies, and simulate existing and new policies for precise access control.

Explore how to evaluate and tighten access in IAM using access analyzer, credential reports, policy simulator, and role policy generation based on CloudTrail activity.

Federate users with an identity provider for temporary credentials and IAM roles. Enforce multi factor authentication, rotate access keys, apply least privilege, and use IAM access analyzer and policy conditions.

Explore architecture patterns for real-world AWS scenarios, including granular IAM permissions, role-based access to DynamoDB, using AWS managed policies, IP-based access controls, and programmatic access with access keys.

Explore EC2, the core AWS service that runs virtual servers in the cloud, deploy and configure instances, manage storage, IP addresses, and networking, and compare pricing models.

Launch linux and windows amazon ec2 instances, choose instance types and AMIs, create key pairs, configure security groups for ssh and rdp, and explore snapshots and custom AMI creation.

Learn to connect to linux and windows EC2 instances using ssh and rdp, with instance connect or session manager, and configure ports 22 and 3389 in security groups.

Explore how Amazon EC2 instance metadata and user data operate. Leverage IMDS v2 with token authentication, view and run base64 encoded scripts on first launch.

Explore EC2 user data and metadata to configure instances, retrieve instance IDs, AMI IDs, and instance types, and run a web server with or without token authentication.

Learn to launch an EC2 instance using user data and metadata to install a web server and display the instance ID on a dynamic page.

Understand how to grant EC2 permissions using access keys versus IAM roles, including how roles leverage AWS STS to provide short-term credentials without storing keys on the instance.

Demonstrate using access keys and IAM roles on EC2, configure credentials, and switch to roles for secure, temporary credentials while avoiding stored plain-text credentials.

Explore EC2 placement groups: cluster, partition, and spread, to deploy instances across availability zones with low latency, high throughput, and hardware isolation for workloads like HDFS and Cassandra.

Explore how network address translation works for public addresses on EC2. The internet gateway performs one-to-one NAT, translating private IPs to a public IP and back, outside the instance.

Learn to configure elastic network interfaces and public and private IP addresses in EC2, associate and reallocate elastic IPs, and understand DNS implications when stopping and starting instances.

Explore how public and private subnets differ, configure public IPs and route tables, and use a bastion host with an internet gateway to access private-subnet instances.

Create a private subnet in the default VPC and deploy a bastion host in a public subnet to access the private instance via EC2 Instance Connect and a key pair.

Explore the AWS Nitro system, Nitro instances, and Nitro enclaves, and understand how modular hardware delivers near bare-metal performance with secure isolated environments.

Map EC2 pricing to use cases: on-demand for interruption-free tasks; spot for cost-sensitive, interruptible workloads; reserved and capacity reservations; dedicated hosts or instances for licensing and security.

Launch and manage EC2 virtual server instances in the AWS cloud using AMIs, EBS or instant storage, and secure key pairs, with instance metadata and user data to configure running instances.

Explore Amazon EC2 architecture patterns, covering user data scripts, low-latency high performance computing with cluster placement groups and Elastic Fabric Adapter, reserved and spot instances, and elastic IP failover.

Discover how auto scaling ensures the right number of EC2 instances and how elastic load balancing distributes traffic across the auto scaling group to create elastic, fault-tolerant applications.

Create an auto scaling group with a launch template and user data to deploy an Apache web server across two AZs and display each instance's AZ via its web page.

Explore Amazon elastic load balancing to ensure high availability and fault tolerance by distributing traffic across EC2 instances, containers, IP targets, and Lambda, with health checks and auto scaling integration.

Explore ALB and NLB deployments, target groups, health checks, and routing rules. Learn path- and host-based routing across AZs and subnets.

Learn how to deploy an application load balancer in front of an auto scaling group, register healthy EC2 instances via a target group, and test cross-AZ traffic distribution.

Explore Amazon EC2 auto scaling policies, including target tracking, simple scaling, step scaling, and scheduled scaling, and how CPU utilization metrics and alarms drive instance adjustments.

Create a dynamic scaling policy for an auto scaling group behind an application load balancer, expanding to four instances across AZs; scale on 50 requests per target with CloudWatch alarms.

Explore cross-zone load balancing in elastic load balancers, where application load balancers always enable it and traffic distributes across registered targets in enabled availability zones.

Externalize session state data to low-latency stores like DynamoDB or external MySQL databases, ensuring seamless failover across instances. Combine this with sticky sessions to complement, not replace, externalized state.

Configure a network load balancer with a custom TCP port 8181 across two availability zones, assign elastic IPs, and enforce access using security groups and a whitelisted network ACL.

Master elastic load balancing and auto-scaling basics, including health checks, grace periods, monitoring options, lifecycle hooks, and termination policies, plus selecting application, network, or gateway load balancers for fault-tolerant architectures.

Explore AWS organizations to manage multiple accounts under a single consolidated bill, apply governance with service control policies, and create new accounts for multi-account testing.

Create an organization and add an account in AWS organizations to establish the management account and a production OU, then enable SCPs and switch roles to verify admin access.

Learn to implement service control policies in AWS Organizations by creating a prod OU, deploying a deny-modify IAM role SCP, and verifying access restrictions before detaching to restore permissions.

Learn how AWS Control Tower sits atop AWS Organizations to deploy a well-architected landing zone with preventive and detective guardrails, auditing, Identity Center single sign-on, and automated account provisioning.

Consolidate multiple AWS accounts into an organization and centrally manage them. Explore consolidated billing, linked accounts, and organizational units, with service control policies and migration across organizations.

Explore architecture patterns in AWS Organizations, including programmatically creating accounts via the Organization API, using service control policies to limit IAM actions, and migrating accounts between organizations.

Explore the Amazon VPC, a logically isolated AWS cloud space for private resources and full networking control, including address ranges, routing, security groups, and on-premises connectivity.

Explore AWS global infrastructure, including regions, availability zones, subnets, AWS Outposts, local and wavelength zones, CloudFront, and the global network, to deploy resilient, low-latency applications worldwide.

Explore Amazon VPC, an isolated cloud network within an AWS region, and learn to use subnets across availability zones, route tables, and internet gateways to manage public and private spaces.

Define VPC CIDR blocks from /16 to /28, avoid overlaps, and design subnets like 10.0.1.0/24 with about 250 usable hosts; blocks cannot be resized, use RFC 1918 ranges and plan.

Learn to create a custom AWS VPC, both with the VPC wizard and manually, including public and private subnets across two availability zones, an internet gateway, and DNS settings.

Compare stateful security groups with stateless network ACLs in an AWS VPC, and learn how EC2 instance protections differ from subnet-level filters, including allow rules and rule processing.

Configure vpc peering between us east 1 and us west 1 using cloud formation, set up security groups and routes, verify private connectivity with ping and curl, then clean up.

Create an S3 gateway endpoint for a VPC and configure routes to the endpoint. Launch an EC2 instance in a public subnet and test access to S3.

Explore AWS client VPN, an OpenVPN-based, fully managed solution that authenticates via Active Directory, mutual authentication using certificates, or SAML, and connects remote devices to a VPC via SSL/TLS.

Enable AWS site-to-site VPN to create a managed IPsec connection between a corporate data center and AWS, using VGW and CGW, dual tunnels, and support for BGP or static routing.

Explore AWS VPN CloudHub topology that links multiple branch offices to a VPC with a VGW, customer gateways, and unique BGP ASN, using route tables to control IPsec traffic.

Connects VPC networks across regions via a direct connect gateway linked to a transit gateway or a virtual private gateway, enabling cross-region connectivity with BGP routing.

Explain IPv6 in a VPC, including 128-bit hex addresses, no NAT, and public routability. Describe AWS IPv6 allocation: 56-bit VPC range, 64-bit subnets, and egress-only gateway for outbound traffic.

Explore Amazon S3 storage classes, 11 nines durability, and availability, and how data placement differs from S3 standard to Glacier, including retrieval fees and first-byte latency.

Master IAM policies, bucket policies, and ACLs to control access to S3 buckets and objects using JSON-based rules, including principle, resource, and action elements and the deny-then-allow authorization flow.

Explore S3 permissions and bucket policies by building an IAM user, applying identity-based and bucket policies, and testing put, get, and delete object actions with deny overrides explicit allow.

Explore versioning, replication, and lifecycle rules in Amazon S3 to preserve, retrieve, and restore objects. Enable cross-region or same-region replication and manage lifecycle transitions and expirations.

Create two S3 buckets, enable versioning, and configure a same-region replication rule with an IAM role; explore lifecycle rules and versioning.

Enforce encryption in S3 by using a KMS key and a bucket policy that denies puts without KMS encryption, demonstrating SSE with AWS KMS and key management.

Generate an s3 presigned url to grant temporary access to a specific object without public bucket access, using aws s3 presign with a 3600 second expiry (and optional lambda authentication).

Explore multi-part upload for large S3 objects, enabling parallel parts via CLI or Botore SDK, and learn how transfer acceleration uses cloud front edges to speed uploads.

Learn how S3 Select and Glacier Select use SQL expressions to retrieve a single file from within a zip archive in S3 or Glacier storage, via Lambda integration.

Enable server access logging on an s3 bucket, choose a separate target bucket with an optional prefix, and capture details like requester, bucket name, time, action, and status.

Create a public Amazon S3 static website by setting up a bucket, enabling static website hosting, uploading index.html and assets, and applying a bucket policy for S3 get objects.

Learn how cross-origin resource sharing (CORS) works, including origins, preflight requests, and configuring S3 bucket rules to allow requests from another origin with access-control-allow-origin, methods, and headers.

Practice cross-account access to an s3 bucket by creating a role in the production account with a trust policy and assuming it from a management account user using external id.

Explore how S3 Object Lambda uses Lambda to process and modify get responses from S3. Leverage prebuilt functions for PII detection and redaction, and for decompression of compressed objects.

Learn Amazon S3 fundamentals, including buckets, region latency considerations, object keys, versioning, encryption options, lifecycle, policies, and access methods for cross-account and performance optimization.

Explore S3 architecture patterns, including versioning to prevent deletion, cross-region replication, lifecycle transitions to IA and Glacier Deep Archive, and client-side encryption with client-managed keys.

Register a domain with Amazon Route 53 to manage DNS, traffic, and availability by creating a hosted zone, checking availability, choosing a top-level domain, and completing checkout.

Implement a failover routing policy in Route 53 for a two-region application load balancer, designate a primary and secondary, and verify failover with health checks and CloudFormation templates.

Explore how Route 53 Resolver connects AWS and on-prem networks with outbound and inbound endpoints, using conditional forwarding and resolver rules for private and public domain resolution.

Learn how Amazon CloudFront uses edge locations and distributions to cache content from origins like S3 or EC2, reducing global latency.

Explore how CloudFront uses EC2 and S3 origins, regional edge caches, and edge locations to deliver content, manage TTLs and cache misses, and forward headers for dynamic caching.

Discover how CloudFront signed URLs and cookies control access to content, with Lambda-based authentication and IP restrictions, and secure S3 origins using OAI and OAC.

Create three s3 buckets for a static website, pdfs, and jpgs, upload index.html, and configure cloudfront with path-based origins, cache behaviors, and origin access control.

Learn how CloudFront handles SSL/TLS with ACM in us-east-1 or third-party certificates, and how SNI enables multiple domain certificates on one IP for secure content delivery.

Lambda at edge lets you run node.js and python lambda functions near viewers to customize CloudFront content, executing at viewer request, origin request, origin response, and viewer response.

Learn how AWS Global Accelerator uses edge locations and anycast IPs within the AWS global network to route users to optimal endpoints, improving latency and supporting TCP and UDP traffic.

Explore dns, caching, and performance optimization using Route 53 for public and private hosted zones, health checks, edge locations, CloudFront caching, and Lambda@edge to tailor content delivery.

Learn DNS caching and performance optimization using Route 53 alias records, failover and geo location routing, CloudFront behaviors for multi-region origins, and signed cookies with AWS Global Accelerator routing.

Explore block and file storage systems, compare them with object storage, and learn how EBS, EFS, FSx, and Storage Gateway enable data access for EC2 and on-premises environments.

Explore the differences between block, file, and object storage, including HDD vs SSD, NAS file shares, and AWS S3 buckets, plus how REST APIs enable scalable cloud storage.

Learn how EBS volumes attach to EC2 instances within the same availability zone and how data durability works, while reviewing gp2, io1, io2 volume types and multi-attach constraints.

Learn how data lifecycle manager automates EBS snapshots and AMIs for EC2, stores snapshots in S3, and enables cross-account disaster recovery with retention and deletion.

Configure raid with EBS at the operating system level for performance and redundancy. Explore raid 0 striping and raid 1 mirroring, and why AWS does not provide raid.

Create and mount an Amazon EFS file system using the CLI, configure SSH and NFS security groups, mount across availability zones, and enable encryption in transit with EFS tools.

Learn how Amazon FSx provides fully managed Windows and Lustre file systems with AD integration, multi-AZ high availability, and native S3 integration for compute-intensive workloads.

Explore how AWS storage gateway links on-premises storage to S3, including file gateway with NFS/SMB and local cache, volume gateway in cached or stored mode, and tape gateway backups.

Explore elastic storage options in AWS, including EBS volumes and snapshots, EFS, FSx, and gateway services, with focus on encryption, RAID, multi-AZ resiliency, and lifecycle management.

Explore how Docker containers enable lightweight, isolated microservices, compare containerization to virtualization, and learn how AWS ECS and cloud-native architectures enable scalable, cost-efficient deployments.

Scale Amazon ECS with service autoscaling for tasks and cluster autoscaling for container instances, using target tracking, step, and scheduled policies driven by CloudWatch metrics like CPU utilization.

Launch a docker container on AWS Fargate by creating a cluster, creating a task definition for the container, running and validating tasks, and optionally deploying a service with auto scaling.

Explore Amazon Elastic Kubernetes Service (EKS), a managed Kubernetes platform across AWS and on premises, enabling hybrid deployment, batch processing via Jobs API, machine learning workflows, autoscaling, and load balancing.

Explore amazon elastic container registry, a fully managed registry integrated with ecs and eks, storing docker and OCI images in s3, with namespaces, public/private repositories, and IAM access control.

Explore Docker containers and ECS features, including Fargate serverless compute, EC2 launch types, container instances, and elastic load balancing, plus images, registries, task definitions, services, and ECS Anywhere.

Explore architecture patterns for AWS container services, including ECS and EKS, with memory-based auto scaling, task roles for S3 access, and CloudWatch Container Insights for monitoring.