[NEW] AWS Certified Solutions Architect Associate (SAA-C03)

Explore AWS global infrastructure, including regions and availability zones, their purpose for low latency and data durability, and how local zones, wavelength zones, edge locations, and outposts extend coverage.

Explore how an AWS account provides access to regions and AZs, with EC2 and RDS at AZ level, while VPC and S3 are regional, IAM and Route 53 are global.

Create and activate a new AWS account, set a cost budget, and create an IAM user. Prepare SSH key pairs for EC2 access; optionally buy and configure a domain name.

Create a new AWS account to access the six-month free tier with $200 credits ($100 default plus $100 after activities), learn activation, verification, and basic EC2 quota checks.

Navigate the AWS management console to switch regions, access account details, and open EC2 and S3 consoles via the search box, with parallel tabs.

Learn to set up an AWS cost budget and email alerts to prevent runaway charges, using the root user and the billing dashboard, while managing AWS credits.

Create an IAM user with administrator access to perform AWS exercises, log in securely without using the root account, and understand the difference between root and IAM users.

Create and manage a region-specific EC2 SSH key pair for Linux, using .pem files, or convert to .ppk for Windows with PuTTY, and store keys securely.

Buy and configure a public domain name and point DNS to AWS Route 53 by creating a public hosted zone and updating GoDaddy's name servers, enabling AWS-hosted DNS resolution.

Explore how AWS accounts and IAM connect, distinguish root vs non-root users, and manage permissions with IAM policies, groups, and roles for secure cloud access.

Learn how every aws action is an api call accessed via rest endpoints, and how the management console, cli, and sdk simplify authentication with iam.

Learn about IAM credentials, authentication using username and password for the console, and access keys for CLI or SDK, plus default password policies and creating an IAM user.

Create a new IAM user named Ben with a password, log in as that user to confirm access, while noting the root account MFA and multi-session setup for future use.

Explore multi-factor authentication (MFA) for AWS logins, enabling dynamic, time‑sensitive tokens via virtual apps like google authenticator or hardware tokens for root and iam users.

Learn IAM access keys for programmatic AWS access, including access key id and secret access key, and practice using them with the AWS CLI and SDK, while securely storing credentials.

Understand how IAM policy defines permissions for IAM identities to access AWS services and resources, with action-level control and conditional access.

Complete a hands-on exercise to create two IAM policies—custom S3 full access and inline EC2 read-only—and attach them to a user, then verify permissions via bucket creation and EC2 access.

Version IAM policies to enable safe changes; new policy versions allow rollback to older versions, with up to five versions and the most recent set as default.

Understand how allow and deny statements interact across multiple IAM policies, and that explicit deny overrides allow while implicit deny applies when no policy grants access.

Learn how IAM groups attach policies to a group, assign users to groups like DevOps, and manage permissions from group policies alongside user policies.

Install and configure the AWS CLI on your workstation, set a default region, provide access key and secret key, and run commands like describe regions and s3 ls.

Learn to access AWS programmatically with the AWS SDK, install the language-specific SDK, and run Python code to launch and terminate an EC2 instance.

Learn how to access an in-console terminal with preconfigured iam credentials using aws cloudshell to run cli commands without installing the cli, noting its non-persistent nature.

Understand how IAM roles grant temporary credentials for applications and services using STS, enabling EC2 access to S3, cross-account access, and federated web identities without long-term keys.

Preview advanced IAM topics and their relevance to other AWS services, including cross-account IAM roles, AWS IAM Identity Center, AWS Organizations, and Control Tower for centralized access.

Explore how IAM permission boundary acts as a guardrail to cap the maximum permissions a user or role can have, by intersecting attached policies with the boundary.

Explore IAM tools, including Access Analyzer, policy simulator, and policy generator, to analyze permissions, enforce least privilege, identify external and internal access, and detect unused permissions.

Test how inline, managed, and resource-based policies affect user access with the IAM policy simulator, and identify which policies grant or deny specific actions, including implicit denies.

Learn how to create precise IAM policies using the policy generator and CloudTrail-based analysis, leveraging Access Analyzer and policy simulator to grant only required permissions.

Discover how the IAM credential report audits AWS accounts, listing users, passwords, access keys, MFA status, and key ages, downloadable as a CSV from the IAM console.

Discover IAM best practices for working in AWS, with exam-relevant concepts to help you prepare for the AWS certified solutions architect associate (SAA-C03) exam.

Pause to review exam essentials and section summaries, download the exam essential guide, and revise IAM fundamentals and future IAM advanced topics before the next section.

Explore AWS compute options from physical servers to virtual machines, containers, and serverless. Learn how EC2, ECS/EKS, and Lambda map to IaaS, PaaS, and FaaS.

Learn how Amazon EC2 delivers elastic compute cloud virtual machines in the AWS cloud, letting you select operating system and compute resources while AWS manages hardware across regions and AZs.

Learn the step-by-step process to launch and connect an EC2 instance, including selecting region, VPC, AMI, instance type, security groups, key pairs, and SSH or browser-based access.

Explore ssh-based and browser-based ec2 access, detailing ssh key pairs and the ec2 instance connect flow using temporary keys, iam permission ec2-instanceconnect:send-ssh-public-key, and port 22.

Launch a Linux EC2 instance and connect via SSH using a key pair or the EC2 instance connect browser terminal. Terminate the instance at the end of the exercise.

Understand EC2 instance types, including general purpose, compute, memory, and storage optimized, and how family and size define CPU and memory. Benchmark workloads and use pricing calculator for scalable choices.

Understand security groups as the firewall for EC2 in a VPC, with inbound and outbound rules. Learn how they are stateful and interact with network ACLs, IPv4 and IPv6.

Explore elastic block storage for EC2, including root and data volumes, and its persistent, AZ-bound nature. Learn how to resize, snapshot, and back up EBS in S3.

Learn the basics of virtual private cloud networking in AWS. Discover how VPC components like subnets, availability zones, and CIDR ranges determine EC2 IP addressing—private, public, and elastic—and internet access.

Learn how EC2 user data serves as a bootstrap script to configure instances on first boot, enabling software installation, OS updates, file downloads, and tasks, alongside manual and AMI approaches.

Launch an EC2 instance with a user data script to install and run a simple http server, ensure port 80 is open for http traffic, and publish a basic website.

Execute a hands-on exercise to enable an EC2 instance with an IAM role to access an S3 bucket, download a file, and serve it via a web server.

Create a custom AMI from a running web server EC2 instance, reboot for data consistency, then launch a new instance from that AMI, verify the site, and terminate both instances.

Explore the EC2 pricing options—on demand, spot, savings plan, and reserved instances—and how per-second and per-hour pricing and workload patterns drive cost decisions.

Demonstrates how to request spot instances in the EC2 console, set launch parameters, define target capacity and price constraints, and leverage capacity-based matching to save on costs.

Use EC2 tags to label resources with key-value pairs, enabling environment-based filtering (production), cost allocation, and policy-based access across aws resources.

Pause the video to read through the Amazon EC2 summary, reinforcing EC2 fundamentals, the section summary, and exam essentials for the AWS SAA-C03 track.

Explore the EC2 advanced topics, including an in-depth look at EBS, elastic network interfaces, hibernation for cost savings, low-latency arrangements, and the EC2 instance metadata service.

Explore elastic block storage (EBS) terminologies like volume size, IOPS (baseline, provisioned, credits), burst performance, and throughput for read/write operations on EC2.

Compare gp3 and gp2 SSDs with provisioned io1 and io2 express, and HDDs st1 and sc1, weighing cost and performance for relational databases, big data, and NFS; monitor with CloudWatch.

Learn how EBS snapshots backed by AWS and stored in S3 provide 11 nines of durability, with incremental backups, sharing across accounts, cross-region copies, and automated lifecycle with DLM.

EBS volumes are AZ scoped and attachable only within the same AZ, with data replicated there. Cross-AZ moves require a snapshot to restore a volume in the target AZ.

review the exam essentials for the AWS certified solutions architect associate course by pausing each slide to read the notes and reinforce understanding.

Automate the entire ami lifecycle with ec2 image builder, using recipes to create, verify, and distribute custom amis from a base amazon linux ami across regions and accounts.

Elastic network interfaces (eni) attach to EC2 instances in a VPC to provide private and elastic IP addresses and MAC addresses, with security groups tied to the eni.

Explore EC2 hibernation, a suspend-to-disk feature that saves memory to the EBS root volume for supported OS/AMIs, so you resume with the same state and instance ID while reducing costs.

Explore EC2 instance metadata service (IMDS) with v1 and secure v2. See how EC2 apps retrieve instance ID, AMI ID, private IPs, security groups, and IAM role credentials via 169.254.169.254.

Explore EC2 placement groups within availability zones: cluster placement group for low-latency, spread placement group to avoid hardware failures, and partition placement group for clusters like Hadoop, Cassandra, or Kafka.

design highly available and scalable aws architectures using load balancers and autoscaling groups across multiple availability zones, with horizontal and vertical scaling for EC2.

Explore how the application load balancer operates at layer 7, with listeners, target groups, health checks, and routing features like content-based routing and weighted target groups.

Explore advanced application load balancer features, including http to https redirection, sticky sessions, connection draining, dual stack dns, mutual tls, client ip preservation, request tracing, and content-based routing.

Launch two EC2 instances, register them in an ALB target group with health checks to index.html, and configure an internet-facing ALB on http port 80 with restricted backend security.

Enable tls termination on the application load balancer by provisioning an ACM certificate via dns validation, switch the listener to https (port 443), and adjust the alb security group.

Enable ALB sticky sessions on the target group using duration-based cookies and a load balancer generated cookie for five minutes, so requests stay on the same EC2 instance.

Learn host-based routing with an application load balancer by creating Asia and Europe target groups, adding listener rules to forward traffic by host header, and mapping domains in Route 53.

Explore network load balancer fundamentals at layer 4, supporting tcp, udp, and tls, with per-az static ips and client ip preservation for streaming, gaming, and IoT.

Explore how the gateway load balancer inspects traffic with IDS/IPS and third-party appliances, using the GNU protocol to encapsulate traffic and centralize inspection in your VPC.

Compare application load balancer, network load balancer, gateway load balancer, and classic load balancer, covering external vs internal deployment, cross-zone balancing, server name indication, client IP preservation, and proxy protocol.

Automate EC2 scaling with an ASG using a launch template. Maintain minimum, maximum, and desired capacity while health checks and ALB integration enable dynamic scaling via CloudWatch policies.

Create an autoscaling group in the EC2 console by selecting a launch template, configuring networks and AZs for high availability, and setting desired capacity, health checks, and optional load balancer.

Explore key autoscaling group features, including termination policy, cooldown period, instance refresh, lifecycle hooks, and warm pools, to optimize scaling and rolling updates for exam readiness.

Configure an autoscaling group with base on-demand capacity and spot pools, using on-demand percentage above base and diverse spot strategies to optimize costs.

Explore load balancers with auto scaling groups, using simple and target tracking scaling policies and CloudWatch alarms. Learn job processing with SQS and S3, plus blue-green deployment with target groups.

Understand that a VPC is an isolated cloud network with subnets. Explore CIDR ranges, internet gateway, NAT gateways, IP addresses, route tables, and VPC firewall (security groups and ACLs).

Create your own VPC in the AWS console, name it Demo VPC, set the IPv4 CIDR block 10.10.0.0.16, and bypass the default VPC.

Learn how to design a VPC with subnets across availability zones, assign CIDR ranges, and use main and subnet route tables to route traffic through the internet gateway.

Attach an internet gateway to the VPC, create a public subnet in one AZ and a private subnet in another, and set up route tables for internet access.

Explore how a NAT gateway provides outbound internet access for private subnets by translating addresses, using an elastic IP in a public subnet, and offering high availability.

Create a NAT gateway in a public subnet, allocate an elastic IP, and update the private subnet route to flow outbound traffic through the NAT gateway; verify by pinging google.com.

Compare traditional AZ-based NAT gateways with regional NAT gateway, highlighting automatic expansion, manual mode, zonal affinity, simplified VPC routing, and no inter-AZ data transfer charges.

Explore the VPC firewalls, including security groups and network ACLs, and learn how instance-level stateful rules and subnet-level stateless rules govern inbound and outbound traffic.

Explore how VPC endpoints and AWS private link connect your private subnet to S3, DynamoDB, KMS, SQS, and more, using gateway and interface endpoints to save NAT costs.

Enable private access to S3 and DynamoDB with a VPC gateway endpoint, routing via a prefix list in the subnet route table; accessible only within the VPC and no charge.

Demonstrates creating a VPC gateway endpoint for S3 to enable private access from EC2 in a private subnet, with IAM role, route-table updates, and AWS CLI verification.

Enable dns hostname and private dns for your vpc interface endpoint to let aws service dns names resolve to the private eni ip, keeping traffic within the vpc.

Demonstrates creating an interface endpoint for Amazon SQS, configuring ENI in a private subnet, setting security groups and IAM permissions, enabling private DNS, and testing connectivity via AWS CLI.

Secure VPC endpoints by applying gateway and interface endpoint security groups and policies, and resource-based restrictions to limit access to specific services like S3 and DynamoDB.

Explore how AWS Transit Gateway uses a hub-and-spoke model to connect thousands of VPCs and on-prem networks via VPN or Direct Connect. Understand regional peering and connect attachments for SD-WAN.

Transit gateway's advanced features include IP multicast, AZ affinity, and appliance mode to prevent asymmetric routing, plus RAM-based cross-account sharing for centralized networking patterns.

Compare VPC peering, transit gateway, and VPC endpoint (PrivateLink) for private app access across VPCs, emphasizing one-way access, overlapping CIDR issues, and scalability.

Explore AWS site-to-site vpn for hybrid networking, enabling private, encrypted connectivity between your on-premises data center and a vpc via two ipsec tunnels, with static or dynamic routing.

Explore AWS site-to-site VPN architectures, including multiple redundant connections for high availability, public IPs, and VPN cloud hub pattern with detached mode, unique BGP ASNs, and up to 10 sites.

Explore AWS client VPN, privately connecting your home workspace to a VPC with encrypted traffic via private IP access, using OpenVPN and X.509 authentication.

Discover AWS Direct Connect, a private, dedicated link from your on-premises data center to the AWS network, using private, public, and transit interfaces for low latency and data migrations.

Explore how the AWS Direct Connect Gateway enables global connectivity to VPCs across regions, using PrivateWave or TransitWave; it's optional, and PrivateWave limits VPC attachments, while TransitWave supports thousands.

Understand that Direct Connect provides private on-premises to AWS connectivity with dynamic BGP routing, no static routing, three virtual interfaces, and lower data transfer costs, though setup takes weeks.

Learn how VPC flow logs capture traffic at ENI, subnet, or VPC levels to troubleshoot issues and monitor bandwidth, with options to send logs to CloudWatch, S3, or Kinesis Firehose.

Learn how VPC traffic mirroring captures full packets for deep packet inspection, enabling third-party appliance analysis, unlike flow logs that only record metadata; set up via the VPC console.

Understand IPv6 in VPC with dual-stack and IPv6-only subnets, where IPv6 addresses are public by default and NAT cannot handle IPv6; use an egress-only internet gateway for outbound IPv6 traffic.

Explore VPC architectures across availability zones with public and private subnets, NAT gateways, and VPC endpoints to support scalable web and 3-tier applications.

Review the section summary and exam essentials to reinforce learning. Pause the video as needed and complete the quizzes to validate your understanding before moving to the next section.

Explore Amazon S3 as the core object storage service, its integration with compute services, and its storage classes, security, management, automation, logging and monitoring, and optimization for exam readiness.

Learn the differences between block storage, file storage, and object storage, including their performance traits—IOPS, throughput, latency—and how S3 via API compares to EBS and EFS.

Explore Amazon S3, a web-based object storage service with virtually unlimited space and 11 nines of durability, powering backend storage, data lakes, media hosting, backups, and archiving.

Create a region-specific, uniquely named S3 bucket, then upload objects with keys, access controls, and metadata. Explore bucket types, object metadata, versioning, ETag, tags, and ACL permissions.

Create a new S3 bucket in the Mumbai region, upload a sample file, and learn about globally unique bucket names and making objects public.

Explore Amazon S3 storage classes, compare standard, infrequent access, one zone IA, Intelligent Tiering, and S3 Glacier options, and learn when to use based on durability, retrieval times, and cost.

Understand how S3 Intelligent Tiering automatically moves objects between frequently accessed, infrequently accessed, and archived tiers based on usage, with optional Glacier Flexible Retrieval and deep archive.

Explore S3 Express One Zone, a single-AZ directory bucket with millisecond access, up to 2 million requests per second, and 10x faster, 80% cheaper than standard S3.

Explore S3 security features at the access and data layers, including block public access, bucket policies, encryption, and versioning. Learn about object lock, MFA delete, and cross-account or network restrictions.

Enforce secure S3 access by using block public access and a bucket policy to control who can read or write objects, while preferring IAM permissions over ACLs.

In this hands-on exercise, make an S3 bucket public by disabling block public access and adding a bucket policy granting public read access to all objects.

Explore s3 data security with encryption in transit via https, encryption at rest, and secure endpoints, including fips 140 options, plus bucket policies to enforce https.

Explore how s3 sse-kms uses envelope encryption, deriving per-object data keys from a master key and requiring kms generate data key, kms decrypt, and kms describe key permissions.

Identify and protect sensitive data in S3 with Amazon Macie, using machine learning and pattern matching to detect PII and notify via EventBridge for automated actions.

Enable S3 bucket versioning to keep multiple object versions with version ids, allowing revert via delete markers and cost-efficient storage for non current versions through lifecycle rules.

Enable S3 bucket versioning, demonstrate viewing versions, overwriting with the same key, and recovering from deletes or delete markers to restore previous versions.

Enable S3 object lock to prevent deletion or alteration, using bucket or object level retention period, with governance and compliance modes, MFA delete, and legal hold to meet regulatory needs.

Enable bucket-level MFA delete to require a multi-factor code for deleting object versions or suspending versioning, with versioning enabled and MFA delete set via the AWS CLI as root.

Replicate objects across S3 buckets with S3 replication, asynchronously for same-region and cross-region setups. Learn live replication for new objects and on-demand batch replication for existing ones, plus 15-minute SLA.

Explore s3 replication across regions, including inter-region data transfer costs and intra-region no charge. Enable selective replication by prefix or tags, apply sse kms encryption, and monitor with CloudWatch.

Set up S3 bucket replication between a source and destination bucket with versioning enabled, create the replication rule, and verify object replication and version consistency.

S3 event notification triggers actions on object events by sending metadata to AWS SNS, AWS SQS, or AWS Lambda, with optional EventBridge integration and prefix or suffix filters.

Create an SNS topic and email subscription, update the access policy to allow S3 to publish, and configure S3 event notifications for the images folder with put events.

Learn how S3 triggers the event bus Amazon EventBridge, routing events to multiple targets such as Lambda, SQS, or Step Functions, with cross-account routing and JSON filters.

Discover when to use S3 event notification with lambda, event bridge, SQS, SNS, and AWS step functions to handle image thumbnails, video queues, auditing, and Glacier restore events.

Enable S3 server access logs to collect request records, including requester, operation, status, and bytes transferred, stored in a separate bucket. Analyze these logs to enhance security and optimize costs.

S3 inventory provides a scheduled report of all bucket objects and metadata, delivered to another S3 bucket for analysis with Athena.

Identify who can access your S3 bucket by analyzing ACLs and bucket policies with IAM Access Analyzer for S3, detecting public or cross-account access, and applying one-click blocks.

Explore S3 Storage Lens, a visualization tool across an AWS organization that surfaces more than 100 metrics on bucket usage, encryption status, requests, and costs to optimize storage and archiving.

Explore S3 performance optimization techniques, including prefix partitioning, multipart uploads, byte-range fetches, transfer acceleration, and CloudFront as a content delivery network to reduce latency for global users.

Partition data in S3 using prefixes to boost throughput by enabling parallel reads and higher per-prefix request rates. Organize by time, device, or hashes, and avoid hot prefixes.

Learn how multipart uploads split large files into parallel parts for S3 to enable faster, more resilient transfers for objects over 100 MB and above 5 GB when required.

Use the byte range fetch to download object parts in parallel with range gates, then reassemble for streaming, ETL tasks, or resumable transfers via AWS S3 get object.

Explore how Amazon cloudfront caches S3-originated media at global edge locations to speed delivery, while reducing data transfer costs and leveraging a 1 TB free tier and lower rates.

Learn to use S3 batch operations to replace object tags by creating a manifest, configuring an IAM role with required permissions, running the job, and verifying the results.

Host a static website on s3 using static website hosting over http, then learn how cloudfront and route 53 enable https and custom domains.

Learn to host a static website on S3 by creating a bucket, enabling static website hosting, uploading index.html, and configuring a public bucket policy and Route 53 DNS.

Explore the S3 requester pays feature, shifting data access and transfer costs to the requester. Enforce usage via bucket policies and headers, while storage costs stay with the bucket owner.

Learn how S3 pre-signed URLs grant temporary access to S3 objects without AWS credentials, enabling GET and PUT operations with controlled expiration and secure sharing.

Amazon S3 explains cross-origin resource sharing (CORS), the same-origin policy, preflight requests, and bucket-level CORS configuration with origins, methods, and headers.

Learn how S3 access points simplify scalable access control by creating per-prefix access points with dedicated policies and DNS, enabling internet or VPC restricted access.