DJames617 SAA-C03 / Domain 1 / 30%
Design Secure Architectures
Secure access, secure workloads and applications, and data security controls.
Official Task Statements
| Task | What to prove |
|---|---|
| SAA-1.1 | Design secure access to AWS resources. |
| SAA-1.2 | Design secure workloads and applications. |
| SAA-1.3 | Determine appropriate data security controls. |
Concepts You Need to Understand
- IAM policy evaluation, federation, roles, resource policies, network segmentation, encryption, secrets, and secure application boundaries.
AWS services involved
- IAM
- IAM Identity Center
- KMS
- Secrets Manager
- VPC
- WAF
- Shield
- ACM
- CloudFront
Important configurations
- Trust policies versus permissions policies.
- Security groups and NACLs.
- KMS key policies.
- Private subnets and VPC endpoints.
Exam Decision Patterns
Least operational overhead
Prefer managed and serverless services when they satisfy the requirement. Exceptions appear when the scenario needs host control, unsupported runtimes, specialized network behavior, or exact migration compatibility.
Highly available
Identify the failure boundary. One instance is not HA. Multiple instances in one AZ help capacity but not AZ failure. Multi-AZ handles regional AZ faults. Multi-Region handles regional events but adds complexity and cost.
Durable
Durability is about preserving data. Use replication, versioning, backups, point-in-time recovery, and tested restore plans. A durable backup does not guarantee a low RTO.
Decouple the application
Use SQS for buffering work, SNS for fanout, EventBridge for event routing, and Step Functions for visible workflow state. Add retries, DLQs, and idempotent consumers.
Least privilege
Prefer roles and temporary credentials, scope actions/resources/conditions, watch explicit denies, and remember that resource policies may also be required.
Most cost-effective
Read usage pattern, duration, access frequency, scaling behavior, data transfer, and operations. Cheapest unit price is not always lowest total cost.
Lowest latency
Move content or compute closer to users, cache aggressively, choose the right database access pattern, and avoid unnecessary cross-Region or NAT paths.
Private connectivity
Use private subnets, VPC endpoints, PrivateLink, VPN, Direct Connect, Transit Gateway, and tight DNS/routing design instead of public exposure.
Minimum downtime
Separate deployment downtime, failure recovery, and data restore time. Use blue/green, canary, Multi-AZ, replication, and tested rollback where appropriate.
Automatic remediation
Pair a reliable signal with EventBridge or CloudWatch, a scoped Systems Manager Automation or Lambda action, and a validation step.
Common Mistakes
- Using IAM users for application access.
- Exposing a database publicly because the app needs outbound internet.
Example Architecture
Hands-On Activity
Build an IAM role trust policy and permissions policy on paper, then compare evaluation flow.
For an AWS-account lab, use one of the linked mini labs and keep cleanup steps visible before you start.
Task-by-Task Study Notes
SAA-1.1 - Design secure access to AWS resources.
This task statement is asking whether you can turn a scenario into a decision. Start by identifying the workload requirement, the control or service family involved, and the tradeoff AWS is testing in this domain.
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
SAA-1.2 - Design secure workloads and applications.
This task statement is asking whether you can turn a scenario into a decision. Start by identifying the workload requirement, the control or service family involved, and the tradeoff AWS is testing in this domain.
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
SAA-1.3 - Determine appropriate data security controls.
This task statement is asking whether you can turn a scenario into a decision. Start by identifying the workload requirement, the control or service family involved, and the tradeoff AWS is testing in this domain.
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
Review Checklist
Sources and Review Metadata
This independent training application is not affiliated with or endorsed by Amazon Web Services. AWS, Amazon Web Services, and AWS certification names are trademarks of Amazon.com, Inc. or its affiliates.