SAA-C03 Cheat Sheet — Free Essentials

Key facts distilled from CertKata's SAA-C03 question bank. Free to read — no account needed.

The shared responsibility model

AWS is responsible for security OF the cloud: physical facilities, hardware, and the underlying network and virtualization layer. You're responsible for security IN the cloud: your data, IAM configuration, guest OS patching (for EC2), network traffic protection, and how you configure every service you use. The split shifts with the service model — for a managed service like RDS, AWS also patches the database engine itself, narrowing what you're responsible for compared to running a database yourself on EC2.

Regions, Availability Zones, and edge locations

A Region is a geographic area containing multiple isolated Availability Zones, each with independent power, cooling, and networking. Spreading resources across AZs protects against a single facility failing; nothing but a genuine multi-Region deployment protects against an entire Region going down. Edge locations are a separate, much larger set of sites used by CloudFront and Route 53 to cache content and resolve DNS close to end users — they don't run general-purpose compute.

RTO vs. RPO

Recovery Time Objective is how long you can tolerate being down before service is restored. Recovery Point Objective is how much data loss, measured in time, you can tolerate. The four common DR strategies trade cost against both: backup and restore is cheapest but slowest to recover; pilot light keeps a minimal core running; warm standby keeps a scaled-down full environment running; multi-site active-active runs full capacity in more than one Region and gets you closest to zero for both RTO and RPO, at the highest cost.

Storage class and volume type, matched to access pattern

S3 Standard for frequent access, Standard-IA for infrequent access needing millisecond retrieval, Glacier Instant Retrieval for archival data still needing millisecond access, Glacier Flexible Retrieval for archival with minutes-to-hours retrieval tolerance, Deep Archive for the cheapest, slowest tier. For EBS: gp3 is the general-purpose default, Provisioned IOPS SSD (io2) is for demanding, latency-sensitive random I/O like a busy database, and the HDD-based types (st1, sc1) suit large sequential throughput rather than random access.

Scaling: horizontal vs. vertical

Vertical scaling (scale up) increases the resources of a single instance. Horizontal scaling (scale out) adds more instances and distributes load across them. Auto Scaling groups implement horizontal scaling — combined with a load balancer, this is the standard pattern for both elasticity (matching capacity to demand) and fault tolerance (no single instance is a point of failure).

Security Groups vs. Network ACLs

Security Groups operate at the instance level, are stateful (a permitted inbound request's response is automatically allowed back out), and support only allow rules. Network ACLs operate at the subnet level, are stateless (return traffic needs its own explicit rule), and support both allow and deny rules, evaluated in priority order. Traffic to an instance passes the subnet's NACL first, then the instance's Security Group.