Browse AWS Certification Guides

SAA-C03 Secure Architectures Guide

Study SAA-C03 Secure Architectures: key concepts, common traps, and exam decision cues.

This chapter covers the heaviest domain on SAA-C03. AWS is not just testing whether you recognize IAM, KMS, or security groups. It is testing whether you can choose the right access model, segment workloads safely, and protect data without creating unnecessary operational friction.

I verified the current SAA-C03 Domain 1 task statements on May 11, 2026. AWS currently expresses this domain as three task statements:

  1. design secure access to AWS resources
  2. design secure workloads and applications
  3. determine appropriate data security controls

IAM: Identity and Access Management for AWS users, roles, policies, and permission boundaries.

KMS: Key Management Service for controlling encryption keys and how workloads may use them.

SCP: Service control policy, the AWS Organizations guardrail that limits the maximum permissions accounts or OUs can use.

What this domain is really testing

Expect questions that mix identity, network placement, encryption, compliance, and data-access policy into one scenario. Strong candidates separate those layers instead of treating “security” as one generic control plane.

Current weight in the exam guide

AWS currently weights this domain at 30% of scored content, making it the single largest SAA-C03 area.

Work this domain in order

Lesson AWS task fit Why it matters
1.1 Secure Access Task 1.1 This is the identity lane: federation, roles, temporary credentials, cross-account trust, resource policies, and organization guardrails.
1.2 Secure Workloads & Applications Task 1.2 This is the workload lane: public versus private placement, endpoints, WAF, Shield, secrets, and secure application boundaries.
1.3 Data Security Controls Task 1.3 This is the data lane: encryption, key policy, transport security, retention, backup, replication, and immutability.

Fast routing inside this chapter

If the scenario is really about… Go first to…
federation, roles, temporary credentials, cross-account access, or SCPs 1.1 Secure Access
private subnets, endpoints, ALB placement, WAF, Cognito, or secret handling 1.2 Secure Workloads & Applications
KMS, TLS, versioning, Object Lock, backups, replication, or retention 1.3 Data Security Controls

What strong answers usually do

  • prefer temporary credentials over long-term keys
  • keep the minimum necessary surface public
  • match the control layer to the problem: identity, resource policy, endpoint path, or key policy
  • layer encryption, transport protection, and recovery controls instead of treating one of them as “complete security”

Common SAA-C03 traps

  • choosing long-term IAM users where role assumption is cleaner
  • using public networking when a private endpoint pattern fits better
  • forgetting that KMS key policy can still block access
  • treating backup, replication, encryption, and lifecycle policy as unrelated topics

Best review order late in prep

Revisit this chapter when:

  • you keep missing questions that include the phrase most secure
  • answer choices differ only by access path or policy layer
  • you are confusing resource policy, trust policy, SCP, and KMS key policy

If the wording starts to blur, use the glossary before you continue. Many misses in this domain are label confusion before they are design confusion.

In this section

Revised on Monday, June 15, 2026
2. Resilient Architectures