AWS SAA-C03 design secure architectures syllabus
Design Secure Architectures is the heaviest domain on the exam at 30 per cent, and it has the fewest task statements of the four. Three tasks carry almost a third of the scored content, which makes it the densest ground on the paper.
It is also the domain whose weighting moved most. Under the original SAA-C03 split it sat at 26 per cent, level with cost optimisation. It now outweighs cost optimisation by ten points. The AWS SAA-C03 syllabus hub page covers the other three domains.
Pattern
| Element | Detail |
|---|---|
| Questions | 65 |
| Scored questions | 50 |
| Unscored questions | 15, not identified on the exam |
| Duration | 130 minutes |
| Question types | Multiple choice and multiple response |
| Scaled score | 100 to 1,000 |
| Passing score | 720 |
| Negative marking | None. An unanswered question is scored as incorrect |
This domain carries 30 per cent of the scored content. The current weightings are below, and they replace the 26, 24, 24 and 26 split that most study material still quotes.
| Domain | Weighting | Task statements |
|---|---|---|
| Design Secure Architectures | 30% | 3 |
| Design Resilient Architectures | 26% | 2 |
| Design High-Performing Architectures | 24% | 5 |
| Design Cost-Optimized Architectures | 20% | 4 |
Even if $9 invested today doubled in five years...
$9 spent on mocks today could change what you’re earning in five years.
AWS Solutions Architect Pro · one year of access.
Task statements
Task 1.1: Design secure access to AWS resources
- Access controls and management across multiple accounts
- Federated access and identity services, including IAM and AWS IAM Identity Center
- AWS global infrastructure, covering Availability Zones and Regions
- Security best practices such as the principle of least privilege, with multi-factor authentication on IAM users and the root user
- A flexible authorisation model built from IAM users, groups, roles and policies
- Role based access control, including AWS STS, role switching and cross account access
- Security across multiple accounts, including AWS Control Tower and service control policies
- Resource policies, and when to federate a directory service with IAM roles
- The AWS shared responsibility model
Task 1.2: Design secure workloads and applications
- Application configuration and credentials security
- AWS service endpoints, and controlling ports, protocols and network traffic
- VPC architecture with security components: security groups, route tables, network ACLs and NAT gateways
- Network segmentation into public and private subnets
- Security services and their use cases, including Amazon Cognito, Amazon GuardDuty and Amazon Macie
- Integrating AWS Shield, AWS WAF, IAM Identity Center and AWS Secrets Manager to secure applications
- Securing external network connections through AWS VPN and AWS Direct Connect
- Threat vectors external to AWS, such as distributed denial of service and SQL injection
Task 1.3: Determine appropriate data security controls
- Data access and governance, retention and classification
- Encryption at rest using AWS KMS
- Encryption in transit using AWS Certificate Manager and TLS
- Access policies for encryption keys, key rotation and certificate renewal
- Data backups and replication
- Data lifecycle and protection policies
- Aligning AWS technologies to compliance requirements
Services most used in this domain
- IAM, AWS IAM Identity Center, AWS STS and AWS Directory Service
- AWS Organizations, AWS Control Tower and service control policies
- Amazon VPC with security groups, network ACLs and NAT gateways
- AWS WAF, AWS Shield, AWS Network Firewall and AWS Firewall Manager
- Amazon GuardDuty, Amazon Inspector, Amazon Macie, Amazon Detective and AWS Security Hub
- AWS KMS, AWS CloudHSM, AWS Certificate Manager and AWS Secrets Manager
- Amazon Cognito, AWS Artifact and AWS Audit Manager
What is not in this domain
- No hands-on configuration. The exam is multiple choice throughout
- No penetration testing or offensive security content
- No compliance framework examined in its own right. Compliance appears only as a requirement to design against
- No out-of-scope services such as the AWS developer tooling
How to spend the time
Give this domain the largest share of your hours. At 30 per cent it is nearly a third of the scored questions, and candidates working from older study plans routinely treat it as equal to cost optimisation, which is now ten points lighter.
IAM policy evaluation is the single highest yield topic. Questions frequently turn on which of several policies wins, how a resource policy interacts with an identity policy, and what a role assumption actually grants.
Learn the encryption split precisely. AWS KMS for data at rest, AWS Certificate Manager and TLS for data in transit, then key policies and rotation as a separate concern from either.
Network security sits here rather than in the networking domain. Security groups, network ACLs, public and private subnet design and NAT gateways are examined as security decisions. Browse the available AWS Solutions Architect practice papers.
Common mistakes
- Allocating this domain 26 per cent of revision time under the old weighting
- Confusing security groups, which are stateful, with network ACLs, which are not
- Treating cross account access as an IAM user problem rather than a role assumption problem
- Mixing up AWS Shield, which handles distributed denial of service, with AWS WAF, which filters application layer requests
- Skipping AWS Control Tower and service control policies because they look like enterprise-only features
- Leaving questions blank, when an unanswered question is scored as incorrect
Security here against security in the other domains
| Aspect | Domain 1 | Elsewhere on the exam |
|---|---|---|
| Network design | Examined as segmentation and access control | Examined for performance in Domain 3 |
| Encryption | At rest, in transit, plus key management | Not a focus |
| Multi account | Control Tower and service control policies | Cost allocation and billing in Domain 4 |
| Weighting | 30 per cent | 70 per cent across three domains |
| Task statements | Three | Eleven |
Frequently asked questions
How much of the AWS SAA-C03 exam is security?
30 per cent of the scored content, which makes Design Secure Architectures the heaviest of the four domains.
Has this domain always been 30 per cent?
No. The original SAA-C03 weighting put it at 26 per cent. It was revised in place under the same exam code.
How many task statements does it have?
Three, which is the fewest of any domain despite it carrying the most marks.
Is IAM the main topic?
It is the backbone of Task 1.1, covering users, groups, roles, policies, federation and cross account access through AWS STS.
Is network security in this domain or the networking one?
In this one. Security groups, network ACLs, subnet segmentation and NAT gateways are examined here as security decisions.
Which encryption services are examined?
AWS KMS for data at rest, AWS Certificate Manager with TLS for data in transit, and AWS CloudHSM for dedicated key storage.
Is the shared responsibility model tested?
Yes, named in Task 1.1 alongside security best practices.
Are AWS Shield and AWS WAF both in scope?
Yes, both are named under securing workloads and applications, and questions often turn on which of the two fits a given threat.
Do I need to pass this domain separately?
No. The exam uses compensatory scoring, so only the overall score matters.
Is there a hands-on component?
No. Every question is multiple choice or multiple response.