The SAA-C03 exam tests whether you can design AWS solutions, not whether you can recite service descriptions. The single biggest predictor of pass-rate is the number of hours you spent inside a real AWS console before exam day.
This roadmap breaks the exam blueprint into 30 hands-on labs across six weeks. It is intentionally aggressive — five labs per week — but each lab is a contained 30 to 90 minutes. You can run it on weekends.
Week 1 — The IAM and networking foundation
- Build a custom IAM policy from scratch (allow only S3 read on a single bucket).
- Create cross-account role assumption with
sts:AssumeRole.
- Build a VPC with a public + private subnet, IGW, and NAT Gateway.
- Add a NACL and Security Group, prove they overlap.
- VPC Endpoints — connect EC2 to S3 without going through the internet.
If you cannot draw the request flow for lab #5 from memory, do not move on.
Week 2 — Compute and storage primitives
- Launch EC2 with a user-data bootstrap script that installs nginx.
- Build an Auto Scaling Group with a custom AMI.
- Front the ASG with an Application Load Balancer and host-header routing.
- Build an EFS file system mounted on two EC2 instances; prove shared writes.
- S3 lifecycle rules: move objects to Glacier after 30 days.
Week 3 — Databases and caching
- RDS MySQL with a Multi-AZ failover; force the failover from the console.
- Aurora Serverless v2 vs Aurora provisioned — measure cold-start latency.
- DynamoDB with a GSI; query the GSI with the AWS CLI.
- ElastiCache Redis cluster as an EC2 session store.
- S3 + CloudFront with signed URLs — restrict access to a private file.
Week 4 — Decoupling and async
- SQS standard queue + Lambda consumer.
- SQS FIFO + dead-letter queue; intentionally poison-pill it.
- SNS fan-out to two SQS queues.
- EventBridge scheduler to invoke Lambda on a cron expression.
- Step Functions state machine with a parallel branch.
Week 5 — Security, monitoring, governance
- KMS — create a CMK and encrypt an S3 object with it.
- Secrets Manager rotation against an RDS instance.
- CloudTrail + Athena — query who deleted an S3 object.
- GuardDuty enable + a cross-account finding.
- AWS Config rule that flags non-encrypted EBS volumes.
Week 6 — High availability and disaster recovery
- Route 53 weighted routing across two ALBs in different regions.
- S3 cross-region replication + versioning.
- RDS read replica in a second region; promote it.
- Multi-AZ vs Multi-Region — design a four-9s architecture on paper, then build the stripped-down version.
- Capstone: e-commerce architecture with EC2/ALB/RDS/CloudFront/Route 53/CloudWatch — review against the SAA-C03 blueprint and identify three weaknesses.
How to actually do this
Every one of these 30 labs costs money on real AWS. If you have your own account, set a $50 budget alarm and tag aggressively. If you would rather not deal with the cleanup tax, run the same labs in a sandbox-as-a-service platform — every Cloud Arena lab is mapped to one or more SAA-C03 domains.
Pair the hands-on track with two cheap resources: the official SAA-C03 exam guide and one well-reviewed practice exam set. That is it. You do not need a 60-hour video course.
Day-of-exam advice
- The SAA-C03 is a design exam. When in doubt, pick the simplest, cheapest, most managed answer that meets the stated requirements.
- If the question mentions HA, you can almost always rule out single-AZ answers.
- If it mentions cost, lifecycle policies and reserved capacity are usually right.
- If it mentions decoupling, SQS or EventBridge is usually right.
Six weeks. Thirty hands-on labs. The cert is the byproduct — the real win is that you can now build. Start the roadmap with a free lab on our catalog.