The AWS Solutions Architect Associate (SAA) certification expires every three years. I’ve taken it twice. The first time was a panic-cram of A Cloud Guru courses; the second time I built a 50-card deck and reviewed it for 10 minutes a day for six weeks. The second time was easier and I scored higher. This is that deck.
The exam content evolves — services get added, deprecated, renamed — but the architectural backbone barely moves. VPC design, IAM policy mental models, S3 storage class selection, RDS vs. DynamoDB tradeoffs, Lambda concurrency limits. These are the cards that show up regardless of which exam version you sit for.
The 50 cards, by domain
The deck is organized around the four scored content domains in the official AWS SAA-C03 exam guide: Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), and Design Cost-Optimized Architectures (20%). Cards span all four domains, but I’ve grouped them below by the AWS service families that dominate each domain — that’s the level at which the questions actually live.
VPC and networking — 12 cards. CIDR block sizing, public vs. private subnets, NAT gateway vs. NAT instance, internet gateway, VPC peering vs. Transit Gateway, security groups vs. NACLs (and the stateful/stateless distinction that trips up everyone), VPC endpoints (Gateway vs. Interface), Route 53 record types, and the three cross-region failover patterns. Networking sits across the Resilient and High-Performing domains and is the single densest service family on the exam.
IAM and security — 8 cards. User vs. role vs. group, policy evaluation logic (explicit deny > explicit allow > implicit deny), STS assume-role flow, KMS key types (AWS-managed vs. customer-managed vs. customer-provided), envelope encryption, and the three Secrets Manager vs. Parameter Store decision factors. The Design Secure Architectures domain is the largest single domain at 30% per the official exam guide, and IAM evaluation questions are almost always “which of these IAM evaluations grants access” — algorithmic, not factual.
S3 — 6 cards. Storage classes (Standard, Standard-IA, One Zone-IA, Intelligent-Tiering, Glacier Instant, Glacier Flexible, Glacier Deep Archive), the cost-vs-retrieval-time tradeoffs for each, lifecycle policies, versioning + MFA Delete, S3 Object Lock for compliance, and Transfer Acceleration. S3 questions are usually pricing-optimization questions in disguise.
Compute — 8 cards. EC2 instance families and when to use each, EBS volume types (gp3 vs. io2 vs. st1), Lambda concurrency limits (reserved, provisioned, account quota), the three Lambda cold-start mitigations, ECS vs. EKS vs. Fargate, and the Spot vs. On-Demand vs. Reserved cost-curve break-even calculation.
Databases — 8 cards. RDS Multi-AZ vs. read replicas (and the recovery-point/recovery-time differences), Aurora vs. RDS, DynamoDB on-demand vs. provisioned capacity, DynamoDB partition key design and the hot-partition problem, Global Tables, ElastiCache (Redis vs. Memcached), and DAX. The exam loves to test “which DB for this access pattern” — get the access pattern → DB mapping fluent.
Resilience and monitoring — 8 cards. Multi-AZ vs. multi-region, the four S3 storage durability tiers, CloudWatch metrics vs. logs vs. alarms, X-Ray tracing, EventBridge vs. SNS vs. SQS, SQS standard vs. FIFO, and Step Functions for orchestration. Choosing the right pub/sub or queue primitive is a recurring pattern across the Resilient and High-Performing domains.
What the cards look like — cloze deletion with overlapping clusters
Every card in this deck is a cloze deletion. AWS exam questions are mostly “given access pattern X, choose service Y” — the natural fit is a context sentence with the discriminator hidden.
The S3 storage class card uses the overlapping pattern (one of SuperMemo’s recommended cloze techniques for ordered enumerations):
S3 storage classes by retrieval cost (cheapest to most expensive):
{{c1::Glacier Deep Archive}} → {{c2::Glacier Flexible Retrieval}} →
{{c3::Standard-IA}} → {{c4::Standard}}. Retrieval times scale inversely:
Glacier Deep Archive is {{c5::12 hours}}; Standard-IA is {{c6::milliseconds}}.Six cards from one note. Each card hides one tier in the cost ordering OR one retrieval-time fact. Reviewing card 3 (Standard-IA hidden) shows the Glacier tiers as anchor context, which reinforces the ordering of the tiers — the actual exam-tested skill — even on a card that’s nominally about a single class.
For service-vs-service comparisons, the discriminator gets its own deletion:
RDS {{c1::Multi-AZ}} provides {{c2::synchronous::no data loss on failover}}
replication across AZs for high availability. {{c3::Read replicas}} are
{{c4::asynchronous::can lag the primary}} and exist for read scaling, not
HA. Multi-AZ failover takes {{c5::60-120 seconds}}; promoting a read replica
takes {{c6::minutes}} and is a manual operation.Six cards. Cards 1 and 3 force you to produce the service name. Cards 2 and 4 force you to produce the synchronous/asynchronous distinction (the most-tested fact). Cards 5 and 6 force you to produce the failover-time numbers. Each independently scheduled.
Security group vs. NACL — historically the trip-up question — gets four overlapping cards:
Security groups are {{c1::stateful::return traffic auto-allowed}} and
operate at the {{c2::ENI}} level. NACLs are {{c3::stateless::must allow
both directions explicitly}} and operate at the {{c4::subnet}} level.The hint syntax (after ::) carries the why of each fact. By exam day, the candidate has internalized not just “stateful vs. stateless” but the operational consequence — which is what AWS tests for.
Why a 50-card deck beats a course rewatch
I tried both for my first cert. The course rewatch is great for the first viewing — it builds the mental model. But by week three of trying to retain it, you’ve forgotten the cards from week one and you’re starting over. Spaced repetition fixes exactly this problem.
Avorio’s FSRS-5 implementation schedules each card based on how well it sticks for you. CIDR math is universally hard — those cards will show up frequently. IAM policy evaluation is universally easy if you’ve done any AWS before — those stretch out fast. By exam day, you’ve spent the most time on the cards that actually need it.
The 6-week pace
Week 1-2: Learn the deck. 10-12 cards a day, ~15 minutes. Every card seen 4-5 times.
Week 3-4: Consolidation. The algorithm decides what you see — typically 25-35 reviews per day, ~10 minutes.
Week 5-6: Mix in practice exam questions. Use the deck to fill gaps that the practice exams expose. The scheduler will adapt.
By exam day, the cards you struggled with most have been reviewed 25+ times each, and the easy ones 6-8 times. Your retention curve looks the way you want it to.
Try the first 10 below
The networking cluster — 10 cards covering VPC, subnets, security groups, and route tables. If they’re already easy, your foundation is solid. If 3+ feel uncertain, install Avorio and load the full 50.