AWS Certified Solutions Architect – Professional Cheat Sheet (SAP-C02)
Every in-scope AWS service, architectural pattern, and migration decision the SAP-C02 exam actually tests — organised by the four exam domains, not alphabetically
November 16, 2026 is the last day to sit SAP-C02. This material targets SAP-C02, not SAP-C03.
See the full timelineAbout This Cheat Sheet
- 20 pages
- Every in-scope SAP-C02 service
- For 2+ years of hands-on AWS architecture
- Updated April 2026
Exam domains
Share of the scored SAP-C02 content
- Design Solutions for Organizational Complexity26%
- Design for New Solutions29%
- Continuous Improvement for Existing Solutions25%
- Accelerate Workload Migration and Modernization20%
Services covered
Organizations & identity
- Organizations
- IAM
Networking
- VPC
- Transit Gateway
- PrivateLink
- Direct Connect
Compute & containers
- EC2
- Auto Scaling
- Batch
- Elastic Beanstalk
- App Runner
- Outposts
- Wavelength
- ECS
- EKS
- ECS Anywhere
- EKS Anywhere
- EKS Distro
- Fargate
Storage
- S3
- EBS
- EFS
- FSx
- Glacier
- Storage Gateway
- Backup
- Elastic Disaster Recovery
Databases
- RDS
- Aurora
- DynamoDB
- DocumentDB
- Neptune
- Keyspaces
- ElastiCache
- MemoryDB
- Timestream
Migration & modernization
- Migration Hub
- MGN
- DMS
- SCT
- DataSync
- Transfer Family
- Snow Family
- Proton
Show 27 more servicesShow fewer
Serverless & integration
- Lambda
- Step Functions
- API Gateway
- EventBridge
- AppSync
Analytics
- Athena
- EMR
- Glue
- Lake Formation
- Kinesis
- MSK
- Managed Flink
- OpenSearch
- QuickSight
- Redshift
- Data Exchange
- AppFlow
High availability & DR
- Application Recovery Controller
Monitoring & operations
- CloudWatch
- CloudTrail
- Config
- X-Ray
- Systems Manager
- Compute Optimizer
- Managed Grafana
- Managed Prometheus
- CodeGuru
Concepts covered
- Foundations
- Multi-account strategy · Edge, DNS & load balancing · Application integration
- Resilience & migration
- HA & DR strategies · The 7 Rs
- Also covered
- CI/CD and IaC · Cost management · Machine learning · IoT · Front-end/mobile and end-user computing · Media services and blockchain
- Well-Architected
- The Well-Architected Framework with lenses
Built from the official SAP-C02 exam guide; every service on its in-scope list is audited present.
What's Inside
Organizations & Multi-Account
The building blocks of enterprise-scale AWS governance across many accounts.
- Organizations with OUs and SCPs
- Control Tower landing zone and Account Factory
- Resource Access Manager, Service Catalog
- IAM Identity Center, License Manager, Service Quotas
Identity, Access & Federation
How IAM decides access, and the federation options for workforce, directory and app users.
- IAM policy evaluation order, permission boundaries
- ABAC with resource/principal tags
- IAM Access Analyzer with custom policy checks
- STS variants: AssumeRole / SAML / WebIdentity / SessionToken
- Directory Service: Managed Microsoft AD, AD Connector, Simple AD
- Cognito User Pools vs. Identity Pools
Encryption, Secrets & Certificates
Key management, certificates and secret storage, and when each option fits.
- KMS with multi-Region keys and grants
- CloudHSM, envelope encryption
- ACM for free public TLS + Private CA for internal trust
- Secrets Manager with rotation vs. SSM Parameter Store for config
Threat Detection & Protection
The detection and protection services, and where each sits in an organisation-wide security setup.
- GuardDuty, including Runtime Monitoring and Malware Protection
- Inspector, Macie, Detective, Security Hub
- WAF with Managed Rule Groups; Shield Standard vs. Advanced
- Network Firewall in a central inspection VPC
- Firewall Manager for org-wide policy
- Artifact, Audit Manager, Fraud Detector
Networking — VPC & Hybrid
The VPC building blocks and every option for connecting VPCs and on-premises networks.
- VPC core: subnets, IGW, egress-only IGW, NAT, route tables
- Security groups, NACLs, Flow Logs
- Reachability Analyzer, Network Access Analyzer, IPAM
- Hybrid: Transit Gateway with multiple route tables, VPC peering
- PrivateLink; Gateway vs. Interface endpoints
- Direct Connect with Direct Connect Gateway
- Site-to-Site VPN, Client VPN, Global Accelerator
- Route 53 Resolver DNS Firewall
Edge, DNS & Load Balancing
DNS routing, global failover, CDN features and load-balancer behaviour at the edge of an architecture.
- Route 53: all eight routing policies, Alias records, Private Hosted Zones
- Calculated and CloudWatch health checks
- Application Recovery Controller: readiness checks, routing controls, zonal shift
- CloudFront with OAC, signed URLs/cookies, field-level encryption
- Lambda@Edge vs. CloudFront Functions; real-time logs, origin failover
- ALB / NLB / GWLB: sticky sessions, cross-zone tradeoffs, target-group health checks
Compute, Containers & Serverless
Compute choices from EC2 to serverless, with the purchasing and scaling options the exam tests.
- EC2 instance families; purchasing options: Spot, Reserved, Savings Plans
- Dedicated Hosts, Capacity Reservations
- Auto Scaling with mixed-instances policies and warm pools
- Batch, Beanstalk, App Runner, Lightsail, Outposts, Wavelength
- ECS, ECR, ECS Anywhere, EKS, EKS Anywhere, EKS Distro, Fargate
- Lambda, Step Functions, AppSync for GraphQL
- API Gateway: REST/HTTP/WebSocket, all authorizers, stage variables, custom domains
- EventBridge: rules, Pipes, Scheduler
Application Integration
Messaging and integration services, from queues and fan-out to SaaS data flows and email.
- SQS: Standard/FIFO, visibility timeout, DLQ, long polling, Extended Client
- SNS: fan-out, message filtering, FIFO topics
- Amazon MQ for legacy AMQP/MQTT/STOMP/JMS
- AppFlow for SaaS integration
- SES for transactional/marketing email with VDM
- Pinpoint for multi-channel engagement
Storage
Every storage service, with the features that decide durability, cost, performance and recovery.
- S3: all classes, Replication with optional RTC, Object Lock
- S3 Storage Lens, Access Points, Block Public Access, Object Ownership
- EBS volume types with IOPS/throughput tradeoffs, DLM, Fast Snapshot Restore
- EFS; FSx (Windows/Lustre/NetApp ONTAP/OpenZFS); Glacier archive classes
- Storage Gateway: S3 File, FSx File, Volume, Tape
- AWS Backup with Vault Lock and cross-Region/account copy
- Elastic Disaster Recovery for DR
Database
The relational, NoSQL and specialty databases, with the replication and scaling features that separate them.
- RDS: Multi-AZ vs. Multi-AZ Cluster vs. Read Replicas
- RDS Proxy, Performance Insights
- Aurora: Global Database, Backtrack, Cloning, Aurora Serverless v2
- DynamoDB: GSI/LSI, Streams, TTL, Transactions, PITR
- DynamoDB DAX, Global Tables, PartiQL
- DocumentDB, Neptune, Keyspaces, Timestream
- ElastiCache (Redis/Memcached), MemoryDB (Redis durable)
Analytics & Data
The analytics stack from streaming ingestion to BI, with the cost and governance levers of each service.
- Athena, cost-optimised via Parquet + partitioning
- EMR: Spark/Hive/Presto/HBase, EMR Serverless, Spot
- Glue: serverless ETL + Data Catalog
- Lake Formation: row/column/cell permissions, LF-Tags, cross-account sharing
- Kinesis Data Streams, Kinesis Video Streams, Data Firehose
- Managed Service for Apache Flink, MSK
- OpenSearch Service with vector k-NN; QuickSight with Q for NL BI
- Redshift: Spectrum, Redshift ML, Serverless, zero-ETL
- Data Exchange
High Availability & Disaster Recovery
The disaster-recovery strategies with their RPO/RTO tradeoffs, and the multi-AZ and multi-Region building blocks behind them.
- Four DR strategies: Backup & Restore, Pilot Light, Warm Standby, Active-Active
- Multi-AZ patterns across services
- Multi-Region patterns: S3 CRR, DynamoDB Global Tables, Aurora Global Database
- Route 53 failover, CloudFront
- Application Recovery Controller: readiness checks, routing controls, zonal shift, safety rules
- Elastic Disaster Recovery (DRS) for continuous replication
Migration & Modernization
The migration toolchain end to end, and the 7 Rs for choosing a strategy per workload.
- Migration Hub, Application Discovery Service
- Application Migration Service (MGN)
- Database Migration Service (DMS), Schema Conversion Tool (SCT)
- DataSync, Transfer Family, Snow Family (legacy)
- Proton for platform engineering
- The 7 Rs: Rehost, Replatform, Repurchase, Refactor, Retire, Retain, Relocate
Monitoring, Observability & Ops
Observability and operations tooling: metrics, logs, traces, config history and the advisors that flag risk and waste.
- CloudWatch: metric math, composite alarms, anomaly detection, Synthetics, ServiceLens
- CloudWatch Logs with subscription filters
- CloudTrail + CloudTrail Lake; Config with auto-remediation
- X-Ray; Systems Manager (the full suite)
- Trusted Advisor, Compute Optimizer, Health Dashboard
- Managed Grafana + Managed Service for Prometheus
- CodeGuru (Reviewer and Profiler)
Deployment & Developer Tools
IaC and CI/CD services for shipping infrastructure and application changes safely.
- CloudFormation: templates, change sets, drift detection, StackSets, helper scripts
- CreationPolicy/UpdatePolicy/DeletionPolicy
- CDK, Service Catalog
- CodeBuild, CodePipeline, CodeArtifact
- CodeDeploy: blue/green, canary, linear
Cost Management
Cost visibility, budgeting and commitment tools for running a large estate efficiently.
- Cost Explorer, Budgets with actions
- CUR + Athena/QuickSight for chargeback
- Savings Plans: Compute vs. EC2 Instance
- Compute Optimizer, License Manager, cost allocation tags
ML, IoT, Media & End-User Computing
The specialist service families that turn up in architecture scenarios beyond core infrastructure.
- SageMaker AI full suite
- AI Services: Comprehend, Rekognition, Textract, Transcribe, Translate
- Polly, Lex, Kendra, Personalize, Fraud Detector
- IoT Core, Greengrass, Device Management, Device Defender
- IoT Events, SiteWise, 1-Click, Things Graph
- Elastic Transcoder, Kinesis Video Streams, Managed Blockchain
- Amplify, Device Farm, AppSync, WorkSpaces, AppStream 2.0
Well-Architected Framework & Lenses
The Well-Architected Framework and the lenses the exam uses to judge a design.
- The six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability
- Well-Architected Tool with workload-specific lenses
- Lenses: ML, Generative AI, Serverless, Financial Services, IoT, SAP, Games
Why This Cheat Sheet Helps
The SAP-C02 exam asks you to compare entire architectures — each question has long scenarios and each wrong answer is plausible. The winning skill is pattern recognition: 'hybrid DNS' → Route 53 Resolver; 'cross-account logs' → Organizations + centralised CloudTrail; 'legacy Oracle to Aurora' → SCT + DMS; 'no downtime, multi-Region' → Aurora Global Database + Route 53 / ARC. This cheat sheet puts those patterns side by side with the precise AWS vocabulary examiners use.
It assumes real-world experience — you already know how a VPC works. Use it to ensure every in-scope service is on your mental map and to reinforce the architectural decision rules the test actually measures.
How to Use It
Skim the whole sheet once to map the exam's surface area. Then hammer practice exams and, for each wrong answer, find the relevant section and study the tables side by side. Pay extra attention to the Exam Tip boxes — they encode the most frequently-tested decision rules.
In the final week, walk through the four domain percentages against your confidence in each section: Organizational Complexity (26%) → sections 2–5; New Solutions (29%) → sections 6–15; Continuous Improvement (25%) → sections 17–19, 24; Migration (20%) → section 16.
Frequently Asked Questions
Is this AWS Solutions Architect Professional cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the SAP-C02 exam.
How much AWS experience do I need before SAP-C02?
AWS recommends two or more years of hands-on experience designing and deploying workloads on AWS. The exam is architecture-heavy: you are expected to compare entire solutions, not just individual services. If you do not already hold the Solutions Architect Associate or equivalent experience, start there first.
How is SAP-C02 different from SAA-C03?
SAA-C03 tests the service you would choose for a use case. SAP-C02 tests the architecture you would choose — multi-account governance, hybrid networking, DR strategies, migration patterns, and how to refactor an existing workload toward cost efficiency or reliability. Questions are longer, answers more subtly different, and the time per question is generous so you can work through the scenario.
Is this cheat sheet updated for the current SAP-C02 exam?
Yes, it is built directly from the current SAP-C02 exam guide (solutions-architect-professional-02) and audited against the full in-scope services list. It also reflects current services — Amazon Application Recovery Controller, AWS Network Firewall, AWS Proton, the CloudOps rebrand of SysOps, and recent deprecations (Snow Family, legacy AWS Support plans).
Keep Studying
Recommended courses
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.