SAP-C03 cloud-native architecture explained
Architecture Design and Implementation Built for the Cloud is the first of the five SAP-C03 domains and, with security, the largest: AWS weights it at 25% of scored content. In practice it asks which managed building blocks (functions, containers, queues, event buses, workflow engines, data stores) meet a set of requirements with the least operational burden, and what that choice costs in flexibility. The page covers the reasoning behind the guide’s five tasks and marks what is new compared with SAP-C02.
What the domain asks of an architect
A professional-level scenario rarely asks whether a service can do something. It gives load patterns, team skills, latency targets and compliance limits, then asks for the design that fits them best. The core decisions are:
- Compute model. AWS Lambda suits short, event-driven work (a single invocation is limited to 15 minutes). Containers on Amazon ECS or Amazon EKS, with AWS Fargate removing node management, suit long-running services, existing container images or portability needs. EC2 remains right when instance-level control is required.
- Coupling and messaging. Amazon SQS decouples producers from consumers with buffering; Amazon SNS fans out; Amazon EventBridge routes events by rule across services and accounts; Amazon Kinesis Data Streams handles ordered, replayable streams.
- Orchestration. AWS Step Functions coordinates multi-step workflows with retries and error handling instead of code buried in Lambda functions.
- Data layer. DynamoDB, Aurora or S3, chosen by access pattern.
- Service-to-service networking. Service mesh with Amazon VPC Lattice and Amazon ECS Service Connect is a new skill in the SAP-C03 guide.
The five tasks in the AWS exam guide
| Task | What it covers |
|---|---|
| 1.1 Design architectures built for the cloud | Event-driven messaging (idempotency, ordering, delivery guarantees), stateless design with externalized state, serverless data pipelines, durable multi-step workflows, cross-account and cross-Region event routing, ECS/EKS/Fargate, service mesh (VPC Lattice, ECS Service Connect), ECR image scanning and lifecycle policies, auto scaling, ingress and load balancing, edge (CloudFront Functions, Lambda@Edge), WebSocket and pub/sub, multi-tenant isolation |
| 1.2 Integrate AI and ML services | Generative AI integration with Amazon Bedrock including multi-account patterns, AI agents with AgentCore and knowledge bases, ML inference with SageMaker AI endpoints, RAG ingestion and retrieval (see Bedrock vs SageMaker) |
| 1.3 Design hybrid cloud integration patterns | Redundant Direct Connect, VPN and Transit Gateway connectivity, DataSync, Storage Gateway and Transfer Family, modernizing legacy integrations (API Gateway, Lambda, Amazon MQ), hybrid DNS with Route 53 Resolver, hybrid compute (EKS Anywhere, ECS Anywhere, Outposts, Local Zones) |
| 1.4 Design network architectures | Multi-VPC connectivity (peering, PrivateLink), subnet strategy and IPAM, traffic inspection with Network Firewall, WAF and Gateway Load Balancer, IPv6 and dual-stack migration, global routing with Route 53 and Global Accelerator |
| 1.5 Design data, storage, and database architectures | Data lakes and lakehouses (Lake Formation, Redshift Spectrum, Iceberg), real-time and batch analytics (EMR, Redshift, MSK, AppFlow), database selection and scaling for high availability, storage by access pattern, caching (ElastiCache, DAX), cataloging and cross-account sharing (Glue Data Catalog, Clean Rooms) |
Compared with SAP-C02, the guide marks as new: durable workflows, serverless data pipelines, service mesh, container image management, ingress design, WebSocket patterns and multi-tenant isolation in task 1.1; all of task 1.2; hybrid compute and IPv6 design; and the lakehouse, analytics and data-sharing skills in task 1.5. Several SAP-C02 skills on event routing, networking and database scaling were folded into these tasks.
Worked mini-scenario
An order platform receives bursts of up to ten times the normal rate during promotions. Downstream, an inventory system can process only a steady rate and occasionally fails.
- Option 1: API Gateway to Lambda, calling the inventory system directly. Simple, but bursts hit the inventory system and failures are lost unless the code handles them.
- Option 2: API Gateway to an SQS queue, with a Lambda consumer limited by maximum concurrency and a dead-letter queue. The queue absorbs bursts, the concurrency cap protects the inventory system, and failed messages are kept for inspection. The trade-off is an asynchronous customer response.
Option 2 wins on operational overhead and protection of the dependency. If the process needs human approval or long waits between steps, Step Functions would replace the consumer logic. Step Functions Standard workflows can run for up to a year, Express workflows for up to five minutes.
Easy-to-confuse pairs
| Pair | The distinction |
|---|---|
| SQS vs SNS vs EventBridge | Queue with pull and buffering, pub/sub push to subscribers, rule-based event routing |
| Kinesis Data Streams vs SQS | Ordered replayable stream with multiple readers vs a queue where messages are consumed and deleted |
| Step Functions Standard vs Express | Long-running, auditable executions vs high-volume short executions |
| ECS vs EKS | AWS-native container orchestration vs managed Kubernetes |
| PrivateLink vs VPC Lattice vs Transit Gateway | Private exposure of one service, application-layer service networking, network-layer hub routing |
Exam-style pitfall
Choosing the most modern service rather than the one that meets the stated constraint. If a scenario says the team has no container expertise and wants minimum operations, Kubernetes is wrong even if technically valid; a rule such as reusing existing container images can rule out a Lambda rewrite. Underline the constraint before reading the options.
Practice questions
Question 1. A company ingests clickstream events at highly variable rates. Several independent teams must each process every event in its own way, and a team must be able to reprocess the last day of events after fixing a bug. Which service should receive the events?
- A. An Amazon SQS standard queue shared by all teams
- B. An Amazon Kinesis data stream with one consumer per team
- C. An Amazon SNS topic delivering to each team by email
- D. One AWS Lambda function that calls each team’s code in turn
Show answer
Answer: B
Amazon Kinesis Data Streams retains records for a configurable period and lets multiple consumers read the same records independently, so each team gets every event and can replay. A standard SQS queue gives each message to one consumer, SNS does not retain messages, and one Lambda function couples the teams.
Want more questions like this? Full SAP-C03 practice tests →
Question 2. A workflow approves expense claims. After submission it must wait up to ten days for a manager decision, retry failed payment calls, and keep an auditable history of each step, with the least custom code. What should the architect choose?
- A. A single AWS Lambda function that sleeps until the manager responds
- B. An AWS Step Functions Express workflow
- C. A cron job on an Amazon EC2 instance polling a database
- D. An AWS Step Functions Standard workflow with a wait for the approval callback
Show answer
Answer: D
A Step Functions Standard workflow supports long waits, built-in retries and catch logic, and a recorded execution history, and Standard executions can run for up to a year. Lambda stops after 15 minutes, Express workflows after five, and a cron job on EC2 means custom code and servers.
Want more questions like this? Full SAP-C03 practice tests →
Question 3. A software-as-a-service provider hosts hundreds of small customers and a few large ones. Large customers require strict data isolation and are willing to pay for it. Small customers need the lowest possible cost per tenant. Which tenancy design fits?
- A. Pool the small tenants on shared resources and give each large tenant a dedicated stack
- B. Pool all tenants on shared resources and rely on application-level filtering
- C. Give every tenant a dedicated stack in its own account
- D. Give every tenant a dedicated database but share all other tiers
Show answer
Answer: A
A bridge approach uses pooled, shared resources for small tenants to keep cost per tenant low, and dedicated silos for the large tenants that require isolation. Pooling everything fails isolation and siloing everything raises cost for the many small tenants.
Want more questions like this? Full SAP-C03 practice tests →