SAP-C03 study plan: four weeks
Four weeks is workable for SAP-C03 if you already design on AWS and can give 8 to 10 hours a week, roughly 36 hours in total. The plan follows the five domains of the AWS exam guide and splits the hours by their published weights: Domain 1 and Domain 2 are 25% of scored content each, Domain 5 is 20%, and Domains 3 and 4 are 15% each.
AWS recommends two or more years of experience designing and implementing solutions on AWS. Without that, extend the plan to six to eight weeks and spend the extra time on hands-on work.
| Week | Domain | Weight | Hours (of about 36) |
|---|---|---|---|
| 1 | Architecture Design and Implementation Built for the Cloud | 25% | 9 |
| 2 | Security, Compliance, and Governance | 25% | 9 |
| 3 | Resilience, Migration, and Business Continuity; Cost-Optimized Architecture Design | 15% each | 5.5 each |
| 4 | Operational Excellence and Automation, then practice | 20% | 7, plus about 3 for practice |
Week 1: Architecture Design and Implementation Built for the Cloud (25%)
The largest domain by scope: five tasks covering cloud-native design, AI and ML integration, hybrid integration, networking, and data, storage and databases. See the domain explainer.
- Cloud-native building blocks (task 1.1). Event-driven messaging with EventBridge, SQS, SNS and Kinesis, durable workflows with Step Functions, ECS and EKS, service mesh with VPC Lattice and ECS Service Connect, ECR image scanning, auto scaling, API Gateway and edge, multi-tenant isolation.
- AI and ML integration (task 1.2). Bedrock integrations, AgentCore agents, RAG with knowledge bases and vector stores, SageMaker AI inference endpoints. Bedrock vs SageMaker helps with the service boundary.
- Hybrid and network (tasks 1.3 and 1.4). Direct Connect, VPN and Transit Gateway redundancy, DataSync and Storage Gateway, Route 53 Resolver for hybrid DNS, VPC peering and PrivateLink, IPAM, Network Firewall and WAF, IPv6, Route 53 and Global Accelerator for multi-Region routing.
- Data (task 1.5). Lakehouse designs with Lake Formation and Apache Iceberg, analytics pipelines, database selection and scaling, caching, cross-account sharing with Glue Data Catalog and Clean Rooms.
Hands-on: wire an event-driven pipeline end to end and compare it with a container-based version.
Week 2: Security, Compliance, and Governance (25%)
Professional questions assume many accounts, teams and compliance rules. See the domain explainer.
- Identity (task 2.1): IAM Identity Center and federation, Cognito, least-privilege cross-account roles, permission boundaries, data perimeters with Access Analyzer and VPC endpoint policies, IAM Roles Anywhere. See AWS IAM basics.
- Encryption (task 2.2): KMS customer managed keys and rotation, ACM and Private CA, CloudHSM, and post-quantum strategies with ML-DSA and ML-KEM.
- Multi-account governance (task 2.3): Organizations, Control Tower, SCPs and RCPs, RAM, centralized logging with CloudTrail, Config, Security Lake and Security Hub, Inspector and Patch Manager.
- Compliance and responsible AI (tasks 2.4 and 2.5): data residency and sovereignty, AWS Artifact, audit trails including AI services, Bedrock Guardrails, AgentCore Identity, human-approval workflows.
Hands-on: build two accounts, restrict one with an SCP, and share a resource between them.
Week 3: Resilience and cost (15% each)
Resilience, Migration, and Business Continuity (explainer), about 5.5 hours:
- Migration strategies (task 4.1): discovery and portfolio assessment, rehosting with AWS Transform MGN, DMS and DataSync, replatform, refactor and strangler fig, mainframe modernization.
- Disaster recovery (task 4.2): RTO/RPO (backup types and RTO/RPO), Elastic Disaster Recovery, Resilience Hub, Route 53, Global Accelerator and Application Recovery Controller, multi-cluster containers.
- Business continuity (task 4.3): AWS Backup governance and Vault Lock, ransomware protection, Fault Injection Service and chaos engineering.
Cost-Optimized Architecture Design (explainer), about 5.5 hours:
- Purchase options, Graviton, Compute Optimizer and AI/ML cost levers (task 3.1); data transfer and network costs including CloudFront and VPC endpoints (task 3.2); tagging, Cost Explorer, Budgets and Anomaly Detection (task 3.3); storage, database and observability costs (task 3.4).
Hands-on: run a fault-injection experiment on a test stack and write down what the recovery target actually was; then price two designs for the same workload.
Week 4: Operational excellence and practice (20%)
Operational excellence and automation, about 7 hours:
- Infrastructure as code with CloudFormation and CDK, policy as code, secrets, StackSets (task 5.1).
- CI/CD and DevSecOps: multi-account pipelines, pipeline vulnerability scanning, Bedrock Evaluations, blue/green and canary (task 5.2).
- Observability: CloudWatch, X-Ray, OpenTelemetry, Container Insights, synthetic and real-user monitoring, SLOs, AI/ML metrics (task 5.3).
- Operational automation: remediation with safety constraints, scaling, runbooks (task 5.4).
Then about 3 hours of practice under time: 75 questions in 180 minutes. Start with the sample questions, then official AWS practice material (see study resources). Review every wrong answer by asking which requirement in the scenario it violated.
Weekly rhythm
| Day | Activity |
|---|---|
| 1-2 | Read documentation and whitepapers for the week’s topics |
| 3-4 | Hands-on in a sandbox account |
| 5 | Question practice, 20 to 25 scenarios |
| 6 | Review errors and rewrite weak topics as comparisons |
| 7 | Rest or light review |
Mapping the plan to the exam guide
The AWS exam guide lists task statements and skills for every domain; the week sections above follow them. Tick off each skill as you can explain it, and give extra time to anything you cannot yet design on paper. The guide also lists in-scope and out-of-scope services, so check a service against it before spending a day on it. If you are coming from the outgoing exam, SAP-C03 vs SAP-C02 sets out its four domains next to these five. The exam’s format page has the weights and scoring.