AWS Solutions Architect

Build systems from managed parts and event flows instead of servers you patch. You learn where Lambda, containers and workflow services each fit, and where service limits, ordering and failure handling change the design.

• Event-driven design with EventBridge, SNS and SQS
• Lambda limits, concurrency and cold starts
• Choosing between ECS, EKS and Fargate
• Orchestrating long workflows with Step Functions
• API Gateway patterns and throttling
• Idempotency, retries and dead-letter queues

You build A serverless, event-driven architecture with each service limit noted.

Networks are the hardest thing to change later. You plan IP space, connect many accounts and a data center through shared routing, and decide how traffic reaches users and how DNS resolves across environments.

• IP address planning for growth and overlap
• Hub-and-spoke routing with Transit Gateway
• Direct Connect and VPN: resilience and failover
• PrivateLink and endpoint services
• Hybrid DNS with Route 53 Resolver
• Global delivery with CloudFront and Global Accelerator

You build A hub-and-spoke network design for ten accounts and one data center.

Pick the store from the access pattern, not from habit. You compare object, block, file, relational, key-value and warehouse options, and design lakes, caches and streaming paths that scale without rework.

• Choosing a data store from access patterns
• S3 storage classes and lifecycle design
• Aurora, RDS and DynamoDB: scale and consistency
• Analytics with Redshift, Athena and Lake Formation
• Streaming ingestion with Kinesis and MSK
• Caching layers and read scaling

You build A data architecture for one product that names a store for each access pattern.

AI features now arrive as design requests for existing systems. You decide where managed AI services, foundation models and custom models fit, how data reaches them, and how their cost and failure modes shape the rest of the design.

• Managed AI services versus custom models
• Foundation models with Amazon Bedrock in a reference design
• Feeding models: data pipelines and retrieval
• Where to place inference: real time, batch or edge
• Capacity, latency and cost of AI workloads
• Failure handling when a model is slow or wrong

You build A reference architecture that adds a generative AI feature to an existing application.

One account does not scale to an organization. You design the account structure, central sign-in, and the preventive controls that keep every team inside the same limits while still moving on their own.

• Account structure with AWS Organizations
• Service control policies and their limits
• Landing zones with Control Tower
• Central sign-in with IAM Identity Center
• Cross-account roles and permission boundaries
• Delegated administration of security services

You build An account structure with preventive guardrails and a role model for three teams.

Encryption choices are really ownership choices. You decide who controls each key, how keys replicate across Regions, and how secrets and certificates are issued, rotated and revoked across a large estate.

• Envelope encryption and KMS key policies
• Customer-managed keys and key ownership across accounts
• Multi-Region keys and CloudHSM
• Secrets Manager and rotation at scale
• Certificates with ACM and private CAs
• Immutability: S3 Object Lock and backups

You build A key management design with ownership, rotation and access rules.

Auditors ask for evidence, not intent. You map regulatory requirements to detective and preventive controls, collect proof continuously, and extend the same controls to AI features, covering logging, content filtering and human review.

• Mapping a framework to AWS controls
• Continuous evaluation with Config and Security Hub
• Audit evidence with Audit Manager and CloudTrail Lake
• Data residency and sovereignty constraints
• Controls for AI: guardrails, logging and review
• Responsible AI duties in an architecture

You build A control map for a regulated workload, including its AI feature.

The same architecture can cost very different amounts depending on how you buy it. You match workloads to on-demand, Savings Plans, reserved capacity and Spot, then build the tagging and reporting that let each team see its own spend.

• On-demand, Savings Plans, reserved and Spot compared
• Right-sizing compute and choosing Graviton
• Licensing and tenancy effects on cost
• Cost allocation tags and account-level showback
• Cost Explorer, budgets and anomaly detection
• Unit economics: cost per transaction or per customer

You build A purchasing and allocation plan for a multi-team workload.

Data movement and idle storage are the costs teams overlook. You trace where bytes travel, redesign paths to avoid charges, and tier storage and databases to match how often the data is really used.

• Reading a data transfer bill
• NAT gateways, endpoints and cross-AZ traffic
• Caching and CDN to reduce egress
• Tiering and lifecycle rules for object and block storage
• Database right-sizing, serverless and read replicas
• Retention policies that remove data nobody uses

You build A cost reduction review of one workload, with the traffic and storage changes costed.

Resilience starts with what the business can tolerate losing. You set recovery time and recovery point targets, choose a disaster recovery pattern to match, and design failover that works across Availability Zones and Regions.

• Recovery objectives from business impact
• Backup and restore, pilot light, warm standby and active-active
• Multi-AZ and multi-Region design for data stores
• Failover routing and health checks
• Backup policy and cross-account copies
• Testing recovery before you need it

You build A disaster recovery plan with a pattern, targets and a test procedure for a tiered application.

Migration is a portfolio decision before it is a technical one. You assess applications, pick a strategy for each, plan waves and dependencies, and choose the tools that move servers, databases and large data sets with little downtime.

• Discovery and application portfolio assessment
• The migration strategies: rehost, replatform, refactor and others
• Planning waves and dependencies
• Moving servers and databases with minimal downtime
• Transferring large data sets online and offline
• Landing the workload and decommissioning the old one

You build A migration plan that assigns a strategy to each of twelve applications.

Operations at scale depends on repeatable change and clear signals. You define infrastructure in code, ship it through secured pipelines, and build the logging, metrics and tracing that tell you a system is healthy.

• CloudFormation and CDK for shared building blocks
• StackSets and multi-account deployment
• CI/CD and DevSecOps pipeline design
• Drift detection and change control
• Metrics, logs and traces across accounts
• Automated remediation of known failures

You build A pipeline and observability design that deploys one stack to several accounts.

Take one large, messy scenario and design it end to end. You balance security, cost, resilience, migration and operations in a single architecture, then defend each trade-off to people who disagree.

• Analyzing a multi-team scenario and its conflicts
• Drawing the target architecture
• Checking it against every pillar
• Costing and phasing the move
• Presenting the trade-offs you made

You build A full architecture proposal with diagrams, cost estimate, risks and decision records.