The AWS Solutions Architect Associate is the most common first cloud certification, and the study advice for it is mostly the same: watch a course, do practice exams, memorise the service comparison tables. That approach works — plenty of people pass using it. It's just not the approach we'd recommend.
We hire people who hold this certificate and we teach people working towards it. The gap between passing and being useful on day one is rarely knowledge of services. It is whether you can look at an unfamiliar problem and reason about it the way AWS expects. The exam tests that reasoning more than most candidates realise. What follows is the order we'd study in if we were starting again.
Start with the Well-Architected Framework
Before any service-specific content, read the Well-Architected Framework whitepaper. All of it. It's 80 pages and it's the lens through which the exam questions are written. Questions that seem ambiguous often become clear when you ask "which answer is most aligned with the five pillars?"
There are six pillars now — Sustainability joined Operational Excellence, Security, Reliability, Performance Efficiency and Cost Optimisation in late 2021 — but the way to use them hasn't changed. Almost every question contains a phrase that names a pillar without naming it. "Most cost-effective" is Cost Optimisation. "Least operational overhead" is Operational Excellence, and it nearly always points at the managed service over the one you run yourself. "Highly available" is Reliability, and it means more than one Availability Zone. Spot the phrase and two of the four options usually eliminate themselves.
Read it actively. For each section, write down the preference AWS is expressing as a plain sentence: "prefer managed services over self-managed", "prefer horizontal scaling over vertical", "prefer roles over long-lived keys". That page is worth more than any flashcard deck, because it's the rule the flashcards are instances of.
Build something that costs money
Not a tutorial. A project. Something with a multi-tier architecture, IAM roles, at least one serverless component, and a VPC you designed yourself. The discipline of building something real — where mistakes cost you actual AWS credits — teaches differently than video courses.
Cap your spending at $20 with a billing alarm. It's enough to build seriously, not enough to cause stress.
A concrete brief that covers most of the exam's surface area: a small web application with an Application Load Balancer in public subnets, the application on EC2 or ECS in private subnets across two Availability Zones, a single RDS instance, static assets in S3 behind CloudFront, and one Lambda function triggered by an S3 upload or an EventBridge schedule. Build the VPC by hand — CIDR ranges, route tables, an internet gateway, a NAT gateway — and then explain to yourself why the private subnets can reach the internet and the internet cannot reach them.
Two notes. The NAT gateway bills by the hour whether or not anything passes through it, so it will be the line item that surprises you; delete it when you stop for the day. And build with Terraform or CloudFormation from the second attempt onwards, because destroy is how you keep the bill at zero between sessions. Set the billing alarm in CloudWatch in us-east-1, where billing metrics live.
The mistakes you make here are the curriculum. Locking yourself out of an instance because the security group references the wrong source, or watching a Lambda fail because its execution role can't write to the bucket — these are exam questions, and you'll remember them because they cost you an evening.
Practice exams last, not first
Practice exams are for identifying gaps in understanding, not for building understanding. If you start with practice exams, you'll learn to recognise answer patterns without understanding the underlying concepts. That works for passing but fails on the job.
Use them like a diagnostic, not a textbook. Sit one under exam conditions — the real thing is 65 questions in 130 minutes, with a scaled pass mark of 720 out of 1,000 — then go through every question you got wrong and every question you got right by guessing. Don't just read the provider's explanation. Open the AWS documentation for the service involved and read until the question is obvious. Keep a list of the topics that sent you to the docs; when one appears twice, it's a gap, not bad luck.
Two or three practice exams is plenty. If you're scoring consistently above 80 per cent and the gap list has stopped growing, book the real one. If you've done six and the score is drifting rather than climbing, you've started memorising the question bank.
The one thing that matters most
Understanding IAM. Deeply. More than 30% of real-world cloud security issues trace back to misconfigured IAM. The exam reflects this. Time spent understanding assume role, resource policies, permission boundaries, and SCPs compounds more than time spent on anything else in the curriculum.
"Deeply" means being able to answer, without looking it up, what happens when an identity policy allows an action, a resource policy is silent, and a service control policy denies it. The evaluation order — an explicit deny anywhere wins; then SCPs, resource policies, permission boundaries and identity policies each get their say — is a small amount of material that unlocks a large share of the security questions.
The concept most often half-understood is the role. A role has two policies, and they do different jobs. The trust policy says who may assume it; the permissions policy says what they can do once they have. Confusing the two is the root of most "the Lambda has the permission but still gets AccessDenied" afternoons.
{
"Effect": "Allow",
"Principal": { "Service": "lambda.amazonaws.com" },
"Action": "sts:AssumeRole"
}Do this by hand once: create a role, assume it from the CLI with aws sts assume-role, export the temporary credentials, and try an action the role isn't allowed. Then add a permission boundary and watch an action that the identity policy permits get refused anyway.
The certificate proves you can pass an exam. The project proves you can be trusted with an account.
A study plan that fits around a job
At five or six hours a week, this is roughly eight weeks.
- Weeks 1–2: the Well-Architected whitepaper, actively, plus the IAM documentation on policy evaluation and roles. No video course yet.
- Weeks 3–5: the project. Build the VPC first, then the tiers, then the serverless piece. Use a course as a reference when you're stuck, not as a sequence to sit through.
- Week 6: the services you haven't touched — Route 53, storage classes, the databases you didn't use — read against your pillar-preference page so each one has a "why" attached.
- Weeks 7–8: practice exams as diagnostics, gap list, targeted docs reading, then book the exam while the material is warm.
Flashcards still earn their place for the genuinely arbitrary — which storage class has a minimum retention period, which service names map to which acronyms. Keep that deck under fifty cards. Everything else should be something you can derive, because that's the only kind of knowledge that survives contact with a real account.
