CertificationsAWS Solutions Architect Associate SAA-C03Labs
AWS Solutions Architect Associate SAA-C03 hands-on labs
Cloud panel and CLI: identity policies, bucket policies, route tables, Multi-AZ design and the cost that follows.
25 labs you run in the browser: 7 guided, 13 assisted, 4 challenge, 1 capstone. About 5 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
25
labs
7
guided
steps in order
5
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- Cloud panel with the matching CLI line· you click25 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Choose a bucket for large render exports
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
The studio exports finished renders as single files of 30 to 60 GB. Until now the exports went onto attached block volumes, and the team keeps adding disks as the library grows…
object storageblock storagewrite once dataencryption at rest
Close a public receipts bucket
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A finance team scans supplier receipts into one bucket. The bucket was created before the account turned on Block Public Access…
object storagepublic accessencryption at rest
Give a report writer the key it needs
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A report writer reads order objects and writes its output back to storage under a customer managed key. The key was added last month and the role has no policy that names it yet…
least privilegerole policykey permissions
Stand up the copy bucket for a standby region
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
Order objects are copied into a standby region every fifteen minutes so the business can keep trading if the main region is lost. The copy target does not exist yet…
cross region copydisaster recoveryobject versioningencryption at rest
Keep a scaled out fleet behind its balancer
ProGuided · Quick · 6 min · Cloud panel with the matching CLI line
The web fleet grew from two nodes to eight during a sale week, which is exactly what the scaling policy is for. The nodes that came up took their group from the launch template…
elastic computeload balanceringress rulelaunch template
Let only the app tier reach the database port
ProGuided · Quick · 12 min · Cloud panel with the matching CLI line
Orders database port 5432 is open to every IPv4 address after a temporary test rule was left in place. Only the application servers should connect. Identify the exposure, remove it…
security groupgroup sourcedatabase segmentation
Make the load balancer subnet public
ProGuided · Quick · 12 min · Cloud panel with the matching CLI line
Priya is preparing a new load balancer subnet for the public web tier. Its route table has no path to the internet…
public subnetroute tableinternet gatewaysubnet association
Move a checkout service to its new port
ProAssisted · Quick · 5 min · Cloud panel with the matching CLI line
The checkout service is moving off the old framework and will listen on 8443 from Monday. Its group still opens 8080 to every address, a leftover from the first launch…
network segmentationsecurity groupservice migration
Serve product images through the cache only
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
Product images are served through an edge cache, and most requests are answered close to the viewer. The origin group still answers 443 from every address…
edge cacheorigin groupdata transfer costingress rule
Make the web tier HTTPS only
ProAssisted · Quick · 10 min · Cloud panel with the matching CLI line
Priya, the platform lead, found that the public web security group still has its launch-week HTTP and SSH rules. The service now accepts TLS through its public edge…
security groupsstateful filteringleast privilege
Protect a label archive with versioning and encryption
ProAssisted · Quick · 10 min · Cloud panel with the matching CLI line
Olu in operations reports that someone overwrote a shipping label in tidewater-labels-archive last week and the previous copy could not be recovered…
S3 versioningdefault bucket encryptionoverwrite recovery
Close a public receipts bucket
ProAssisted · Quick · 12 min · Cloud panel with the matching CLI line
Dana in Finance received a scanner alert that tidewater-receipts is publicly readable. The bucket holds customer receipts…
S3 Block Public Accessbucket policiesIAM permissions
Trim an analytics role to read only
ProAssisted · Quick · 12 min · Cloud panel with the matching CLI line
Hana in security reviewed the analytics role and found it carries full S3 access although the job only ever reads reports. Give analytics-reader read access and nothing more…
least privilegeIAM managed policiesrole policies
Block a scanning address at the subnet edge
ProAssisted · Quick · 14 min · Cloud panel with the matching CLI line
Hana spotted repeated requests from 198.51.100.77 against the app subnet's HTTPS service. Block that source at the subnet network ACL while keeping the service reachable for other clients.
network ACLsstateless filteringrule evaluation order
Find out why the report role is denied
ProAssisted · Quick · 14 min · Cloud panel with the matching CLI line
Kofi in reporting says report-writer gets AccessDenied writing to tidewater-scans. The role is meant to write files under reports/ only. Find out why the write is denied…
IAM policy simulatorimplicit denyresource ARN matchingleast privilege
Find who opened SSH to the world and close it
ProAssisted · Quick · 14 min · Cloud panel with the matching CLI line
Hana found TCP 22 on sg-0bastion open to every IPv4 address this morning. Audit the management event to identify who added the rule, then close only the public source…
CloudTrail event historysecurity group ingressaudit trail
Refuse plain HTTP on the landing bucket
ProAssisted · Quick · 14 min · Cloud panel with the matching CLI line
Hana in security reports that partners drop stock files into tidewater-landing, and the company standard forbids plain HTTP for anything that touches it…
S3 bucket policiesTLS enforcementexplicit denypolicy simulator
Give the app tier a private path out and a tight front door
ProAssisted · In-depth · 25 min · Cloud panel with the matching CLI line
Priya's application servers in subnet-0app-a need outbound access to download patches, but the app subnet must stay unreachable from the internet…
private subnetNAT gatewayroute tablessecurity group references
Let the dev team create roles without letting them out of bounds
ProAssisted · In-depth · 25 min · Cloud panel with the matching CLI line
Hana, the platform lead, is handing the dev lead role to the team. The role keeps the customer managed dev-admin policy so it can create and manage roles for its own work…
permissions boundarydelegated administrationleast privilegepolicy simulator
Close three findings from the security review
ProAssisted · In-depth · 28 min · Cloud panel with the matching CLI line
Hana's quarterly security review lists three findings: a bucket with customer receipts is readable by everyone, the build role carries administrator rights…
public bucket policyBlock Public Accessleast privilegemanaged policies
Cut three storage lines the review flagged
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
A storage cost review names three buckets. invoice-export-archive is the audit record of what the billing system sent…
cost optimizationstorage lifecycleobject versioninganonymous access
Find the one bucket that needs work
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
Three buckets came through a storage review together. Subtitle drafts for an unreleased series sit in the first, and that bucket was made public for a trailer review that ended months ago…
object storagepublic accessencryption at restobject versioning
Make spot checkpoints survive a reclaim
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
A batch render fleet runs on reclaimable capacity because the work is interruptible and the price is a fraction of a reserved instance…
spot capacitycheckpointobject versioningleast privilege
Prepare a parcel locker network for its busiest week
ProChallenge · In-depth · 34 min · Cloud panel with the matching CLI line
A parcel locker network carries its busiest week of the year in three days, and the readiness check left four items open…
public container accessencryption at restobject versioningsecurity group rules
Get a camera trap estate ready for a funder review
ProCapstone · In-depth · 35 min · Cloud panel with the matching CLI line
A wildlife trust runs camera traps across four reserves and uploads footage from the field over whatever mobile signal the rangers can find. A funder reviews the grant in ten days…
public container accessencryption at restobject versioningsecurity group rules
Where to go next
Every certification with labsSAA-C03 lab questions
There are 25 labs: 7 guided, 13 assisted, 4 challenge, 1 capstone. Together they carry about 5 hours of authored lab time, and none of them is a free taster yet.
Practise SAA-C03 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.