AWS Services for SAP-C02 Exam Guide (2026)
The AWS Certified Solutions Architect – Professional exam tests your ability to design complex, enterprise-grade architectures—not your memory for service features. Passing SAP‑C02 requires you to understand which AWS services to choose for a given business and technical context, how to combine them into resilient, secure, and cost‑optimized systems, and why you made those choices over alternatives.
This page focuses on the AWS services that appear most often in the exam’s scenario‑based questions. It organizes them into architecture categories, explains the trade‑offs an architect must evaluate, and shows how these services work together to form complete enterprise solutions. Use it as a strategic reference throughout your SAP‑C02 preparation, not as an encyclopedia of every AWS offering.
CloudCertPro builds deep architecture thinking. For detailed service‑by‑service technical reference, visit CloudComputingDevPro, which provides implementation guides, limits, and best practices.
Core AWS Service Categories
Rather than a flat list, SAP‑C02 tests services within these architecture domains. The table below gives a high‑level map.
| Category | Representative Services | Why It Matters in SAP‑C02 |
|---|---|---|
| Compute | EC2, Auto Scaling, Lambda, ECS/EKS, Fargate | Choose the right compute model for workload elasticity, startup latency, and cost profile. |
| Storage | S3, EBS, EFS, FSx, AWS Backup | Match storage performance, durability, and access patterns to application needs. |
| Networking | VPC, Transit Gateway, Route 53, Direct Connect, CloudFront, Global Accelerator | Design secure, high‑throughput, globally distributed network topologies. |
| Database | RDS, Aurora, DynamoDB, ElastiCache, Redshift | Select relational vs. NoSQL, provisioned vs. serverless, and caching strategies. |
| Security & Identity | IAM, IAM Identity Center, KMS, Secrets Manager, WAF, Shield, GuardDuty | Build defense in depth, enforce least privilege, protect data and edges. |
| Containers | ECS, EKS, ECR, App Runner | Architect microservices and hybrid container workloads with proper orchestration. |
| Serverless | Lambda, API Gateway, Step Functions, EventBridge, SQS, SNS | Create event‑driven architectures that scale to zero and reduce operational overhead. |
| Integration & Messaging | SQS, SNS, EventBridge, Step Functions, Amazon MQ | Decouple components, implement async processing, and integrate with existing systems. |
| Analytics | Kinesis, Glue, Athena, EMR, Redshift, QuickSight | Ingest, process, and visualize data at scale; build data lakes and real‑time pipelines. |
| Observability & Operations | CloudWatch, CloudTrail, Config, Systems Manager, Trusted Advisor | Monitor, log, automate, and comply; essential for Domain 3 (continuous improvement). |
| Migration & Modernization | MGN, DMS, Migration Hub, DataSync, Storage Gateway, Snow Family | Plan and execute workload migrations; assess, move, and modernize. |
| Management & Governance | Organizations, Control Tower, SCPs, Budgets, Cost Explorer | Establish multi‑account governance, cost controls, and compliance guardrails. |
| Cost Management | Cost Explorer, Budgets, Compute Optimizer, Savings Plans, Reserved Instances | Continuously optimize spend without sacrificing performance or resilience. |
Compute Services
Compute decisions directly affect scalability, cost, and operational burden.
- Amazon EC2 provides maximum control. Use Reserved Instances or Savings Plans for steady‑state workloads. Spot Instances are ideal for fault‑tolerant, interruptible jobs like batch processing and CI/CD.
- Auto Scaling automatically adjusts EC2 capacity. Combine with Elastic Load Balancing to distribute traffic. Choose dynamic scaling (target tracking, step) over simple policies for finer control.
- Elastic Load Balancing (ALB, NLB, GWLB) routes requests to healthy targets. ALB for HTTP/HTTPS, NLB for extreme throughput and low latency, GWLB for virtual appliances. Cross‑zone load balancing minimizes imbalance.
- AWS Lambda runs code without provisioning servers. Ideal for event‑driven, variable workloads. Mind the 15‑minute timeout; use Step Functions for longer orchestrations.
- Amazon ECS and EKS manage containers. ECS is deeply integrated with AWS services; EKS provides Kubernetes conformity. Fargate eliminates instance management; EC2 launch type gives you control over networking and instance selection.
Architecture decision pattern: For a stateless web API that experiences unpredictable spikes, Lambda + API Gateway may be more cost‑effective than EC2 Auto Scaling. For a legacy application requiring full OS access and consistent high throughput, EC2 with Reserved Instances is appropriate.
Storage Services
Choose storage based on data access patterns, performance, and durability requirements.
- Amazon S3 is the default for object storage. Use lifecycle policies to transition data to cheaper tiers (S3 Standard‑IA, Glacier, Deep Archive). S3 Intelligent‑Tiering automatically optimizes for unknown patterns. S3 Versioning and Object Lock protect against accidental deletion and ransomware.
- Amazon EBS provides block storage for EC2 instances. gp3 volumes offer a good balance of price and performance. Provisioned IOPS (io2) for databases requiring high, consistent IOPS. Snapshot backups are incremental and stored in S3.
- Amazon EFS is a scalable file system that can be mounted across multiple EC2 instances. Use EFS Lifecycle Management to move infrequently accessed files to IA storage class. EFS One Zone reduces cost for dev/test workloads that don’t need regional resilience.
- Amazon FSx offers managed Windows File Server or Lustre. FSx for Lustre is designed for high‑performance computing and analytics; FSx for Windows integrates with Active Directory.
- AWS Backup centralizes backup policies across S3, EBS, RDS, DynamoDB, and more. Enable cross‑region backups for disaster recovery.
Architecture decision pattern: For shared application data accessed by hundreds of EC2 instances, EFS is a natural fit. For static web assets, S3 + CloudFront are optimal. For a single‑instance database, EBS with Provisioned IOPS and regular snapshots is typical.
Database Services
Database selection hinges on data model, consistency needs, query patterns, and scaling requirements.
- Amazon RDS (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server) provides managed relational databases. Use Multi‑AZ for high availability; Read Replicas for read scaling. Reserved Instances lower long‑term costs.
- Amazon Aurora is MySQL‑ and PostgreSQL‑compatible with better performance and automatic multi‑AZ replication. Aurora Serverless v2 scales dynamically; Aurora Global Database enables cross‑region reads and disaster recovery.
- Amazon DynamoDB is a fully managed NoSQL key‑value and document database with single‑digit‑millisecond latency. Use on‑demand capacity for unpredictable workloads, provisioned capacity for steady state, and DynamoDB Accelerator (DAX) for microsecond latency.
- Amazon ElastiCache (Redis, Memcached) caches frequently accessed data to offload databases. Redis also supports pub/sub, geospatial, and session store use cases.
- Amazon Redshift is a petabyte‑scale data warehouse. Use sort and distribution keys for query performance; Redshift Spectrum queries data directly in S3.
Architecture decision pattern: A social media app that requires low‑latency user profile lookups might use DynamoDB with DAX. A financial reporting system that needs complex joins and ACID transactions will use Aurora or RDS.
Networking Services
Enterprise networking is a cornerstone of SAP‑C02. You must design secure, scalable, and highly available networks across accounts and on‑premises.
- Amazon VPC defines your private network. Use public and private subnets, security groups, NACLs, and VPC Flow Logs. VPC Peering connects two VPCs; Transit Gateway is the hub for connecting hundreds of VPCs and on‑premises networks.
- Transit Gateway simplifies hybrid and multi‑account networking. It supports routing, VPN attachments, Direct Connect attachments, and inter‑region peering.
- Route 53 provides DNS with latency‑based, geolocation, and failover routing. Use alias records for AWS endpoints; health checks for automated failover.
- Direct Connect offers dedicated, private connectivity to AWS. Use it for consistent network performance or large data transfers. Combine with VPN as a backup.
- CloudFront is a CDN that caches content at edge locations. Pair with S3, ALB, or API Gateway. Use Origin Access Control for S3 to restrict direct access.
- Global Accelerator routes traffic over the AWS global backbone, improving latency and providing static anycast IP addresses.
Architecture decision pattern: A multi‑account enterprise with hundreds of VPCs and on‑premises data centers would use Transit Gateway with route tables, inter‑region peering, and Direct Connect for consistent hybrid connectivity.
Security & Identity Services
Security is woven into every domain. SAP‑C02 demands that you apply defense in depth and least privilege across all services.
- IAM controls access through users, roles, and policies. Prefer roles over long‑term access keys. Use permission boundaries and SCPs for guardrails.
- IAM Identity Center (formerly AWS SSO) federates workforce identities. Integrate with on‑premises AD or external IdPs for centralized access management.
- AWS KMS manages encryption keys. Use customer managed keys for fine‑grained control and key rotation. KMS integrates with most AWS services for server‑side encryption.
- Secrets Manager securely stores and rotates database credentials, API keys, and other secrets. Avoid hard‑coding credentials.
- WAF and Shield protect web applications from common exploits and DDoS attacks. Attach WAF to CloudFront, ALB, or API Gateway. Shield Advanced adds cost protection and 24/7 support.
- GuardDuty analyzes VPC flow logs, CloudTrail, and DNS logs for threats. Security Hub consolidates findings and checks compliance against standards.
Architecture decision pattern: For a multi‑account setup, use IAM roles for cross‑account access, SCPs to deny risky actions, and GuardDuty plus Security Hub in a delegated administrator account for centralized threat detection.
Integration & Messaging Services
Decoupling components and building asynchronous workflows is key for resilience and scalability.
- Amazon SQS provides fully managed message queues. Standard queues offer high throughput and at‑least‑once delivery; FIFO queues guarantee exactly‑once ordering. Use dead‑letter queues to handle failures.
- Amazon SNS is a pub/sub notification service. Send messages to many subscribers (email, SMS, Lambda, SQS, HTTP endpoints). Often combined with SQS for fan‑out patterns.
- Amazon EventBridge is a serverless event bus. It ingests events from AWS services, custom applications, and SaaS providers, then routes to targets based on rules. Ideal for event‑driven architectures and cross‑account communication.
- AWS Step Functions orchestrates workflows with visual state machines. Use for long‑running processes, error handling, and human approval steps. Built‑in integration with Lambda, ECS, and hundreds of AWS services.
- Amazon MQ provides managed message brokers for Apache ActiveMQ and RabbitMQ. Use when migrating existing applications that rely on those protocols.
Architecture decision pattern: An order processing system might use EventBridge to capture “Order Placed” events, trigger a Step Functions workflow that orchestrates payment (Lambda), inventory update (DynamoDB), and fulfillment notification (SNS to SQS for worker instances).
Observability & Operations
Continuous improvement (Domain 3) depends on deep operational visibility.
- CloudWatch collects metrics, logs, and events. Set alarms for abnormal behavior; use CloudWatch Logs Insights for ad‑hoc queries. CloudWatch Container Insights and Lambda Insights provide application‑level monitoring.
- CloudTrail records API activity across your accounts. Enable organization‑wide trails, log file integrity, and deliver to a central S3 bucket. Critical for governance and security auditing.
- AWS Config evaluates resource configurations against rules. Automatically remediate non‑compliant resources with Systems Manager Automation. Use Config aggregator for multi‑account visibility.
- Systems Manager provides operational tools: Session Manager for secure shell access without public IPs, Patch Manager for OS updates, Automation for runbooks, and Parameter Store for configuration data.
- Trusted Advisor scans for best practice violations: idle resources, security gaps, underutilized instances. Act on its recommendations to improve cost, performance, and security.
Migration & Modernization Services
Domain 4 explicitly tests migration and modernization. Know the tools and the 7 Rs (rehost, replatform, repurchase, refactor, retire, retain, relocate).
- AWS Application Migration Service (MGN) performs lift‑and‑shift migrations of servers to EC2. It continuously replicates source servers and minimizes cutover downtime.
- Database Migration Service (DMS) migrates databases with minimal downtime. Schema Conversion Tool (SCT) helps convert schema for heterogeneous migrations (e.g., Oracle to Aurora).
- Migration Hub tracks migration projects and provides a dashboard of progress.
- DataSync moves large amounts of data between on‑premises storage and AWS (S3, EFS, FSx). It preserves metadata and handles scheduling and validation.
- Storage Gateway provides on‑premises access to virtually unlimited cloud storage: File Gateway (NFS/SMB to S3), Volume Gateway (iSCSI to EBS snapshots), Tape Gateway (virtual tape library to S3 Glacier).
- Snow Family (Snowcone, Snowball, Snowmobile) physically ships data to AWS when network transfer is impractical.
Architecture decision pattern: A large on‑premises data center migration would start with Migration Hub for assessment, use MGN for application servers and DMS for databases, and DataSync for file data. Post‑migration, run Trusted Advisor and Compute Optimizer to right‑size resources.
High-Frequency SAP-C02 Services
Some services appear repeatedly in exam scenarios. Prioritize these in your study.
| AWS Service | Exam Importance | Architecture Frequency | Recommended Study Priority |
|---|---|---|---|
| Amazon VPC | Very High | Every multi‑tier architecture | Top |
| AWS IAM | Very High | Every design (roles, policies, federation) | Top |
| Amazon EC2 & Auto Scaling | Very High | Core compute layer | Top |
| Amazon S3 | Very High | Storage backbone | Top |
| Amazon RDS / Aurora | Very High | Relational workloads, failover scenarios | Top |
| AWS Organizations & SCPs | High | Multi‑account governance | High |
| Amazon Route 53 | High | DNS and failover | High |
| AWS Lambda | High | Serverless architectures | High |
| Amazon DynamoDB | High | NoSQL workloads | High |
| Amazon CloudFront | High | Content delivery, WAF integration | High |
| Transit Gateway | High | Enterprise networking | High |
| AWS Key Management Service | High | Encryption everywhere | High |
| Amazon EventBridge | Medium | Event‑driven architectures | Medium |
| AWS Step Functions | Medium | Orchestration, error handling | Medium |
| AWS Direct Connect | Medium | Hybrid connectivity | Medium |
| AWS Migration Hub / DMS | Medium | Migration scenarios | Medium |
| Amazon ElastiCache | Medium | Caching, real‑time workloads | Medium |
Service Relationships
Enterprise architectures combine services across categories. Understanding these relationships is more valuable than knowing individual service details. Below are several common architecture stacks.
Web application: CloudFront + WAF + ALB + Auto Scaling across AZs + RDS Multi‑AZ + S3 for static assets + ElastiCache for session state.
Event‑driven system: EventBridge + Lambda + SQS + DynamoDB + Step Functions for orchestrating long‑running workflows.
Data analytics platform: Kinesis Data Firehose → S3 → Glue → Athena/EMR → QuickSight. Redshift for aggregated reporting.
Hybrid cloud: Direct Connect + Transit Gateway + VPN backup + Route 53 Resolver + AWS Directory Service.
Multi‑account enterprise: Organizations + Control Tower + SCPs + IAM Identity Center + CloudTrail Organization trail + Config aggregator + RAM for shared resources.
Recommended Learning Order
Build your service knowledge in a way that makes architecture patterns easier to grasp.
- Networking – VPC, Transit Gateway, Route 53. Everything else connects to the network; understand it first.
- Compute – EC2, Auto Scaling, Lambda, containers. Learn how to place and scale workloads within your network design.
- Storage – S3, EBS, EFS. Where data lives and how it’s backed up.
- Database – RDS, Aurora, DynamoDB, ElastiCache. Persistent state and performance optimization.
- Security & Identity – IAM, KMS, Organizations, WAF. Secure what you have built.
- Containers & Serverless – ECS/EKS, Lambda, EventBridge, Step Functions. Modern application patterns.
- Integration & Messaging – SQS, SNS, EventBridge. Decouple and make systems resilient.
- Observability & Operations – CloudWatch, CloudTrail, Config. Instrument and improve.
- Migration & Modernization – MGN, DMS, DataSync. Move existing workloads into your enterprise foundation.
- Management & Governance / Cost – Control Tower, Budgets, Compute Optimizer. Tie everything together at the enterprise level.
This order aligns with the natural dependency chain: you need a network before you place compute; you need compute before you attach storage and databases; you add security at every layer; you then evolve to serverless and event‑driven patterns; finally you instrument, govern, and optimize.
Continue Learning
Turn service knowledge into architecture competence with these CloudCertPro resources:
- SAP-C02 Certification Guide – Complete exam overview and learning framework.
- SAP-C02 Domains – Study the official exam objectives and how they connect.
- SAP-C02 Architectures – Enterprise architecture patterns and design decisions.
- SAP-C02 Scenarios – Practice real‑world case studies that integrate multiple services.
- SAP-C02 Resources – Study plans, checklists, and official AWS references.
For in‑depth technical guides on AWS services, architecture patterns, and implementation best practices, visit CloudComputingDevPro.
Key Takeaways
- SAP‑C02 evaluates your ability to choose and combine AWS services, not to recall individual feature lists.
- Focus your study on the high‑frequency services listed above, and understand their role in larger architecture patterns.
- Prioritize service relationships over memorization. Exam scenarios will describe business requirements; you must map those to the right set of integrated services.
- Follow the recommended learning order to build a mental model of how services depend on each other.
- Use CloudCertPro’s domain‑based path and scenario exercises to practice making the architecture decisions the exam demands.
Mastering the AWS service landscape for SAP‑C02 is less about knowing every service and more about knowing which service fits, why it fits, and how it connects to the rest of the enterprise. This guide gives you the map; the scenarios and labs will build the skill.