AWS Serverless Applications Exam Cram – SAA-C03 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

This study guide reviews the AWS serverless services and integration patterns commonly tested in the AWS Certified Solutions Architect – Associate exam. The focus is on selecting the right service for compute, messaging, orchestration, event routing, streaming, and API delivery.

Key Concepts

Serverless Architecture

Serverless services remove the need to manage servers, operating systems, patching, and most capacity provisioning. AWS generally provides automatic scaling and high availability, while billing is based on actual usage for many services.

Serverless does not mean that applications have no operational concerns. Architects still need to design for permissions, retries, idempotency, throttling, timeouts, observability, failure handling, and service quotas.

AWS Lambda

AWS Lambda runs application code as functions in response to events.

Important characteristics:

Lambda functions scale automatically based on demand, subject to account and function concurrency quotas.
Billing is based primarily on requests and execution duration. No compute charge applies while a function is not running, although related services and configuration can still incur charges.
CPU power increases with the memory allocated to the function. Memory should therefore be selected based on both performance and cost requirements.
The maximum function timeout is 15 minutes, or 900 seconds. The default timeout is 3 seconds.
Lambda is suitable for event processing, file processing, stream processing, automation, and serverless application backends.
Lambda is not appropriate for long-running workloads that exceed the timeout or for applications requiring full control over the underlying operating system.

#### Lambda Invocation Models

Invocation model	Typical sources	Result handling	Important design concern
Synchronous	API Gateway, SDK, CLI	The caller waits for the function response	The client is responsible for handling errors and implementing retries or backoff
Asynchronous	Amazon S3, Amazon SNS, EventBridge or other event services	Lambda queues the event and invokes the function later	Failures can cause retries; processing must be idempotent
Event source mapping	Amazon SQS, Kinesis Data Streams, DynamoDB Streams	Lambda polls the source and invokes the function with batches of records	Configure batching, concurrency, visibility or checkpoint behavior, and failure handling

For stream-based and queue-based integrations using event source mappings, Lambda performs the polling. This differs from services that directly push an event to Lambda.

Ordering depends on the source. Kinesis and DynamoDB Streams preserve ordering within a shard or partition, while SQS Standard does not guarantee ordering. SQS FIFO provides ordered processing within a message group.

Amazon SQS

Amazon Simple Queue Service is a managed message queue used to decouple producers and consumers and to implement store-and-forward patterns.

Key characteristics:

Consumers pull messages from the queue.
A message remains available until it is successfully deleted or otherwise expires.
SQS Standard queues provide very high and effectively unlimited throughput, but delivery is at least once and ordering is best effort.
SQS FIFO queues preserve order within each message group and support deduplication.
FIFO messages require a MessageGroupId; deduplication can use a MessageDeduplicationId or content-based deduplication.
Batch operations can process up to 10 messages per API operation.
A dead-letter queue stores messages that repeatedly fail processing so they can be isolated, inspected, and remediated.

SQS FIFO should be selected when strict ordering and deduplication are more important than the highest possible throughput. Even with FIFO, consumers and downstream systems should be designed carefully around idempotency.

#### Long Polling and Short Polling

Short polling returns immediately, including when no message is available. Long polling waits for messages to arrive for a configured period, reducing empty responses and unnecessary API calls.

Long polling can be enabled through queue configuration or the ReceiveMessage API using WaitTimeSeconds. Values greater than zero and up to 20 seconds enable long polling.

Amazon SNS

Amazon Simple Notification Service is a managed publisher/subscriber messaging service. Publishers send messages to an SNS topic, and SNS pushes copies to subscribed endpoints.

Supported subscribers include:

SQS queues
Lambda functions
HTTP or HTTPS endpoints
Mobile push endpoints
Email and SMS endpoints

SNS is appropriate for one-to-many and fan-out communication. A single topic can distribute a message to multiple endpoint types without requiring the publisher to know the details of each consumer.

#### SNS and SQS Fan-Out

Subscribing multiple SQS queues to an SNS topic creates independent consumer paths. SNS delivers a copy of each published message to every subscribed queue, while each queue provides buffering, independent consumption, retry behavior, and failure isolation for its application.

This pattern is preferable to having one queue shared by unrelated consumers when every consumer must receive every message.

Amazon Kinesis Data Streams

Kinesis is designed for collecting, processing, and analyzing streaming data. Consumers pull records from the stream, and multiple consumers can process the same stream independently.

Important distinctions from SQS and SNS:

Ordering is maintained at the shard level.
Throughput is based on provisioned shards or the selected stream capacity mode.
Architects must account for shard capacity, scaling, monitoring, and consumer processing limits.
Records remain available for a retention period rather than being deleted immediately after one consumer processes them.

Kinesis is a better fit than SQS when multiple consumers need to independently replay or process an ordered stream of records.

AWS Step Functions

AWS Step Functions orchestrates distributed application workflows using state machines. A state machine can define:

Sequential tasks
Parallel execution
Conditional branching
Timers and wait states
Error handling and retries
Service integrations

Step Functions is useful when a process contains multiple steps whose order, state, retries, and failure behavior must be explicit. It is generally preferable to embedding complex orchestration logic inside one large Lambda function.

Amazon EventBridge

Amazon EventBridge is a serverless event bus for event-driven applications. Events can originate from:

AWS services
Custom applications
SaaS applications

Rules match event patterns and route matching events to targets such as Lambda, SNS, SQS, API Gateway, and API destinations using HTTP endpoints.

EventBridge is suited to loosely coupled event routing and filtering. It allows producers to publish events without requiring direct knowledge of the consumers.

Amazon API Gateway

Amazon API Gateway is a managed service for publishing, securing, monitoring, and managing APIs. API Gateway APIs expose HTTPS endpoints and can integrate with Lambda, AWS services, or other backend applications.

Endpoint types:

Endpoint type	Appropriate use
Edge-optimized	Clients are distributed globally and the API should use an edge network for access
Regional	Clients are primarily located within a specific AWS Region or the API is accessed through another regional architecture
Private	The API must be accessible only from a VPC or connected private network, typically through an interface VPC endpoint

API Gateway features relevant to architecture questions include:

Response caching to reduce backend requests and improve latency
Throttling to control steady-state and burst request rates
Authentication and authorization integrations
Monitoring and API lifecycle management

The commonly referenced account-level default steady-state limit is 10,000 requests per second, with a burst limit commonly represented as 5,000 concurrent requests across APIs. Limits can vary by API type, Region, and account configuration, so exam questions may expect the architectural principle rather than reliance on an exact quota. Exceeding a throttle limit results in HTTP 429 Too Many Requests; clients should retry using controlled backoff rather than immediately overwhelming the API again.

Architecture Decision Guide

Requirement	Recommended service or pattern	Why
Run short-lived code in response to events	Lambda	No server management and automatic scaling
Decouple a producer from a consumer	SQS	Durable buffering and independent processing rates
Broadcast an event to many subscribers	SNS	Push-based one-to-many fan-out
Fan out events with independent consumer buffering	SNS plus multiple SQS queues	Each consumer receives a copy and processes at its own pace
Process an ordered, replayable stream	Kinesis Data Streams	Shard-level ordering and multiple independent consumers
Coordinate retries, branching, parallel tasks, and waits	Step Functions	Explicit managed workflow state machine
Route filtered events from AWS, SaaS, or custom sources	EventBridge	Event bus and rule-based target routing
Expose a managed HTTPS API	API Gateway	API publishing, security, throttling, and caching
Preserve strict message order	SQS FIFO or a single Kinesis shard/partition strategy	Ordering guarantees depend on the selected service and grouping model
Isolate repeatedly failing messages	SQS dead-letter queue	Prevents poison messages from blocking normal processing

Exam-Relevant Takeaways

Lambda execution time is limited to 900 seconds; it is not a general-purpose replacement for long-running EC2 or container workloads.
Increasing Lambda memory also increases allocated CPU, so memory tuning affects both performance and cost.
Synchronous Lambda errors are handled by the caller. Asynchronous and event-source integrations have service-managed retry behavior.
Lambda event source mappings poll SQS, Kinesis Data Streams, and DynamoDB Streams.
Design Lambda consumers to be idempotent because duplicate processing can occur.
SQS Standard favors throughput and availability; it does not guarantee order and uses at-least-once delivery.
SQS FIFO provides ordered processing within message groups and deduplication features, but has throughput and configuration constraints.
A dead-letter queue is a configuration associated with a source queue, not a separate SQS queue type.
Long polling reduces empty receives and can lower SQS API costs.
SNS pushes messages; SQS and Kinesis consumers pull messages.
SNS plus SQS is the standard fan-out pattern when multiple consumers need durable, independent copies.
Kinesis capacity and ordering are organized around shards or partitions, so throughput planning is required.
Step Functions is for workflow orchestration, not merely sending notifications or routing events.
EventBridge is an event bus; SNS is primarily a pub/sub notification and fan-out service.
API Gateway endpoint type should match the client geography and network access requirements.
API Gateway throttling protects backends but requires clients to implement backoff and retry behavior.

Common Exam Traps

Confusing push and pull: SNS pushes to subscribers. SQS and Kinesis require consumers to pull records.
Assuming SQS Standard preserves order: Standard queues provide best-effort ordering only.
Treating FIFO as unlimited throughput: FIFO provides stronger ordering and deduplication semantics but is subject to FIFO throughput limits and message-group behavior.
Using one SQS queue for broadcast: Competing consumers on one queue divide messages. Use SNS with one queue per independent consumer when every consumer must receive every message.
Assuming Lambda retries are client-controlled in every case: Synchronous callers manage retries, while asynchronous and event-source integrations have AWS-managed retry and failure behavior.
Ignoring duplicate delivery: At-least-once delivery means Lambda handlers and downstream writes should tolerate retries.
Using Lambda for a long-running process: The 15-minute maximum makes Lambda unsuitable for workloads that exceed the function timeout.
Confusing a dead-letter queue with a queue mode: A DLQ is a failure-handling configuration, not Standard versus FIFO queue behavior.
Choosing Kinesis when elastic queue buffering is needed: Kinesis requires stream capacity planning and is intended for retained streams, replay, ordering, and multiple consumers.
Selecting an edge-optimized API for private access: Private APIs are the relevant choice for VPC-only access; edge optimization is for global public access.
Assuming API Gateway accepts unlimited traffic: Throttling and quotas apply. A 429 response requires controlled client retries.
Putting orchestration logic into a single Lambda: Use Step Functions when the process has multiple durable steps, branching, waits, or explicit retry requirements.

Real-World Engineer Notes

Make event handlers idempotent using event IDs, conditional writes, deduplication records, or naturally idempotent operations.
Configure SQS visibility timeout long enough for normal processing, while ensuring failed messages become visible again rather than remaining hidden indefinitely.
Use DLQs and operational alarms for messages that exceed the permitted receive count. A DLQ without monitoring simply hides failures.
For SNS-to-SQS fan-out, grant the SNS topic permission to send to each queue and restrict the queue policy to the expected source topic.
Batch processing improves efficiency but increases the impact of a failed batch. Choose batch size and failure handling based on latency and retry requirements.
Kinesis designs should monitor iterator age, incoming and outgoing records, shard utilization, and consumer lag.
Step Functions makes state transitions and retries visible, which improves troubleshooting for multi-step business processes.
API Gateway caching is useful for repeatable, cacheable responses, but it should not be used for data requiring immediate consistency unless the cache behavior is carefully controlled.
Use exponential backoff with jitter for throttled API clients to avoid synchronized retry storms.

Quick Reference Summary

Lambda: Event-driven, short-lived serverless compute.
SQS: Pull-based durable queue and application decoupling.
SQS Standard: Highest throughput, best-effort order, at-least-once delivery.
SQS FIFO: Ordered message groups and deduplication.
SNS: Push-based pub/sub and fan-out.
Kinesis Data Streams: Retained, ordered-by-shard streaming data with multiple consumers.
Step Functions: Workflow orchestration using state machines.
EventBridge: Rule-based event bus for AWS, SaaS, and custom events.
API Gateway: Managed HTTPS API front door with caching and throttling.
Long polling: Waits for messages and reduces empty SQS receives.
DLQ: Isolates repeatedly failed messages.
Core reliability rule: Assume retries and duplicates; make processing idempotent.

Flashcards

What is the maximum AWS Lambda function timeout? 15 minutes, or 900 seconds.
How does Lambda memory affect CPU allocation? Lambda allocates CPU proportionally to the configured memory.
Which Lambda invocation model returns the result directly to the caller? Synchronous invocation.
Which services commonly use Lambda event source mappings? Amazon SQS, Kinesis Data Streams, and DynamoDB Streams.
Which SQS queue type provides best-effort ordering and the highest general throughput? SQS Standard.
What identifiers are important for SQS FIFO messages? MessageGroupId for ordering groups and MessageDeduplicationId for deduplication, unless content-based deduplication is used.
What is the purpose of an SQS dead-letter queue? To isolate messages that repeatedly fail processing.
How does long polling differ from short polling? Long polling waits for messages for a configured period; short polling returns immediately.
Which service pushes messages to subscribers? SNS.
Which pattern provides independent copies and buffering for multiple consumers? SNS publishing to multiple SQS queues.
Where does Kinesis preserve ordering? Within a shard or partition, depending on the stream model.
Which service models sequential, parallel, branching, and timed workflows? AWS Step Functions.
What is the primary role of EventBridge? Routing filtered events from AWS, SaaS, and custom sources to targets.
Which API Gateway endpoint type supports VPC-only API access? Private.
What should a client do after receiving API Gateway HTTP 429? Retry with controlled exponential backoff and avoid exceeding the throttling limits.

Practice Questions

Question 1

A company receives customer events from an application. Three independent processing systems must each receive every event, process at their own rate, and avoid losing events when one system is temporarily unavailable. Which architecture is most appropriate?

A. Send all events directly to one SQS Standard queue with three consumers.

B. Publish events to an SNS topic and subscribe one SQS queue for each processing system.

C. Invoke three Lambda functions synchronously from the producer.

D. Write events to an SQS FIFO queue and have three competing consumers.

Correct answer: B

Explanation: SNS provides fan-out, while separate SQS queues provide an independent durable copy and processing rate for each consumer. Multiple consumers on one queue compete for messages rather than each receiving every message.

Question 2

A Lambda function processes messages from an SQS Standard queue. Occasionally, the same business event is processed twice, resulting in duplicate database records. What is the best design improvement?

A. Replace SQS with SNS.

B. Make the Lambda handler idempotent using a unique event identifier and conditional database write.

C. Reduce the Lambda timeout to prevent retries.

D. Disable Lambda event source polling.

Correct answer: B

Explanation: SQS Standard provides at-least-once delivery, so duplicate processing is possible. Idempotency prevents retries or duplicate deliveries from causing duplicate side effects.

Question 3

A financial application must process transactions in strict order for each account, while allowing transactions for different accounts to be processed independently. Which SQS design is most appropriate?

A. SQS Standard with no message attributes.

B. SQS FIFO with the account identifier as MessageGroupId.

C. SNS with email subscriptions.

D. Kinesis with random partition keys.

Correct answer: B

Explanation: SQS FIFO preserves order within a message group. Using the account identifier as the group ID preserves per-account order while allowing different account groups to proceed independently.

Question 4

A company exposes a public API to users worldwide. It needs managed HTTPS access, response caching, and protection against sudden request spikes overwhelming the backend. Which service should be used?

A. API Gateway with an edge-optimized endpoint, caching, and throttling.

B. SQS FIFO with long polling.

C. EventBridge with a private API destination.

D. Kinesis with additional shards.

Correct answer: A

Explanation: API Gateway provides managed HTTPS APIs, edge-optimized endpoints for global clients, response caching, and throttling to protect the backend.

Question 5

A workflow must call several services, retry failed tasks, wait for an external approval, and execute two independent tasks in parallel before continuing. Which AWS service best fits this requirement?

A. Amazon SNS.

B. Amazon SQS Standard.

C. AWS Step Functions.

D. Amazon API Gateway.

Correct answer: C

Explanation: Step Functions defines workflows as state machines and supports task sequencing, retries, waits, branching, and parallel execution. SNS and SQS provide messaging, while API Gateway provides API management rather than durable workflow orchestration.