--- title: "Solutions Architect Beginner to Expert" description: "A comprehensive roadmap to master Solutions Architecture from cloud fundamentals to advanced AWS design patterns, security, compliance, and scalable distributed systems." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/roadmaps/post/solutions-architect-roadmap --- # Solutions Architect Beginner to Expert This roadmap guides you from cloud fundamentals through to professional-level AWS solutions architecture. Each stage builds on the last master the foundations before tackling advanced networking, security, and architectural patterns. Use the AWS Well-Architected Framework as your guiding compass throughout, and complement your learning with hands-on labs and real-world design exercises. ## Roadmap ### Stage 1: Cloud Computing Fundamentals Understand the core concepts and service models that underpin every cloud platform. #### Cloud Service Models IaaS, PaaS, and SaaS what each model provides and who manages what. - [AWS: What is Cloud Computing?](https://aws.amazon.com/what-is-cloud-computing/) #### Cloud Deployment Models Public, private, hybrid, and multi-cloud deployment strategies. #### CapEx vs OpEx Understand the financial model shift from capital expenditure to operational expenditure. #### Economies of Scale How cloud providers pass cost savings to customers through massive infrastructure scale. ### Stage 2: AWS Global Infrastructure Understand how AWS distributes its infrastructure globally for performance and resilience. #### Regions & Availability Zones How AWS Regions are composed of isolated AZs and why this matters for HA design. - [AWS Global Infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/) #### Edge Locations & CloudFront PoPs How AWS delivers low-latency content globally via its edge network. #### AWS Local Zones & Wavelength _(recommended)_ Extend AWS infrastructure to metro areas and telecom networks for ultra-low latency. #### Choosing a Region Criteria for region selection: latency, compliance, service availability, and cost. ### Stage 3: AWS Identity & Access Management (IAM) Control who can access what in your AWS environment with fine-grained policies. #### IAM Core Concepts Users, groups, roles, and policies the four building blocks of AWS IAM. - [AWS IAM Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) #### Principle of Least Privilege Grant only the permissions required nothing more. Apply to every identity. #### IAM Roles & Assume Role Cross-account access, EC2 instance profiles, and service-to-service permissions. #### IAM Policies Identity-based, resource-based, permission boundaries, SCPs, and session policies. #### AWS Organizations & SCPs _(recommended)_ Manage multiple accounts with AWS Organizations and restrict permissions with Service Control Policies. ### Stage 4: Compute EC2 & Auto Scaling Provision and automatically scale virtual machines on AWS. #### EC2 Instance Types & Families General purpose, compute-optimised, memory-optimised, storage-optimised, and accelerated computing. - [EC2 Instance Types](https://aws.amazon.com/ec2/instance-types/) #### AMIs & Launch Templates Create golden images with AMIs and standardise instance config with Launch Templates. #### Auto Scaling Groups Dynamic and predictive scaling policies, cooldown periods, and lifecycle hooks. #### EC2 Pricing Models On-Demand, Reserved Instances, Savings Plans, Spot, and Dedicated Hosts. #### Placement Groups _(recommended)_ Cluster, spread, and partition placement strategies for performance and fault tolerance. ### Stage 5: Compute Serverless & Containers Run workloads without managing servers using Lambda, ECS, and EKS. #### AWS Lambda Function lifecycle, triggers, concurrency, layers, and cold start optimisation. - [AWS Lambda Docs](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) #### Amazon ECS Task definitions, services, Fargate vs EC2 launch types, and cluster management. #### Amazon EKS _(recommended)_ Managed Kubernetes on AWS node groups, Fargate profiles, and add-ons. #### AWS Fargate Serverless container execution no cluster infrastructure to manage. ### Stage 6: Storage S3 & Object Storage Design durable, scalable object storage solutions with Amazon S3. #### S3 Core Concepts Buckets, objects, keys, versioning, and the S3 consistency model. - [Amazon S3 Docs](https://docs.aws.amazon.com/s3/index.html) #### S3 Storage Classes Standard, Intelligent-Tiering, Standard-IA, Glacier, and Glacier Deep Archive. #### S3 Lifecycle Policies Automatically transition objects between storage classes or expire them. #### S3 Security Bucket policies, ACLs, Block Public Access, pre-signed URLs, and SSE options. #### S3 Replication _(recommended)_ Cross-Region Replication (CRR) and Same-Region Replication (SRR) for DR and compliance. ### Stage 7: Storage Block, File & Hybrid Choose the right storage type for databases, shared file systems, and on-premises integration. #### Amazon EBS Volume types (gp3, io2, st1, sc1), snapshots, encryption, and multi-attach. - [Amazon EBS Docs](https://docs.aws.amazon.com/ebs/latest/userguide/what-is-ebs.html) #### Amazon EFS Fully managed NFS file system performance modes, throughput modes, and access points. #### AWS Storage Gateway _(recommended)_ Bridge on-premises environments to cloud storage with File, Volume, and Tape Gateway. #### AWS Snow Family _(recommended)_ Snowcone, Snowball Edge, and Snowmobile for offline data transfer at petabyte scale. ### Stage 8: Databases Relational Design managed relational database solutions on AWS for transactional workloads. #### Amazon RDS Supported engines, Multi-AZ deployments, read replicas, and automated backups. - [Amazon RDS Docs](https://docs.aws.amazon.com/rds/index.html) #### Amazon Aurora Aurora architecture, Aurora Serverless v2, global databases, and cluster endpoints. #### RDS Proxy _(recommended)_ Manage database connection pooling for Lambda and highly concurrent applications. #### Database Migration Service (DMS) _(recommended)_ Migrate databases to AWS with minimal downtime using DMS and SCT. ### Stage 9: Databases NoSQL & Caching Use purpose-built non-relational databases and in-memory caches for modern workloads. #### Amazon DynamoDB Partition keys, sort keys, GSIs, LSIs, DynamoDB Streams, and capacity modes. - [Amazon DynamoDB Docs](https://docs.aws.amazon.com/dynamodb/index.html) #### DynamoDB Design Patterns _(recommended)_ Single-table design, access pattern modelling, and avoiding hot partitions. #### Amazon ElastiCache Redis vs Memcached, caching strategies (lazy loading, write-through), and cluster modes. #### Amazon OpenSearch Service _(recommended)_ Full-text search, log analytics, and OpenSearch Serverless for unpredictable workloads. ### Stage 10: Networking VPC Fundamentals Design isolated, secure network environments in the cloud using Amazon VPC. #### VPC Core Components Subnets (public/private), route tables, internet gateways, and the default VPC. - [Amazon VPC Docs](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) #### NAT Gateways & Instances Enable outbound internet access for private subnets without exposing them inbound. #### Security Groups & NACLs Stateful security groups vs stateless Network ACLs layered network defence. #### VPC Flow Logs Capture and analyse IP traffic for security auditing and troubleshooting. #### CIDR Planning Design non-overlapping IP address ranges for future VPC peering and Transit Gateway. ### Stage 11: Networking Advanced Connectivity Connect VPCs, on-premises environments, and third-party networks securely. #### VPC Peering Direct routing between VPCs limitations, transitive routing, and use cases. - [VPC Peering Docs](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) #### AWS Transit Gateway Hub-and-spoke network topology for connecting many VPCs and on-premises networks. #### AWS Direct Connect Dedicated private connectivity from on-premises to AWS use cases and resilience. #### AWS Site-to-Site VPN IPSec VPN tunnels over the internet as a cost-effective hybrid connectivity option. #### AWS PrivateLink _(recommended)_ Expose services privately across VPCs and accounts without traversing the internet. ### Stage 12: Load Balancing & Traffic Management Distribute traffic across compute resources for availability, performance, and resilience. #### Application Load Balancer (ALB) Layer 7 routing, host/path-based rules, weighted target groups, and WAF integration. - [ALB Docs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) #### Network Load Balancer (NLB) Layer 4 ultra-low latency load balancing, static IPs, and TLS termination. #### Gateway Load Balancer (GWLB) _(recommended)_ Deploy, scale, and manage third-party virtual network appliances. #### Amazon Route 53 DNS routing policies: simple, weighted, latency, failover, geolocation, and multivalue. ### Stage 13: Content Delivery & Edge Deliver content globally with low latency using AWS edge services. #### Amazon CloudFront Distributions, origins, cache behaviours, TTL, signed URLs, and OAC. - [Amazon CloudFront Docs](https://docs.aws.amazon.com/cloudfront/latest/developerguide/Introduction.html) #### CloudFront Functions & Lambda@Edge _(recommended)_ Run lightweight logic at edge locations for request/response manipulation. #### AWS Global Accelerator _(recommended)_ Improve global application availability and performance using the AWS backbone network. ### Stage 14: Architecture Design Principles Apply foundational principles to design systems that are reliable, efficient, and maintainable. #### AWS Well-Architected Framework The six pillars: Operational Excellence, Security, Reliability, Performance, Cost, and Sustainability. - [AWS Well-Architected Docs](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html) #### Design for Failure Assume components will fail. Build redundancy, retries, and fallback paths into every design. #### Loose Coupling Reduce dependencies between components to allow independent scaling and failure isolation. #### Design for Scale Horizontal vs vertical scaling, stateless design, and avoiding single points of failure. ### Stage 15: High Availability & Disaster Recovery Architect systems that remain operational through failures and recover rapidly from disasters. #### RTO & RPO Define Recovery Time Objective and Recovery Point Objective to guide DR architecture. - [AWS Disaster Recovery](https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/introduction.html) #### DR Strategies Backup & Restore, Pilot Light, Warm Standby, and Multi-Site Active-Active patterns. #### Multi-AZ vs Multi-Region When to use AZ redundancy vs full region failover cost vs resilience trade-offs. #### AWS Backup Centralise and automate backups across EC2, RDS, DynamoDB, EFS, and more. ### Stage 16: Microservices & Decoupled Architecture Design systems composed of small, independently deployable services connected asynchronously. #### Microservices Principles Single responsibility, independent deployability, bounded contexts, and API contracts. - [AWS Microservices](https://aws.amazon.com/microservices/) #### Amazon SQS Standard vs FIFO queues, visibility timeout, DLQs, and long polling for async decoupling. #### Amazon SNS Pub/sub messaging, fan-out patterns, and SNS filtering for event-driven architectures. #### Amazon EventBridge Serverless event bus rules, event patterns, pipes, and cross-account event routing. ### Stage 17: Serverless Architecture Build and operate applications without provisioning or managing servers. #### Serverless Design Patterns Event-driven, fan-out, saga, and async request-response patterns with Lambda. - [Serverless Land](https://serverlessland.com/patterns) #### Amazon API Gateway REST, HTTP, and WebSocket APIs throttling, caching, auth, and usage plans. #### AWS Step Functions _(recommended)_ Orchestrate multi-step workflows with Standard and Express state machines. #### AWS SAM & Serverless Framework _(recommended)_ Infrastructure as code for serverless applications with local testing support. ### Stage 18: Security Data Protection Protect data at rest and in transit using AWS encryption and key management services. #### AWS KMS Customer-managed keys, key policies, grants, and envelope encryption. - [AWS KMS Docs](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html) #### Encryption at Rest Enable server-side encryption for S3, EBS, RDS, DynamoDB, and EFS with KMS. #### Encryption in Transit Enforce TLS for all service endpoints, use ACM for certificate management. #### AWS Secrets Manager Store, rotate, and retrieve database credentials and API keys without hardcoding. #### AWS Certificate Manager (ACM) Provision and manage TLS/SSL certificates for CloudFront, ALB, and API Gateway. ### Stage 19: Security Threat Detection & Response Detect threats, analyse findings, and automate responses across your AWS environment. #### Amazon GuardDuty Intelligent threat detection using ML identifies compromised instances, credential abuse, and more. - [Amazon GuardDuty Docs](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html) #### AWS Security Hub _(recommended)_ Aggregate and prioritise security findings from GuardDuty, Inspector, Macie, and partners. #### Amazon Macie _(recommended)_ Discover and protect sensitive data in S3 using ML-driven classification. #### AWS Inspector _(recommended)_ Automated vulnerability assessments for EC2, Lambda, and container images. ### Stage 20: Security Network Protection Protect your network perimeter and application layer from malicious traffic. #### AWS WAF Web ACLs, managed rule groups, rate limiting, and bot control for HTTP workloads. - [AWS WAF Docs](https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html) #### AWS Shield Shield Standard (free DDoS protection) vs Shield Advanced for layer 3/4/7 attacks. #### AWS Network Firewall _(recommended)_ Stateful, managed network firewall for VPC-level traffic inspection and filtering. #### AWS Firewall Manager _(recommended)_ Centrally manage WAF, Shield Advanced, and Network Firewall rules across accounts. ### Stage 21: Compliance & Governance Enforce standards, audit configurations, and meet regulatory compliance requirements on AWS. #### AWS Config Track resource configuration changes, evaluate rules, and trigger auto-remediation. - [AWS Config Docs](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html) #### AWS CloudTrail Audit API calls across your account who did what, when, and from where. #### AWS Audit Manager _(recommended)_ Continuously collect evidence for PCI DSS, HIPAA, SOC 2, and custom frameworks. #### AWS Control Tower _(recommended)_ Set up and govern a secure, multi-account AWS environment using landing zones. ### Stage 22: Observability & Monitoring Gain full visibility into the health and performance of your AWS workloads. #### Amazon CloudWatch Metrics, alarms, dashboards, Logs Insights, and Contributor Insights. - [Amazon CloudWatch Docs](https://docs.aws.amazon.com/cloudwatch/index.html) #### CloudWatch Logs & Log Groups Centralise logs from EC2, Lambda, ECS, and VPC Flow Logs with structured querying. #### AWS X-Ray _(recommended)_ Distributed tracing for Lambda, API Gateway, and ECS visualise service maps. #### Amazon Managed Grafana & Prometheus _(optional)_ Fully managed observability stack for Kubernetes and container workloads. ### Stage 23: Infrastructure as Code Define and provision AWS infrastructure in a declarative, repeatable, version-controlled way. #### AWS CloudFormation Stacks, templates (YAML/JSON), change sets, nested stacks, and drift detection. - [AWS CloudFormation Docs](https://docs.aws.amazon.com/cloudformation/index.html) #### AWS CDK _(recommended)_ Define infrastructure using TypeScript, Python, or Java with the AWS CDK. - [AWS CDK Docs](https://docs.aws.amazon.com/cdk/v2/guide/home.html) #### Terraform on AWS _(recommended)_ Manage AWS resources with the HashiCorp Terraform AWS provider and remote state in S3. #### IaC Best Practices Modularisation, stack separation by lifecycle, tagging strategies, and drift prevention. ### Stage 24: Cost Optimisation Architect solutions that deliver business value at the lowest sustainable cost. #### AWS Pricing Model Pay-as-you-go, pay less with more, and pay less as AWS grows pricing fundamentals. - [AWS Pricing](https://aws.amazon.com/pricing/) #### AWS Cost Explorer & Budgets Analyse spending trends, forecast costs, and set budget alerts per service or tag. #### Savings Plans & Reserved Instances Commit to usage for 1 or 3 years to save up to 72% vs On-Demand pricing. #### AWS Trusted Advisor _(recommended)_ Automated recommendations for cost, performance, security, and fault tolerance. #### Right-Sizing & Spot Instances Match instance types to actual workload needs and use Spot for fault-tolerant jobs. ### Stage 25: Data & Analytics Architecture Design scalable data pipelines, data lakes, and analytics platforms on AWS. #### Amazon Redshift _(recommended)_ Columnar data warehousing, Redshift Spectrum for S3 queries, and RA3 nodes. - [Amazon Redshift Docs](https://docs.aws.amazon.com/redshift/latest/mgmt/welcome.html) #### AWS Glue _(recommended)_ Serverless ETL, the Glue Data Catalog, crawlers, and Glue Studio. #### Amazon Kinesis _(recommended)_ Real-time data streaming with Kinesis Data Streams, Firehose, and Data Analytics. #### AWS Lake Formation _(optional)_ Build, secure, and manage data lakes on S3 with centralised access control. ### Stage 26: Migration Strategies Plan and execute the migration of existing workloads to AWS with proven strategies. #### The 7 Rs of Migration Retire, Retain, Rehost, Relocate, Repurchase, Replatform, and Refactor strategies. - [AWS Migration Strategies](https://aws.amazon.com/blogs/enterprise-strategy/6-strategies-for-migrating-applications-to-the-cloud/) #### AWS Migration Hub _(recommended)_ Track migrations from on-premises to AWS across multiple tools in a single console. #### AWS Application Migration Service _(recommended)_ Lift-and-shift server migrations with minimal downtime using continuous replication. #### Migration Readiness Assessment Evaluate people, process, and technology readiness before beginning large migrations. ### Stage 27: Well-Architected Reviews & Trade-offs Conduct architecture reviews, articulate trade-offs, and continuously improve designs. #### AWS Well-Architected Tool Run workload reviews against the Well-Architected Framework and track improvements. - [AWS Well-Architected Tool](https://aws.amazon.com/well-architected-tool/) #### Architecture Trade-off Analysis Consistency vs availability (CAP theorem), cost vs reliability, and latency vs throughput. #### Architecture Decision Records (ADRs) _(recommended)_ Document architecture decisions, context, and consequences for future reference. #### AWS Solutions Library _(recommended)_ Reference architectures and vetted solutions from AWS for common use cases. - [AWS Solutions Library](https://aws.amazon.com/solutions/) ### Stage 28: AWS Certification Path Validate your knowledge and skills with official AWS certifications. #### AWS Solutions Architect Associate (SAA-C03) The core certification for architects design resilient, high-performing, and cost-optimised solutions. - [SAA-C03 Exam Guide](https://aws.amazon.com/certification/certified-solutions-architect-associate/) #### AWS Solutions Architect Professional (SAP-C02) _(recommended)_ Advanced multi-account, hybrid, and complex architecture design for experienced practitioners. - [SAP-C02 Exam Guide](https://aws.amazon.com/certification/certified-solutions-architect-professional/) #### AWS Specialty Certifications _(optional)_ Advanced Networking, Security, Database, Data Analytics, and Machine Learning specialties.