AWS Solutions Architect - Professional & SRE Master Curriculum

The Bridge from Developer to Solutions Architect / SRE

Associate certifications test individual service capabilities. The Solutions Architect – Professional tests multi-constraint optimization: balancing security guardrails, regional latency, blast-radius isolation, and RTO/RPO requirements while minimizing operational overhead.

Enterprise Service Control Policy (SCP) Guardrails

In enterprise architectures, developers must have full administrative permissions inside their local sandboxes or development accounts, while the platform team enforces non-bypassable organizational guardrails at the OU level.

Critical SCP Rules for SAP-C02:

• SCPs only filter permissions—they never grant access. A user must still be explicitly granted permission via an IAM policy.
• The AWS Organizations Management (root) account is immune to SCPs.
• When writing region-restricting SCPs, always exempt global services (IAM, Route 53, CloudFront, WAF, AWS Support) to prevent breaking account operations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnapprovedRegionsExemptingGlobals",
      "Effect": "Deny",
      "NotAction": [
        "cloudfront:*",
        "iam:*",
        "route53:*",
        "support:*",
        "wafv2:*",
        "health:*",
        "organizations:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "us-west-2"
          ]
        }
      }
    },
    {
      "Sid": "ProtectSecurityServices",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail",
        "config:DeleteConfigRule",
        "config:StopConfigurationRecorder",
        "guardduty:DeleteDetector",
        "guardduty:DisassociateFromMasterAccount"
      ],
      "Resource": "*"
    },
    {
      "Sid": "PreventLeavingOrganization",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    }
  ]
}

ECS Fargate & EKS High-Availability Patterns

• Fargate Spot Strategy: Run baseline production traffic on Fargate On-Demand (e.g. 30%), and burst peak traffic onto Fargate Spot (70%). Handle the 2-minute SIGTERM warning via EventBridge to drain connections cleanly.
• Auto Scaling Lifecycle Hooks: When an EC2 instance in an ASG receives a termination signal, a lifecycle hook moves it to Terminating:Wait. A Lambda function triggers container connection draining and flushes local logs to S3 before signaling CONTINUE.

Disaster Recovery (DR) Architectural Decision Matrix