STUDYING · CERTS + ACTIVE TRACKS
CERTS &
STUDY.
Solutions Architect Associate is the cloud-architecture foundation. Generative AI Developer – Professional is the capability that matters for applied-AI work: foundation-model integration on Bedrock. A real build sits between them, so the second cert rests on shipped work, not exam cramming. Applied-AI and architecture, on purpose — not classical MLOps or fine-tuning.
Certifications
-
Claude Certified Architect Foundations
Agentic architecture, MCP tool design, Claude Code workflows, context management. ~70% of exam surface overlaps existing daily practice.
-
Foundational GenAI-on-AWS vocabulary. Pre-SAA warmup that fills the Bedrock/SageMaker gap SAA skims over.
-
AWS Solutions Architect Associate (SAA-C03)
Foundation + legibility cert, and the AWS-listed precursor to the GenAI Dev Pro. Standalone study (Maarek + Tutorials Dojo); the Bedrock build supplies the hands-on.
-
AWS Certified Generative AI Developer – Professional
On-lane capability cert: integrating foundation models (Bedrock) into production apps — RAG, agents, guardrails, eval. Professional-tier; the Bedrock build provides the hands-on it assumes.
AWS path
0 builds shipped- Phase 1 Account and IAM Foundations 0/8
- Create the AWS account, enable IAM Identity Center, lock down the root user with MFA · 1h
- Set an AWS Budgets cost alert and a billing CloudWatch alarm on day one · 1h
- Create an admin group, a dev IAM user, and enforce MFA via a policy · 1h
- Write a least-privilege IAM role and policy for an EC2 app · 1h
- Build a cross-service role and practice `sts assume-role` from the CLI · 1h
- Use the IAM Policy Simulator to test allow/deny on a tricky policy · 1h
- Configure named CLI profiles and SSO login against Identity Center · 1h
- Read the IAM section (users, groups, roles, policies, boundaries) and note the gaps · 2h
- Phase 2 Networking (VPC) 0/7
- Build a VPC with public and private subnets across 2 AZs · 2h
- Wire route tables, an internet gateway, and a NAT gateway · 1h
- Configure security groups vs NACLs and prove statefulness with a test · 1h
- Add a Gateway endpoint (S3) and an Interface endpoint (SSM) · 1h
- Peer two VPCs and route private traffic between them · 1h
- Turn on VPC Flow Logs and read a captured deny in CloudWatch · 1h
- Read the hybrid options (Transit Gateway, Site-to-Site VPN, Direct Connect) and when to pick each · 2h
- Phase 3 Compute and Scaling 0/9
- Launch an EC2 instance into the private subnet, reach it via SSM Session Manager · 1h
- Bootstrap a web server with user-data and bake a custom AMI · 1h
- Attach an EBS volume, snapshot it, and restore to a new AZ · 1h
- Read the pricing models (On-Demand, Reserved, Savings Plans, Spot) and the break-even logic · 1h
- Stand up an Application Load Balancer with a target group and health checks · 1h
- Wire an Auto Scaling group behind the ALB with a launch template · 2h
- Add a target-tracking scaling policy and load-test it to trigger a scale-out · 1h
- Build a Lambda function behind the ALB or a function URL · 1h
- Read the container options (ECS, EKS, Fargate) and the launch-type tradeoffs · 1h
- Phase 4 Storage 0/8
- Host a static site on S3 behind CloudFront with OAC · 1h
- Add lifecycle rules to tier objects to IA then Glacier · 1h
- Enable versioning plus MFA-delete and recover a deleted object · 1h
- Configure cross-region replication to a second bucket · 1h
- Compare SSE-S3, SSE-KMS, and a bucket policy that denies unencrypted puts · 1h
- Generate a presigned URL and a least-privilege bucket policy for it · 1h
- Create an EFS file system and mount it on two instances across AZs · 1h
- Read the storage-selection guide (EBS vs EFS vs FSx vs Instance Store) · 1h
- Phase 5 Databases 0/8
- Stand up a Multi-AZ RDS instance · 2h
- Add a read replica and observe failover vs read-scaling behavior · 1h
- Create an Aurora cluster and test the reader endpoint · 1h
- Build a DynamoDB table and model one access pattern with a partition key · 2h
- Add a Global Secondary Index and query it · 1h
- Enable TTL and a DynamoDB Stream feeding a Lambda · 1h
- Put ElastiCache for Redis in front of a read-heavy query · 1h
- Read when to reach for Redshift, Athena, or DMS instead of RDS · 1h
- Phase 6 Decoupling and Streaming 0/7
- Build an SQS queue with a producer and a polling consumer · 1h
- Add a dead-letter queue and a redrive policy, then force a failure · 1h
- Fan out an SNS topic to SQS plus an email subscription · 1h
- Create an EventBridge rule that routes an event to a Lambda · 1h
- Build a Step Functions state machine with a retry and a catch · 2h
- Stand up an API Gateway REST API backed by Lambda with throttling · 1h
- Read Kinesis (Data Streams vs Firehose) vs SQS for streaming workloads · 1h
- Phase 7 Resilience and Disaster Recovery 0/5
- Configure Route 53 with a routing policy (weighted or latency) · 1h
- Add health checks and a failover routing policy to a standby · 1h
- Set up AWS Backup with a plan and a cross-region copy · 1h
- Read the 4 DR strategies (backup/restore, pilot light, warm standby, multi-site) and their RTO/RPO · 2h
- Sketch a resilient multi-AZ architecture for a sample scenario and justify each choice · 2h
- Phase 8 Security and Encryption 0/7
- Create a KMS key and encrypt/decrypt app data with an envelope pattern · 1h
- Store an RDS credential in Secrets Manager and rotate it · 1h
- Compare Parameter Store (free tier) vs Secrets Manager for config · 1h
- Issue an ACM cert and attach HTTPS to the ALB · 1h
- Put AWS WAF in front of CloudFront with a managed rule group · 1h
- Build a Cognito user pool and protect an API with it · 1h
- Read the detective services (GuardDuty, Macie, Inspector, Security Hub) and what each finds · 1h
- Phase 9 Monitoring, Cost, and Well-Architected 1/6
- Build a CloudWatch dashboard and an alarm wired to SNS · 1h
- Ship app logs to CloudWatch Logs and query them with Logs Insights · 1h
- Enable a CloudTrail trail to S3 and find an API call in the history · 1h
- Turn on an AWS Config managed rule and watch it flag a non-compliant resource · 1h
- Read the cost tooling (Cost Explorer, Budgets, Trusted Advisor, Compute Optimizer) · 1h
- Read the Well-Architected Framework pillars overview · 1h
- Phase 10 SAA-C03 Exam Prep 0/8
- Score Tutorials Dojo timed set 1 and log weak domains · 2h
- Score Tutorials Dojo timed set 2 and remediate the worst domain · 2h
- Score Tutorials Dojo timed set 3 (target 75 percent or better) · 2h
- Score Tutorials Dojo timed set 4 (target 80 percent or better) · 2h
- Score Tutorials Dojo timed set 5 (target 85 percent or better) · 2h
- Rebuild notes on your two weakest domains and re-drill them · 2h
- Schedule the SAA-C03 exam once two sets clear 85 percent · 1h
- Sit the SAA-C03 exam · 3h
- Phase 11 Bedrock Build (Q4 bridge to GenAI Dev Pro) 0/8
- Set a dedicated AWS Budget alert for Bedrock and OpenSearch Serverless · 1h
- Invoke a Bedrock foundation model from code and handle streaming · 1h
- Build a prompt template and compare two models on the same task · 1h
- Stand up a Bedrock Knowledge Base over a tiny public corpus and query it · 2h
- Add a Bedrock Guardrail and prove it blocks a disallowed query · 1h
- Bolt the existing eval harness onto the Bedrock RAG path · 2h
- Run the accuracy, latency, and cost comparison vs the prior stack · 2h
- Write up the comparison as the public portfolio artifact · 2h
- Phase 12 GenAI Dev Pro Gap-Study (deferred, Q1 '27) 0/5
- Pull the official 5-domain exam guide and map it to the Phase 11 build · 1h
- Gap-analyze the build vs the guide (Agents, model customization, security at scale) · 2h
- Complete the AWS Skill Builder Exam Prep plan for the cert · 4h
- Score the official practice assessment and remediate · 2h
- Sit the GenAI Developer Professional exam · 3h