Module 1: The Exam And Your Unfair Advantage
4. Your unfair advantage: the complete inventory
Description
This is the most important lesson of the module, and probably of the whole guide: the table that turns "you already built a lot of this" from a marketing line into a precise inventory, guide by guide, service by service. A candidate studying SAA-C03 from scratch with a generic prep course learns about IAM, VPC, Lambda, or EventBridge by looking at slides. You operated them — with your own hands, against real Andes Cargo infrastructure, across nine complete guides. That difference is the unfair advantage this guide exists to name precisely, not just vaguely hint at.
Connection to the module
This table governs how Modules 2 through 6 of this guide are written. Every re-reading lesson in those modules starts by citing, in two or three lines, exactly what you already built in the corresponding guide, before translating it into exam vocabulary. They never re-explain what a security group is from scratch — they say "you already built this in X, here's the exact name the exam uses for the same thing."
The complete table
| Guide | What you actually built in andes-cargo-infra/ |
|---|---|
aws-core-services-guide | The mental model of the cloud; VPC with public/private subnet + security groups + NACLs; basic Route 53 (hosted zones, records); single-account IAM (users, groups, roles, policies); Amazon S3 (andes-cargo-shipment-docs); Amazon EC2; AWS Lambda (process-shipment-manifest); Amazon DynamoDB (Shipments) |
terraform-and-iac-guide | All of the above described in HCL inside andes-cargo-infra/, with child modules (s3-bucket, iam-role), the init/plan/apply/destroy cycle actually run, and state as the source of truth |
cicd-and-gitops-on-aws-guide | A GitHub Actions pipeline (ci.yml, apply.yml, drift.yml) running with act against LocalStack, with the plan-on-PR/apply-on-merge pattern |
cloud-security-and-guardrails-guide | Actually built federated OIDC; least-privilege IAM; preventive policy-as-code with conftest/Rego; IaC scanning with Trivy and Checkov; software supply chain (SBOM + signing with cosign); secrets management with SSM Parameter Store and AWS Secrets Manager; detective and preventive guardrails; SCP/multi-account named, not built |
finops-and-cost-guardrails-guide | Infracost and a cost gate in the pipeline; cost tagging (CostCenter, Owner); billing budgets and alarms; AWS Cost Explorer and anomaly detection; right-sizing and commitment discounts (Reserved Instances/Savings Plans/Spot) at the judgment level |
sre-and-incident-response-guide | Documented SLI/SLO and error budget; observability with Prometheus, Grafana, Alertmanager, and Jaeger; burn-rate alerts; blameless incident lifecycle and postmortems; runbooks |
aws-serverless-and-containers-guide | AWS Lambda in depth; AWS Step Functions; Amazon EventBridge (full event bus); Amazon API Gateway REST; Docker/Amazon ECR; Amazon ECS/Fargate (representative, LocalStack Base plan) |
kubernetes-and-eks-in-production-guide | A real Kubernetes cluster (kind); Pods, Deployments, Services; ConfigMaps, Secrets, health probes, HPA; Ingress and NetworkPolicy; GitOps with ArgoCD; admission control (Gatekeeper/Kyverno) and image scanning with Trivy; Amazon EKS at the vocabulary level (managed control plane, node groups, Karpenter, IRSA/EKS Pod Identity, AWS Load Balancer Controller shown, not run against a real account) |
genai-on-aws-production-guide | Amazon Bedrock (guardrails, IaC); AI workload security; token FinOps; observability and evals for AI in production |
How this table is used, exactly: every re-reading lesson in Modules 2 through 6 (for example, the IAM/Identity Center lesson in Module 2) opens with one or two sentences of the type "you already built this in cloud-security-and-guardrails-guide, Modules 2 and 7", and from there on devotes its space only to the exact vocabulary the exam uses to name it, and to what that service needs you to know for the exam that the lab didn't cover. It's the principle of mapping, not re-teaching, applied systematically: if you already operated it, this guide doesn't re-explain how it works from the beginning.
Two honest translations this table can't hide
CloudFormation, not Terraform. The SAA-C03 exam evaluates AWS CloudFormation, and terraform-and-iac-guide — for good reason, since Terraform is the real market standard — never taught it. This guide doesn't rebuild that entire module; Module 6 devotes a single lesson to vocabulary translation: a CloudFormation stack is conceptually the same as a Terraform project, a change set is the same as a plan, and drift is exactly the same concept in both tools. You won't leave this guide knowing how to write a CloudFormation YAML template — you'll leave knowing how to recognize, in an exam question, what each term means.
Bedrock doesn't transfer directly. genai-on-aws-production-guide gave you real experience building with Amazon Bedrock: guardrails, IaC, security, token FinOps. That's a real and valuable skill — but the official list of in-scope services for the SAA-C03 exam, in its Machine Learning section, does not include Bedrock. It instead lists the previous generation of managed services: Amazon SageMaker AI, Amazon Rekognition, Amazon Textract, Amazon Comprehend, Amazon Lex, Amazon Polly, Amazon Transcribe, Amazon Translate, and Amazon Kendra — confirmed live against AWS's official list. That guide's work strengthens your general judgment (how to declare a managed service in IaC, how to think about it in terms of guardrails and per-token cost), but it doesn't translate directly to an exam question. This guide states this plainly, without selling it as if it transferred.
What this means for you, in numbers
A candidate coming to SAA-C03 from scratch has to learn, on the fly and having never touched it before, practically everything in the left-hand column of the table above: what a security group is, how IAM works, what Lambda does, how an EventBridge event is structured, what a Kubernetes Ingress is. Not you. Your work in Modules 2 through 5 of this guide is, mostly, translation: taking a concept you already operated and putting the exact label the exam uses to name it. Your genuinely new work concentrates in Module 6 — the services that, by design of this zero-cost ecosystem, no lab could touch: Amazon RDS/Aurora, real load balancing (ALB/NLB), Amazon EC2 Auto Scaling, Amazon CloudFront, hybrid storage (EFS/FSx/Storage Gateway), hybrid connectivity (Direct Connect/VPN/Transit Gateway/PrivateLink), and the migration services (AWS DMS/Snow Family/DataSync).
The exact identifiers you're going to see repeat
Across Modules 2 through 7, this guide reuses the same Andes Cargo resource names over and over — on purpose, so the re-reading feels continuous instead of like new examples each time. It's worth having them fresh before you continue:
| Resource | Exact identifier |
|---|---|
| Account | 000000000000 (LocalStack test account) |
| Region | us-east-1 |
| S3 bucket | andes-cargo-shipment-docs |
| DynamoDB table | Shipments (partition key shipmentId) |
| Lambda function | process-shipment-manifest |
| Lambda role | LambdaManifestProcessorRole |
| Application role | AppServerRole |
| Sample shipments | 4471 (Peru→Chile), 4472 (Colombia→Ecuador), 4473 (Chile→Peru) |
No module of this guide changes these names, or adds a new business resource with a different name. If a practice question in this guide ever uses an Andes Cargo resource name that isn't in this table, it's because that specific question uses a new generic scenario (remember the proportion from lesson 8: roughly 40-50% Andes Cargo, the rest new scenarios) and says so explicitly in its heading.
An example of what "mapping, not re-teaching" looks like in practice
So the principle doesn't stay abstract, here's exactly how a re-reading lesson in Module 2 works (you won't read it yet, but it's worth seeing the shape before you get there): the lesson on Task 1.1: Design secure access to AWS resources doesn't start by explaining what an IAM role is. It starts like this: "You already built this in cloud-security-and-guardrails-guide, Module 2: federated OIDC end to end, with AppServerRole assumed through an external identity provider. The exam calls this 'federated access' (Task 1.1), and adds a concept your lab didn't need: AWS IAM Identity Center, the successor to AWS SSO for managing human — not application — access across multiple accounts." From there on, the lesson devotes its space to what's genuinely new (IAM Identity Center), not to re-explaining OIDC from scratch. That's the pattern you'll see repeat, with variations, in every re-reading lesson in Modules 2 through 6.
Common mistakes
Assuming "I already built it" means "I already know how the exam asks about it." What happens: someone reads the table, recognizes every name, and concludes they don't need to study those domains because they "already operated them." How to spot it: if your study plan jumps straight to Module 6 (the 100% new part) without going through Modules 2 to 5. How to fix it: operating a service with LocalStack in a guided case is different from recognizing, under time pressure, which of four architecture options solves a new scenario with a specific constraint. Modules 2 through 5 exist exactly to close that gap between "I operated it" and "I recognize it in an exam question."
Treating Bedrock and Kubernetes/EKS as if they transfer 1:1 to the exam. What happens: someone assumes that, because they mastered Bedrock in genai-on-aws-production-guide or EKS in kubernetes-and-eks-in-production-guide, those domains are "already covered" for the exam. How to spot it: if you expect Bedrock questions on the exam, or if you assume your experience with kind and ArgoCD is exactly what the exam evaluates about Amazon EKS. How to fix it: Bedrock is not in the exam's official scope — stated above with the exact source. Amazon EKS is in scope, but the exam evaluates it at the level of managed architecture (control plane, node groups, IAM integration), not at the level of Kubernetes manifests that kind let you actually run; the specific vocabulary translation lives in Module 3 of this guide.
Skipping the Terraform-to-CloudFormation translation out of laziness. What happens: someone decides that, since they'll never use CloudFormation in their real job, they can skip that Module 6 lesson entirely. How to spot it: if your reason for not studying CloudFormation is "at my job we use Terraform." How to fix it: the exam doesn't ask about your work stack, it asks about what AWS defines as in-scope, and CloudFormation appears explicitly in the Management and Governance category of that list. You don't need to know how to write a template — but if a question mentions a CloudFormation change set or drift, you need to recognize what it means, with the same speed you'd recognize those concepts in Terraform.
Summary and next step
In this lesson you saw the complete, precise inventory of the nine previous guides — what each one built, service by service, in Andes Cargo's real infrastructure — and the two honest translations that advantage doesn't fully cover: CloudFormation (which the exam does evaluate and no sibling guide taught) and Bedrock (which no exam guide evaluates, even though genai-on-aws-production-guide taught it in depth).
Before moving on you should be able to name, for at least five of the nine guides, the main service or concept it gave Andes Cargo, and explain why "I already built it" is not the same as "I already know how the exam asks about it."
Lesson 5 draws this guide's exact boundary: what it IS and what it definitely is NOT, so you know from now on what to expect from the seven lessons and seven modules that follow.
Resources
- The nine sibling guides'
DISENO.mdfiles (aws-core-services-guide,terraform-and-iac-guide,cicd-and-gitops-on-aws-guide,cloud-security-and-guardrails-guide,finops-and-cost-guardrails-guide,sre-and-incident-response-guide,aws-serverless-and-containers-guide,kubernetes-and-eks-in-production-guide,genai-on-aws-production-guide) — the source of this table, service by service. - In-Scope AWS Services — SAA-C03 — the official list confirming that Amazon Bedrock does not appear in the Machine Learning category.
- AWS CloudFormation — official documentation — for anyone who wants to go deeper than Module 6's vocabulary translation.