Confusing AWS Service Pairs for SAA-C03

Many questions on the AWS Solutions Architect – Associate (SAA-C03) exam aren't hard because the topic is obscure. You know the scenario needs a queue, or a firewall, or a cache, and two of the options are services that sound alike. The exam is scenario-based: a question describes a requirement, and the options often include close neighbours that each solve part of it.

This guide covers 16 pairs (and trios) that come up again and again. For each one you get the question that separates them, and the words in a scenario that point to the right answer. Everything here comes from AWS's own documentation, linked as we go. Prices, limits and quotas are left out, because they change and the exam rarely depends on them.

How to use this list

Don't try to memorise every feature of every service. For each pair, learn one deciding question, the thing you ask yourself when both names appear in the options. Then learn the scenario words that answer it. "Must not lose messages if a consumer is down" answers a different question from "every subscriber needs it right away".

If you're working through the SAA-C03 study guide, this list fits after you've covered each service once. It's revision for the boundaries between services, not a first introduction.

Messaging and streaming

SQS vs SNS vs EventBridge

Deciding question: does each message go to one worker, to every subscriber, or only to the targets whose rules match it?

• Work to be done once, at the worker's own pace → SQS (a queue that consumers pull from).
• One event that many receivers need right away → SNS (a topic that pushes to every subscriber).
• Events from many sources, each sent only where it's wanted (including from SaaS applications) → EventBridge.

The classic exam answer when many receivers must each get every message and none may miss one is both together: SNS fanning out to one SQS queue per receiver. AWS documents this as fanout to SQS queues.

Kinesis Data Streams vs SQS

Deciding question: do several applications need to read the same records, in order, and possibly read them again?

If yes, that's a stream: Kinesis Data Streams keeps records in order per partition key, and each reading application keeps its own position. If the job is "hand tasks to a pool of workers, and delete each one once it's done", that's SQS.

Storage

S3 vs EBS vs EFS

Deciding question: is it an object fetched by name, a disk for one instance, or a file system many instances share?

• Uploads, backups, a static website, a data lake → S3, objects you fetch by key from anywhere.
• A boot volume or a database disk for one EC2 instance → EBS.
• The same files read and written by many instances at once → EFS.

EBS vs Instance Store

Deciding question: must the data survive the instance stopping?

Instance store disks are physically attached to the host, and their data is lost when the instance stops, hibernates or terminates. That suits buffers, caches and scratch data, or data that's copied across a fleet anyway. Anything that must survive a stop, move to another instance or be backed up with snapshots belongs on EBS.

Networking

Security group vs network ACL

Deciding question: are you controlling what reaches each instance, or blocking traffic for a whole subnet?

A security group is stateful, has allow rules only, and can name another security group as a source. A network ACL sits at the subnet boundary, is stateless (return traffic needs its own rule), has both allow and deny rules, and checks them in number order. "Block this one IP address" is a NACL job, because a security group can't deny. AWS compares the two on its VPC security page.

NAT gateway vs VPC endpoint

Deciding question: does the private instance need the internet, or only an AWS service?

A NAT gateway lets instances in a private subnet reach the internet (patches, a third-party API) without being reachable from it. If they only need S3, DynamoDB or another AWS service, a VPC endpoint keeps that traffic off the internet path entirely, with no internet gateway or NAT involved. "Reduce NAT data processing costs for S3 traffic" is a strong hint for an endpoint.

Gateway endpoint vs interface endpoint

Deciding question: is it S3 or DynamoDB from inside the VPC, or anything else?

Gateway endpoints exist only for S3 and DynamoDB. They're a route-table entry, at no additional charge, used from inside the VPC. Interface endpoints (AWS PrivateLink) are network interfaces in your subnets: they work for many services, including S3, and can also be reached from on premises over VPN or Direct Connect. For S3 you can run both: in-VPC traffic on the gateway endpoint, on-premises traffic on the interface endpoint.

ALB vs NLB

Deciding question: does the load balancer need to read the HTTP request?

An Application Load Balancer routes by host name, path or headers, and can authenticate users before requests reach your app. A Network Load Balancer forwards TCP or UDP connections without looking inside them. That makes it the answer to "static IP address per Availability Zone", "non-HTTP protocol" and "preserve the client's IP address at the target".

CloudFront vs Route 53

Deciding question: are you speeding up content delivery, or answering which address a name points to?

CloudFront caches content at edge locations close to users. Route 53 is DNS: it turns your domain into an address, can steer users by latency, location, weight or health, and registers domains. Most real sites use both, with a Route 53 alias record pointing the domain at the CloudFront distribution.

Databases and caching

RDS vs Aurora vs DynamoDB

Deciding question: relational or key-value, and how much of the scaling do you want to hand over?

• An existing relational app (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server or Db2) that you want AWS to run → RDS.
• MySQL- or PostgreSQL-compatible, with storage that grows by itself, copies across Availability Zones and readers that can take over from the writer → Aurora.
• Look-ups by key at any scale, with no instances to size → DynamoDB, as long as you design the table around your queries, because there are no joins.

RDS Multi-AZ vs read replica

Deciding question: is the goal surviving a failure, or taking read load off the primary?

A Multi-AZ DB instance deployment keeps a standby in another Availability Zone and fails over to it automatically, on the same endpoint. In that deployment type the standby doesn't serve reads. (AWS also offers Multi-AZ DB clusters, whose standbys can serve reads; check which one a question describes.) A read replica is a readable copy for reports and read-heavy traffic, and it can live in another Region. They solve different problems, and one database can have both.

ElastiCache vs DAX

Deciding question: is the cache in front of DynamoDB specifically, with minimal code changes?

DAX is a cache built into how you call DynamoDB. It speeds up repeated, eventually consistent reads, passes strongly consistent reads straight through, and doesn't suit write-heavy tables. ElastiCache (Valkey, Redis OSS or Memcached) is a cache your own code manages, in front of any database, or a store for short-lived data such as sessions.

Compute, identity and secrets

Lambda vs EC2

Deciding question: is it short work triggered by events, or software that runs all the time?

Lambda runs your code when an event arrives (an upload, an API call, a message) and nothing runs in between. EC2 is the answer for long-running or always-on software, a specific operating system or agent, or a job longer than a function's maximum timeout.

IAM user vs IAM role

Deciding question: can this be done with temporary credentials?

Almost always, yes, and then the answer is a role: an app on EC2 or Lambda, access from another AWS account, or people signing in through your identity provider. IAM users with long-term access keys are for the cases where temporary credentials can't be used, such as a third-party tool outside AWS that only accepts access keys. "Hard-code access keys on the instance" is never the right answer.

Secrets Manager vs Parameter Store

Deciding question: does the value need to rotate automatically or be replicated to other Regions?

Secrets Manager is built for credentials, API keys and tokens, with automatic rotation and replication. Systems Manager Parameter Store holds configuration values in a path hierarchy, as plain text or encrypted as SecureString, with a standard tier at no additional charge. "Rotate the database password every 30 days without code changes" points to Secrets Manager.

CloudWatch vs CloudTrail vs Config

Deciding question: how is it performing, who did what, or what did it look like and is it compliant?

• Metrics, logs and alarms when something crosses a threshold → CloudWatch.
• Which user or role made an API call, and when → CloudTrail.
• How a resource was configured at a point in time, and whether it follows your rules → Config.

Practise the pairs, not just read them

Reading a comparison makes it feel obvious. Picking correctly inside a long scenario takes practice with scenario questions.

The free AWS Certification Prep on EditMyStuff has a Confusing pairs tab built for this. Each of these 16 pairs has its own page: an animated diagram of how each service handles the same job, a "when to use which" summary, a side-by-side table, and a few scenario questions with explanations. Every page cites the AWS documentation it relies on. The tab follows the exam you choose: on SAA-C03 you see all 16, and on the Cloud Practitioner (CLF-C02) track you see the 13 that exam's service list covers. A Keyword flashcards tab drills the exam keywords ("decouple", "fan out" and so on) and the service each one points to.

A useful routine: one pair a day, its scenarios first, then the difference out loud in two sentences. The security services have their own set of look-alikes, covered in AWS WAF vs Shield vs GuardDuty.

Frequently asked questions

Are these the only AWS services the exam mixes up?

No. They're common ones, and the ones the practice tab covers today, but any two services with overlapping jobs can appear side by side. The security services (WAF, Shield, GuardDuty, Inspector, Macie) are another group worth learning as a set.

Do I need to memorise limits and prices for these comparisons?

Rarely. The exam usually asks which service fits a requirement, not exact quotas, and quotas change over time. Learn what each service is for, what it can't do, and the words in a scenario that point to it.

Is this list useful for the Cloud Practitioner exam too?

Yes, for most pairs. CLF-C02 asks the same "which service fits" questions at a higher level. ElastiCache vs DAX, Secrets Manager vs Parameter Store and Kinesis vs SQS lean more towards SAA-C03, and the practice tab shows them only on that track.

What's the fastest way to tell two options apart in a long question?

Find the one requirement that only one option meets: "must survive a stop", "static IP", "every subscriber", "rotate automatically". Cross out the option that fails it before you compare anything else.