AWS Certification: Which One to Get and How to Prepare

The best AWS certification is the one that matches the work you want to do next. Cloud Practitioner is not a mandatory first rung. Solutions Architect Associate is not the default for a developer, data engineer, ML engineer, or cloud operator who already has a clearer role target.

My rule is simple: choose the role, read the current exam guide, build one small system that exercises the highest-weight domains, and rehearse a failure and rollback. The badge can help a recruiter or client understand your scope. The project proves you can make and verify decisions beyond a multiple-choice screen.

Are AWS certifications worth it?

AWS certification is worth it when it closes a specific evidence gap. It can show structured coverage when you are changing roles, applying to an AWS partner, consulting, or trying to get past an initial screening step. It does not prove production judgment, incident handling, cost control, or the ability to explain a tradeoff.

• Strong fit: the target job names AWS services, architecture, CloudOps, DevOps, data, ML, networking, or security.
• Weak fit: you have no matching role goal and are collecting badges because the next exam feels productive.
• Missing proof: you can explain services but cannot show a template, diagram, log, test, cost estimate, failure, or rollback.
• Best combination: one role-matched credential plus one documented project and a clear boundary of what you did not test.

I would not use salary-survey headlines as the decision. Certification holders differ by country, role, seniority, employer, prior experience, and selection into the survey. Decide against the job descriptions you actually want and the evidence your current resume lacks. This is where online courses earn their keep: after they lead to a shipped artifact, not another completion screen.

The AWS certification paths

As of July 29, 2026, AWS Certification exam-guide catalog lists 12 exams: two Foundational, five Associate, three Professional, and two Specialty. The catalog is a role map. AWS does not require you to earn the tiers in order.

The official product root remains https://aws.amazon.com/. Use the dated exam-guide catalog for codes and scope because product pages, language availability, betas, and retirement dates can change.

Tier	Current exams and codes	Count
Foundational	AI Practitioner (AIF-C01); Cloud Practitioner (CLF-C02)	2
Associate	CloudOps Engineer (SOA-C03); Data Engineer (DEA-C01); Developer (DVA-C02); Machine Learning Engineer (MLA-C01); Solutions Architect (SAA-C03)	5
Professional	DevOps Engineer (DOP-C02); Generative AI Developer (AIP-C01); Solutions Architect (SAP-C02)	3
Specialty	Advanced Networking (ANS-C01); Security (SCS-C03)	2

Foundational: Cloud and AI vocabulary

Cloud Practitioner covers general AWS cloud concepts, security, services, and billing. AI Practitioner covers AI, ML, generative AI concepts, use cases, and responsible AI at a foundational level. Use these when the job needs informed participation more than implementation depth.

Associate: five technical roles

Solutions Architect focuses on secure, resilient, high-performing, and cost-optimized design. Developer covers building, deploying, and debugging applications. CloudOps Engineer is the current name for the operations path and covers monitoring, reliability, deployment, security, and networking. Data Engineer covers pipelines and data stores. Machine Learning Engineer covers deploying and maintaining ML solutions.

Professional: three advanced roles

Solutions Architect Professional and DevOps Engineer Professional target complex architecture and distributed-system delivery. Generative AI Developer Professional is now in the catalog for designing, implementing, and deploying AI solutions. AWS describes the Solutions Architect and DevOps Professional target candidates as having two or more years of relevant hands-on experience.

Specialty: networking and security

Advanced Networking Specialty and Security Specialty are the two current Specialty exams. The old Machine Learning Specialty is no longer an exam choice: the Machine Learning Specialty retirement notice gives March 31, 2026 as the last test date. Credentials already earned remain active for three years from the date earned.

The replacement path is not static either. The July 2026 MLA-C02 announcement says MLA-C02 beta registration opens September 1, 2026, the last English MLA-C01 test date is September 28, and the English beta begins September 29. If you are preparing now, choose the version whose exam guide and delivery date match your booking.

Which AWS certification should you start with?

Start from the job’s recurring decisions. If the role designs systems, choose architecture. If it writes software, choose Developer. If it owns monitoring and recovery, choose CloudOps. A broad credential is useful only when broad coverage is actually the gap.

Your next role or gap	Best first exam to inspect	Proof project
Business, sales, project, or cloud vocabulary	Cloud Practitioner	Service-and-cost decision memo
AI-aware business or product role	AI Practitioner	Responsible-AI use-case evaluation
Cloud or solutions architecture	Solutions Architect Associate	Secure, resilient, costed architecture
Application development	Developer Associate	Deployed app with logs and rollback
Operations, SRE, or platform work	CloudOps Engineer Associate	Alert, incident, restore, and runbook
Data engineering	Data Engineer Associate	Versioned pipeline with quality checks
ML engineering or MLOps	Machine Learning Engineer Associate	Training-to-deployment workflow with monitoring
Experienced security or networking specialist	Relevant Specialty	Threat model or hybrid-network failure drill

SAA-C03 exam guide is a reasonable broad technical starting point. It says the target candidate should have at least one year of hands-on cloud-solution design experience. The four scored domains are secure architecture 30%, resilient architecture 26%, high-performing architecture 24%, and cost optimization 20%.

If you are not designing solutions, do not force SAA-C03 merely because it is popular. A role-matched sequence is how online learning compounds into a career move instead of a pile of unrelated exam codes.

My reproducible CloudFormation practice lab

I used a local validation lab to test the study method without creating an AWS resource. The baseline was a small CloudFormation template for an encrypted, versioned S3 bucket with all four public-access-block settings enabled. I ran it through CloudFormation Linter 1.53.3 on macOS 27 arm64 with Python 3.14.5 and AWS CLI 2.34.50 installed.

Test	Environment or change	Measured result
Baseline repeatability	Five us-east-1 local schema checks	5 of 5 passed
Region check	Same baseline against eu-west-1 schemas	Passed
Property failure	PublicAccessBlockConfigurations typo	Exit 2; E3002 caught it and suggested the valid name
Resource failure	AWS::S3::Buckett typo	Exit 2; E3006 reported the type does not exist
Rollback	Restore the previous baseline template	Passed; SHA-256 matched the baseline

The five baseline checks took 779.08 milliseconds at the median, including local tool startup. The rollback file hash was 898b55e478ecdb911a85255fbc88b93c9b2357a87890fc6f3a7c20fa2902d78d, identical to the baseline.

• What the lab proves: I can reproduce a valid template, detect two deliberate schema errors, and restore the known baseline.
• What it does not prove: IAM authorization, service quotas, network behavior, billing, runtime reliability, or rollback of a deployed CloudFormation stack.
• Exam limit: passing a linter is not evidence of exam readiness. It is one portfolio artifact tied to infrastructure-as-code and failure handling.
• Safety limit: no cloud account, credential, billable resource, or production data was used.

How to prepare for AWS certification exams

Prepare from the exam guide outward. A course can organize the material, but the official domain weights, task statements, and in-scope services define the target. Build a lab for each major decision type, then test whether you can explain why one plausible option is wrong.

1. Freeze the version: save the exam code and official guide. Use AWS Skill Builder for AWS’s current prep plans, question sets, labs, and digital courses.
2. Use the new Free Tier carefully: the current AWS Free Tier documentation says accounts created after July 15, 2025 receive $100 in credits and can earn another $100. The Free Plan ends after six months or when credits are used, whichever comes first. It is not the old blanket 12-month promise.
3. Set a budget before the first lab: enable AWS Budgets, inspect the billing dashboard, choose a region, tag resources, and delete what the exercise does not need.
4. Practice failure: break one property, policy, route, alarm, or deployment assumption; capture the error; restore the prior state; verify the result.
5. Map practice to weights: spend more review time on a high-weight weak domain than a low-weight strong one.
6. Do timed mixed questions last: use them to practice interpretation and elimination, not to memorize a question bank.

For SAA-C03, a weighted diagnostic can expose a false sense of readiness. Suppose your practice accuracy is 70% secure, 80% resilient, 75% high-performing, and 90% cost-optimized. Using the official weights, the weighted result is 0.30x70 + 0.26x80 + 0.24x75 + 0.20x90 = 77.8%. Secure architecture is still the largest and weakest domain.

Do not translate 77.8% into an AWS scaled score. AWS uses scaled scoring across exam forms, and practice providers have different question quality. Use your diagnostic to allocate study time. Book when two fresh, timed, mixed sets clear your own safety margin and you can explain the distractors.

Cost, exam format, and recertification

AWS before-testing policy lists the standard exam prices by tier. Treat USD figures as the published reference, not the final amount in every country. Local currency, taxes, beta exams, and dated promotions can change checkout.

Tier	Standard USD price	Passing standard
Foundational	$100	700 scaled
Associate	$150	720 scaled
Professional	$300	750 scaled
Specialty	$300	750 scaled

AWS scoring and retake policy says failed candidates must wait 14 calendar days, pay the registration fee again, and may make further attempts without a fixed attempt limit. After passing, the same exam cannot be retaken for two years unless AWS has introduced a new exam guide and series code. Detailed results can take up to five business days.

Certifications are valid for three years, but AWS recertification table now lists credential-specific renewal and maintenance routes. AWS announced in June 2026 that eligible people within 90 days of expiration can maintain a certification for one additional year through curated Skill Builder training and labs. Exam renewal, qualifying higher-level exams, and Cloud Quest options still depend on the credential.

Budget time as well as fees. For an Associate attempt with a $150 exam, $0-$100 of learning material, $0-$50 of lab usage, and 60 study hours valued at $15-$40 an hour, the economic cost is $1,050-$2,700. Those are illustrative inputs, not a claim about what you must spend or earn. The credential should support a role move worth more than your own opportunity cost.

Common mistakes to avoid

The expensive mistake is studying for an old or irrelevant exam. Version drift, role mismatch, passive video hours, uncontrolled lab costs, and copied questions can waste more than the test fee.

• Following a retired map: Machine Learning Specialty is retired, SysOps is now CloudOps, and the catalog includes newer data, ML, AI, and Generative AI credentials.
• Memorizing service names: scenario questions test constraints and tradeoffs. Write down why each distractor fails the stated requirement.
• Using exam dumps: copied live questions break AWS candidate and testing policies and can lead to invalidated results, revoked certifications, or program restrictions.
• Ignoring cost controls: a learning account can still create billable usage. Set budgets and delete resources.
• Skipping failure and rollback: a happy-path demo does not show operational judgment.
• Collecting badges without artifacts: one role-matched certification plus a clear project is stronger than an unexplained catalog of exams. People who break into data science face the same portfolio problem.

Frequently Asked Questions

Pick the role, freeze the current exam code, and make one project carry the study. If the project includes a design choice, a measured check, a deliberate failure, and a verified rollback, the certification has something real to sit beside. That is the combination I would take into an interview.