On October 27, 2026, AWS published the exam guides for SAP-C03 (Solutions Architect – Professional) and DVA-C03 (Developer – Associate). This article goes through the official "Comparison of C02 and C03" pages and both guides, and lays out everything that changed.
My earlier article, written from the announcement blog before the guides were out, is here → previous article URL
This one is based on the published guides.
1. The short version
| SAP-C03 | DVA-C03 | |
|---|---|---|
| In one line | Same substance, restructured skeleton, plus AI and new services on top | AI added, substance unchanged |
| Domain structure | 4 domains → 5, fully reorganized. The cut changes from "organizational complexity / new solutions / improvement / migration" to Well-Architected pillars (design / security / cost / resilience / operations) | 4 domains, names and order mostly kept. Minor weighting changes |
| Weight of additions | Large (generative AI and agents, lakehouse, post-quantum cryptography, containers, DevSecOps) | Moderate (AI-assisted development, AI security, ECR / ECS / EKS / Fargate) |
| Deletions | Effectively zero (3 items, and the official page notes they may remain implicitly) | Zero (no Deletions section at all) |
For SAP, the architect judgment being tested — multi-account, hybrid networking, DR, cost — is the same. But AWS explicitly states that granular skills were consolidated and reorganized, and no C02 task number maps to C03.
For DVA, the official Additions are almost entirely "Use AWS AI tools to…" and "container," with no deletions.
2. Passing score change (SAP)
| Exam | Passing score (as stated in the official guide) |
|---|---|
| SAP-C02 | 750 / 1000 |
| SAP-C03 | 720 / 1000 |
Professional exams have used 750 (DOP-C02 also states 750). The SAP-C03 guide states 720, the same as Associate. A typo in the guide can't be ruled out — the DVA-C03 guide has a wrong registration date — so treat it as "the official guide says 720."
3. SAP-C02 → SAP-C03
Domain weighting
| SAP-C02 | % | SAP-C03 | % |
|---|---|---|---|
| D1 Design Solutions for Organizational Complexity | 26 | D1 Design and Implement Cloud-Native Architectures | 25 |
| D2 Design for New Solutions | 29 | D2 Security, Compliance, and Governance | 25 |
| D3 Continuous Improvement for Existing Solutions | 25 | D3 Design Cost-Optimized Architectures | 15 |
| D4 Accelerate Workload Migration and Modernization | 20 | D4 Resilience, Migration, and Business Continuity | 15 |
| D5 Operational Excellence and Automation | 20 |
Format is unchanged: 75 questions (65 scored + 10 unscored), 180 minutes, 300 USD. Cost (15%) and migration (15%) are lighter than in C02; security (25%) and operations (20%) are heavier.
Added task content (summary of the official Additions)
| Domain | Additions |
|---|---|
| D1 Cloud-native design | Serverless data processing pipelines (Kinesis Data Streams, Glue, Athena, Lambda), durable execution workflows (Step Functions, durable Lambda functions), service mesh (VPC Lattice, ECS Service Connect), container image management (ECR scanning, lifecycle policies), ingress design (ALB / NLB, AWS Load Balancer Controller, API Gateway), WebSocket / pub-sub, multi-tenant isolation patterns (silo / pool, Cognito tenant context, row-level security), new Task 1.2 AI/ML integration: multi-account Bedrock, agent design with AgentCore, SageMaker AI inference endpoints, RAG (Knowledge Bases + vector stores), hybrid compute (EKS Anywhere, ECS Anywhere, Outposts, Local Zones), IPv6 / dual-stack migration, data lake / lakehouse (Lake Formation, Redshift Spectrum, Apache Iceberg), MSK, AppFlow, Glue Data Catalog, Clean Rooms |
| D2 Security | Application authn/authz (Cognito, OAuth 2.0, EKS Pod Identity), IAM Roles Anywhere, post-quantum cryptography (ML-DSA / ML-KEM in KMS), data residency, compliance evidence via AWS Artifact, threat modeling, new Task 2.5 responsible AI controls: Bedrock Guardrails, AgentCore Identity, human-in-the-loop approval with Step Functions |
| D3 Cost | Cost optimization for AI/ML workloads (service tier selection, batching, caching, cross-region inference routing), observability cost optimization (log filtering, retention) |
| D4 Resilience | HA / DR with multi-cluster EKS / ECS |
| D5 Operations | In-pipeline security scanning and signing (Inspector, ECR scanning), multi-account / multi-region deployment pipelines (cross-account CodePipeline), AI output validation with Bedrock Evaluations, Container Insights, AI/ML metrics monitoring (inference latency, model drift, agent performance), CloudWatch Synthetics / RUM, circuit breakers, bulkheads, retries with exponential backoff, automated runbooks |
Deletions
The official Deletions list has three items: "Application upgrade path," "Delegating to AWS," and "Migration-tool security." AWS notes they may remain implicitly, so deletions are effectively zero.
In-scope service changes (excerpt)
| Change | Services |
|---|---|
| Added | Bedrock, VPC Lattice, Cloud WAN, Verified Access, Verified Permissions, Security Lake, Resilience Hub, Fault Injection Service, Clean Rooms, MemoryDB, CDK, Distro for OpenTelemetry, AWS Transform, Local Zones, Data Transfer Terminal, Cost Categories |
| Removed | All of IoT, End User Computing (WorkSpaces, AppStream), Media (Elastic Transcoder, Kinesis Video Streams), the individual AI services (Comprehend, Lex, Polly, Rekognition, Textract, Translate → consolidated into Bedrock / SageMaker AI), Lightsail, App Runner, Batch, Proton, Service Catalog, Wavelength, SES, Pinpoint, Amplify, CodeArtifact, Data Exchange, License Manager |
4. DVA-C02 → DVA-C03
Domain weighting
| DVA-C02 | % | DVA-C03 | % |
|---|---|---|---|
| D1 Development with AWS Services | 32 | D1 Development with AWS Services | 30 |
| D2 Security | 26 | D2 Security | 26 |
| D3 Deployment | 24 | D3 Testing and Deployment | 22 |
| D4 Troubleshooting and Optimization | 18 | D4 Troubleshooting and Optimization | 22 |
Format is identical: 65 questions (50 scored + 15 unscored), 130 minutes, 150 USD, passing score 720.
Additions (all of them)
| Task | Additions |
|---|---|
| 2.3 Security when using AI services (new task, 5 skills) | Access management for AI services, private connectivity via VPC endpoints and opting out of training-data use, input/output filtering (PII / PHI removal, denied topics, prompt-injection defenses), agent tool-use authorization, session isolation and human-in-the-loop, protecting sensitive information in logs |
| 1.1 | AI-assisted development tools for code generation / review / refactoring / security scanning, integrating managed AI services |
| 2.1 | Presigned URLs (S3, CloudFront) |
| 3.1 | Building and managing container images (ECR, Dockerfile, tags, lifecycle) |
| 3.2 | AI-generated tests and regression-test automation |
| 3.3 | Deployment with ECS task definitions / EKS manifests / Fargate, AI assistance in CI/CD |
| 4.1 / 4.3 | AI-assisted error analysis and optimization-opportunity detection |
Deletions
The official comparison page has no Deletions section. Nothing was removed.
Structural changes (task consolidation and moves)
- DynamoDB's four skills (partition keys / consistency / Query vs. Scan / indexes) → one skill. Scope unchanged
- Encryption (2.2) + sensitive data (2.3), 13 skills → consolidated into 2.2 with 7 skills. The freed 2.3 becomes AI security
- Testing (3.2) + test automation (3.3) → consolidated into 3.2
- Moves: SAM unit testing 1.1→3.2, Lambda performance tuning 1.2→4.3, serialization 1.3→1.1, API Gateway stages / custom domains 3.4→3.1
Notable in-scope services
The ML/AI category gains four entries: Amazon Bedrock, Bedrock AgentCore, Amazon Quick, and Kiro. Kiro (the AI IDE) and Quick entering the exam scope is worth noting. In Developer Tools, CodeCommit is gone (CodeBuild / CodeDeploy / CodePipeline / CodeArtifact remain).
5. An instructor's read
SAP sits between "a lot changed" and "substance unchanged." With no task-number mapping, preparation has to be rebuilt from the chapter structure up. The new areas to cover are generative AI and agent design (Bedrock, AgentCore, Knowledge Bases, Guardrails, Evaluations, cross-region inference), data lakehouse, container operations, resilience engineering, and DevSecOps pipelines. IoT, WorkSpaces, and "which individual AI service" questions get lighter.
DVA can be handled by insertion. New Task 2.3 (AI security) is the biggest source of new points; add AI-assisted development, containers, and presigned URLs to existing prep and you're covered. The one thing to watch is CodeCommit dropping out of scope.
Wrapping up
- SAP-C03 is fully reorganized from 4 to 5 domains. The official guide states a passing score of 720, down from 750
- SAP additions: generative AI and agents, lakehouse, post-quantum cryptography, containers, DevSecOps. Deletions effectively zero. IoT and the individual AI services leave the in-scope list
- DVA-C03 keeps its domain structure and format almost unchanged. A new AI-security task, plus AI-assisted development and containers. No deletions
- DVA's in-scope services add Bedrock, AgentCore, Amazon Quick, and Kiro. CodeCommit is out
As a Udemy instructor, I'll be updating my existing SAP and DVA courses based on these exam guides, targeting November.
→ https://www.udemy.com/user/maruchin-tech-2/
References
- Comparison of SAP-C02 and SAP-C03
- SAP-C03 exam guide
- SAP-C02 exam guide
- Comparison of DVA-C02 and DVA-C03
- DVA-C03 exam guide
- DVA-C03 in-scope services
About the author
Maruchin Tech — 12x AWS Certified | Cloud & AI for manufacturing and supply chain (AWS / Google Cloud / Azure) | Udemy instructor (100K+ students)
👨🏫 All my courses:
(Eng) https://www.udemy.com/user/maruchin-tech-2/
(Jpn) https://www.udemy.com/user/shan-wang-wan-jun-2/
🎫 Monthly discount coupons:
https://www.youtube.com/@MaruchinTech-cloud/posts
Top comments (0)