Amazon's cloud certification offerings are delivered through Amazon Web Services (AWS). The AWS credential portfolio is broad enough that choosing an exam can become a problem in its own right. The obvious question—Which AWS exam should I take next?—is less useful than asking what decisions the candidate wants to make at work. A developer who builds event-driven applications needs different knowledge from a platform engineer responsible for operating workloads, an architect balancing resilience against cost, or a security specialist investigating access problems. Amazon's AWS certifications are most useful when read as validations of those different responsibilities rather than as a single hierarchy everyone must climb.

Amazon Web Services organizes this certification program around business, foundational, associate, professional and specialty credentials. Levels matter because they indicate the type and complexity of the work assessed, but level alone is not enough. The right associate exam for an administrator may be a poor substitute for the one a developer needs, and a professional credential should build on genuine experience with the relevant systems. The certification portfolio also changes. Exam versions retire and new AI-focused credentials appear, so candidates should check AWS's current examination notices instead of assuming that a familiar code remains available for booking.

Business and foundational certifications establish different baselines

Cloud Practitioner (CLF-C02) validates general AWS Cloud knowledge: the cloud value proposition, foundational services, billing, security responsibility and basic architectural ideas. Its audience includes people who work with AWS-based projects without necessarily deploying production systems. Someone in procurement, project coordination or a business-facing technical role may need to understand what a managed database changes, why data-transfer charges appear, or why the customer—not AWS—controls user permissions in an application.

Cloud Practitioner knowledge can prevent expensive misunderstandings. A team may describe a new workload as low cost because its virtual machines are small, overlooking attached storage, backups, outbound traffic or environments left running for testing. A discussion of AWS billing and cost visibility becomes useful when the organization tries to understand the bill rather than merely repeat a price estimate. A second foundational distinction is the shared responsibility model: AWS operates the underlying cloud infrastructure, while customers remain responsible for many choices involving identity, configuration, data and applications.

AI Practitioner (AIF-C01) shifts the emphasis toward AI, machine learning and generative AI concepts, including use cases, responsible adoption and the division between a model and a managed application service. In Amazon Bedrock, for example, an organization can use managed foundation-model capabilities without operating the model infrastructure; it still owns important choices about data access, output assessment, use-case fit and guardrails. A business analyst evaluating an AI assistant needs to distinguish a model's plausible answer from a verifiable result and recognize when an experiment requires human review before any operational rollout. This credential does not substitute for the implementation depth of an engineering certification.

AWS also offers the AWS Certified AI Business Strategist (AIB-C01), currently delivered as a beta examination for business professionals. It tests the judgment involved in evaluating AI opportunities, building business cases, establishing governance and scaling adoption. AWS describes this as a business credential rather than an assessment of AWS service implementation, so it should not be confused with a hands-on engineering examination. Its focus is deciding where AI creates measurable value and how an organization can adopt it responsibly.

Associate paths: architecture, applications, operations and data

Solutions Architect – Associate (SAA-C03) is a common choice for people who design cloud systems across compute, network, storage, data and security. Its practical question is how to satisfy requirements when choices compete. A system can be highly available but unnecessarily expensive; an inexpensive storage design may not satisfy recovery objectives; a database choice that works in development may create operational pain at production scale. An architect should be able to explain those trade-offs instead of treating one service as the default answer to every scenario.

A database decision can become the architectural bottleneck long after a design passed its first load test. Relational transactions, key-value access, eventual consistency, operational recovery and query patterns impose different trade-offs; choosing the right AWS database depends on those requirements rather than on the service a team knows best. RDS, DynamoDB and purpose-built data stores are not interchangeable simply because each can persist information. Architecture candidates should be able to defend a choice against workload access patterns, data consistency, maintenance and failure recovery.

The distinction between compute and storage options illustrates the work. An application with unpredictable traffic might use serverless components, while a legacy service may require instance-level control and predictable runtimes. Lambda and EC2 solve different operational problems; knowing which one is appropriate requires understanding execution duration, scaling, runtime constraints and workload economics. S3, EBS and EFS likewise represent object, block and shared-file storage, not simply three price points on a menu.

Developer – Associate (DVA-C02) tests the implementation and maintenance of AWS applications: APIs, permissions, deployment tools, observability and event-driven behavior. A queue consumer must be able to handle repeat delivery, temporary failures and safe retries; a successful initial API call is not proof that the surrounding workflow is reliable. AWS has announced a version transition: DVA-C02 can be taken through November 30, 2026, while registration for DVA-C03 opens October 27 and the updated exam starts December 1, 2026. The new blueprint adds modern AI-assisted development considerations while retaining the core emphasis on developing, testing, deploying and troubleshooting applications. Candidates following older DVA-C02 materials should consult the published DVA-C03 blueprint and booking calendar before deciding whether to take the outgoing exam or prepare for the replacement.

CloudOps Engineer – Associate (SOA-C03) fits people responsible for deployment, operation, monitoring and remediation. Configuration changes must be traceable, alarms must be actionable and incident response must account for rollback and recovery. CloudOps is not merely a renamed SysOps syllabus: deployment and automation in CloudOps must be judged by whether a workload still serves users after a release, a dependency failure or a capacity change. The professional operating the system owns the gap between a green deployment pipeline and a service that is genuinely healthy.

Practical AWS cloud operations involves deciding which signals should page an engineer, which automated action is safe and which failure needs a human decision. A CPU alarm may be unhelpful if customers are actually experiencing failed payments from a downstream dependency. Useful operating metrics connect infrastructure events to application behavior; runbooks, recovery testing and post-incident changes close the loop. That is why operational experience matters when selecting SOA-C03 over a credential focused on writing application code.

Data Engineer – Associate (DEA-C01) focuses on building and running data pipelines and stores. Practical decisions concern ingestion, transformation, data quality, access, lifecycle and cost. A pipeline that delivers yesterday's records on time but silently duplicates a subset is not reliable. Data engineers need to understand how retries, schema changes, partitioning, orchestration and monitoring affect the correctness of the datasets that other teams use.

Data-platform design also requires a deliberate distinction between transactional stores and an analytical AWS data lake. Landing raw events in object storage is not enough: schema evolution, access permissions, cataloging, retention, data quality checks and consumption patterns determine whether the lake is useful. A team that cannot explain where its source records came from or how a transformation changed them cannot claim reliable analytics merely because every pipeline reported a successful run.

AI engineering has its own moving exam versions

AWS's machine-learning track has changed in 2026. Machine Learning Engineer – Associate (MLA-C01) covered building and operating ML workloads, but AWS stopped offering the English-language MLA-C01 exam on September 28, 2026. The updated MLA-C02 beta began in English on September 29, while MLA-C01 remained available in certain other languages during the transition. Candidates should verify which exam and language they can actually book; older MLA-C01 preparation material should not be mistaken for the current English examination.

ML engineering is not the same as presenting an AI demo. A production workflow must handle versioned data, feature preparation, repeatable training, deployment controls and the possibility that a model's behavior will change. Poor data preparation and feature engineering can leak information from the future, misalign training and serving inputs, or make a model appear accurate without truly predicting the intended outcome. After deployment, disciplined ML workload monitoring helps distinguish distribution shift, access failure and service degradation. These engineering practices carry forward, but a study plan based on the MLA-C01 blueprint still needs to be reconciled against the MLA-C02 domains and delivery dates.

AWS Certified Generative AI Developer – Professional (AIP-C01) represents a different kind of advanced implementation work. The relevant problems include model and service selection, grounding, orchestration, secure access to enterprise data, evaluation, latency and operational controls. A proof-of-concept chatbot can provide fluent responses without meeting production requirements for provenance, permission boundaries or reliability. A professional-level design must make those requirements explicit and evaluate whether the deployed solution actually satisfies them. For example, choosing the model layer in Amazon Bedrock involves measurable considerations beyond model popularity.

AWS Certified Machine Learning – Specialty belongs in a historical treatment of the portfolio. AWS retired that examination after March 31, 2026. Existing holders can retain an active certification until its normal expiration, but new candidates should not prepare to book the retired test. The current AI and ML routes have more specific role definitions than the retired specialty did. A new candidate who confuses an active certification held by someone else with a bookable examination could spend valuable preparation time on a retired syllabus.

Professional architecture and DevOps require operating judgment

Solutions Architect – Professional (SAP-C02) asks for systems-level judgment at greater organizational and technical complexity than the associate credential. Multi-account governance, hybrid connectivity, distributed reliability, migration, security and cost across teams shape a design. AWS has announced that SAP-C02 remains available through November 16, 2026. Registration for SAP-C03 opens October 27, with the replacement exam delivered from November 17. The new scope adds cloud-native, generative AI and agentic architecture, enhanced resilience engineering and post-quantum security concepts. SAP-C02 remains bookable for a limited period rather than being the default version for candidates whose exam date falls after November 16. Candidates need to align their booking and preparation with the dated AWS transition.

Recovery planning exposes the difference between nominal redundancy and proven resilience. Two Regions do not automatically guarantee availability when deployments share an identity or DNS dependency, fail to restore state inside the required interval or have never been exercised under load. Resilience and recovery design begins with recovery time objective and recovery point objective, then tests replication, failover routing, application restart and the consequences of partial recovery. An architect should explain the user-visible sequence of failure and restoration, not merely show duplicated resources on a diagram. These recovery concepts remain essential as the updated SAP-C03 blueprint broadens what architects are expected to design and defend.

DevOps Engineer – Professional (DOP-C02) emphasizes the reliability of software delivery and operations. Infrastructure as code, CI/CD, monitoring, incident response and deployment controls belong together because every production change creates a measurable risk. CI/CD deployment safeguards matter when they can detect faults, reduce blast radius, roll back safely and explain what actually changed. An organization with automated releases but inadequate observability has accelerated its exposure rather than controlled it.

There is a similar trap in infrastructure automation: a configuration template may represent the intended state while an emergency console change quietly creates drift. Infrastructure as code without configuration drift requires controlled reconciliation, reviewed changes and visibility into manual exceptions. A useful incident exercise asks what happens if a pipeline reverses an unrecorded security-group change during a recovery. A DevOps engineer needs to prevent that surprise or make it visible before a routine deployment turns into another outage.

An experienced platform engineer may approach DOP-C02 before SAP-C02; an enterprise architect may prefer the reverse. Neither order is a universal requirement. The two paths share concerns about automation, security and reliability, but their centers of gravity differ. DevOps concentrates on maintaining and improving delivery and operations; architecture concentrates on system and organizational design choices.

Security and networking specialties call for deeper domain expertise

Security – Specialty (SCS-C03) tests decisions about protecting workloads and data in AWS. IAM policy design, logging, network segmentation, encryption, incident handling and governance all matter. Least privilege requires tracing which identity can assume a role, which resource policy applies and how temporary credentials or permissions boundaries interact. AWS identity and excess-privilege control is therefore an authorization design problem, not a slogan. Defensible security work also checks whether a network route or cross-account policy permits unintended access that a single security-group review would miss.

Encryption protects data only within the threat model for which it was designed. AWS encryption and data protection must address key policy and recovery, permissions on plaintext access, secrets handling and audit evidence—not just whether a storage bucket has an encryption setting enabled. Similarly, network security across VPC boundaries can fail through routing, service endpoints or cross-account trust even where workloads appear to sit in private subnets. These are distinct technical relationships and should be tested independently rather than conflated with general 'secure cloud' advice.

Security reviews also depend on evidence. If a storage bucket was exposed or credentials were abused, an investigator needs trustworthy logs, consistent timestamps, configuration history and a way to preserve findings. Effective AWS threat detection and response connects these records to triage and containment decisions; producing a large quantity of logs does not itself establish that an incident was detected. The previous SCS-C02 version finished its testing window in 2025 and belongs in the history of the certification rather than a current 2026 preparation plan.

Advanced Networking – Specialty (ANS-C01) goes well beyond connecting a single VPC to the internet. Hybrid routing, segmentation, DNS, cross-account access, resiliency and complex connectivity depend on both network fundamentals and AWS-specific behavior. A design can appear redundant while return traffic follows an unintended path or a DNS dependency points users toward a failed component. Resilient AWS network architecture depends on the interaction of routing policies, health signals and operational tests, not the number of redundant links drawn on a diagram. AWS has announced December 31, 2026 as the final day to take ANS-C01; certifications earned before retirement retain their normal three-year validity, but this exam should no longer be described as an open-ended specialty route.

Both specialties build on hands-on investigation of real system behavior. A security engineer may know that AWS KMS manages keys without having handled cross-account key policies or a compromised role. A network specialist may recognize Amazon Route 53 without understanding how DNS routing policies, resolver caching and health checks affect failover. Those details determine whether a recovery plan works when endpoints or Regions are impaired. Networking and security certifications are most valuable when candidates can diagnose what actually happened, not merely name a service from a list.

How to select and prepare for the right AWS exam

An early-stage learner who needs cloud literacy may begin with Cloud Practitioner, while an AI-focused business role may prefer AI Practitioner or the separate business strategy credential. A software developer should compare the still-available DVA-C02 with the incoming DVA-C03; an operator should study SOA-C03; an architect can examine SAA-C03 or the time-limited SAP-C02 before SAP-C03 begins; a data engineer may choose DEA-C01. Advanced production work can justify DOP-C02, AIP-C01 or a specialty. These are not compulsory ladders. The selection should follow existing responsibilities, intended job decisions and the current AWS exam guide, especially during a period when several versions are changing.

Candidates should also distinguish exposure to a service from production capability. Knowing that S3 stores objects is not the same as designing a secure data lifecycle. Knowing Lambda supports event-driven workloads is not the same as handling retries safely. Knowing CloudWatch produces metrics is not the same as selecting signals that reveal business-impacting faults. Real case studies, controlled experiments and post-incident reviews make preparation more durable than lists of service names.

For an up-to-date plan, review AWS's official exam guide, in-scope services and delivery dates before studying. The current security, ML and AI examples show why that step matters. Let AWS's published program determine whether an exam version is current, transitioning or retired, even when older preparation material remains useful for understanding its technical subject. The most valuable certification is the one that reflects decisions the candidate can explain, defend and apply to a real workload—not simply the credential that appears next in an imagined sequence.