Passing the AWS Certified Cloud Practitioner is a huge win—congrats. It proves you understand the basics of cloud, AWS services, billing concepts, and the shared-responsibility model. But it’s also just the beginning.
This guide is your AWS Cloud Practitioner certification roadmap and next-step AWS learning path—with practical next certifications, hands-on labs you can actually do, and real portfolio projects you can showcase. We’ll keep it relaxed, but we’ll be thorough enough to help you choose the fastest path to real cloud confidence (and, ideally, job-ready skills) without wasting money.
If you want an easy follow-up read that complements what’s below, check out: AWS Cloud Practitioner Roadmap: From First Cloud Cert to Confident Cloud Practitioner. And if your goal is employability, this pairs well with: Beginner-Friendly AWS Learning Path: From Cloud Practitioner to Job-Ready Cloud Skills in One Year.
Where You Are Now: What Cloud Practitioner Actually Enables
Before you choose your next move, it helps to understand what you’ve already earned—and what you still need.
The Cloud Practitioner exam focuses on broad concepts:
- Cloud fundamentals (IaaS/PaaS/SaaS)
- AWS global infrastructure (regions, AZs, edge locations)
- Core services at a high level (EC2, S3, IAM, VPC basics)
- Billing and pricing (common cost drivers)
- Security and compliance basics (shared responsibility)
So you’re not expected to know every command-line flag or design a full VPC from scratch. Your next step should shift from “I can explain AWS” to “I can build on AWS safely and repeatedly.”
Think of it like this:
- Cloud Practitioner = cloud literacy
- Next certifications = cloud specialization + execution
- Labs + projects = proof you can do it
The Big Decision: Certifications vs. Projects (or Both)
Let’s address the elephant in the room: after Cloud Practitioner, you’ll see people sprint into certifications. Others say “just build stuff.” The truth is: the best path is usually a hybrid.
A practical rule of thumb
- Spend 30–50% of your effort on certification prep (structured learning + measurable milestones).
- Spend 50–70% of your effort on hands-on labs and portfolio projects (real experience + evidence).
Certifications help you stay focused. Projects help you stand out.
Next Certification Options: What to Choose and Why
AWS has a ladder of difficulty and specialization. You don’t need to climb every rung to succeed, but choosing intentionally will save you months.
Best first “next step” certifications after Cloud Practitioner
1) AWS Certified Solutions Architect – Associate (SAA-C03)
If you want the most universally useful credential, this is it.
Why it’s a strong next step
- Teaches you how to design secure, scalable AWS systems
- Covers core architecture patterns across services
- Strong market recognition for developers, sysadmins, and cloud engineers
What you’ll gain
- Better mental models for networks, compute, storage, and IAM
- Real design tradeoffs (cost, availability, reliability, security)
- Experience thinking in architecture diagrams and decisions
Who it’s best for
- People targeting cloud architect paths
- Developers who want infrastructure competence
- Anyone who wants to understand how AWS systems “fit together”
2) AWS Certified Developer – Associate (DVA-C02)
This is a good choice if you prefer application-focused work.
Why it’s useful
- Emphasizes building and deploying applications
- Includes serverless patterns and deployment practices
- Good alignment with modern cloud development
What you’ll gain
- Deep familiarity with Lambda, API Gateway, event sources
- IAM permissions for app access patterns
- Practical CI/CD and deployment thinking (depending on your prep approach)
3) AWS Certified SysOps Administrator – Associate (SOA-C02)
Choose this if operations and troubleshooting excite you.
Why it’s useful
- Focuses on operational best practices
- Covers monitoring, incident thinking, and lifecycle management
- Strong fit for people aiming at DevOps/SRE-adjacent roles
What you’ll gain
- Observability mindset (CloudWatch, logs, alarms)
- Backups, scaling, maintenance, and incident readiness
- Operational configuration patterns
A lightweight alternative: “Specialty-style” learning without specialty certs
Specialty certs can be valuable, but they’re usually not the fastest path immediately after Cloud Practitioner. If you’re building momentum, start with the Associate-tier pathway first.
That said, you can still “study like a specialist” by doing labs in one domain at a time:
- Security (IAM, KMS, CloudTrail, least privilege)
- Networking (VPC, subnets, route tables, NAT/IGW)
- Storage (S3 lifecycle, encryption, replication)
- Serverless (API Gateway + Lambda + DynamoDB)
How to Pick Your Certification Path (Fast Self-Assessment)
Use this quick decision filter. Don’t overthink it—choose what aligns with your interests and your career target.
| Your current vibe | Best next certification | Why |
|---|---|---|
| I like designing systems | SAA-C03 | Architecture foundations + AWS service integration |
| I like building apps | DVA-C02 | Lambda/serverless + app deployment patterns |
| I like running and maintaining systems | SOA-C02 | Monitoring, operations, and reliability practices |
| I’m unsure | SAA-C03 | Broadest “center of gravity” for cloud careers |
If you’re unsure, SAA-C03 is usually the “default smart start” because it teaches you architecture decisions that influence everything else.
What to Study Next (Even Before You Pick a Cert)
Your Cloud Practitioner knowledge gives you context, but the next certifications require more depth. Before you commit, make sure you shore up these categories.
The “minimum viable skill stack” after Cloud Practitioner
Core services you must get hands-on with
- IAM (users, roles, policies, groups, permissions boundaries conceptually)
- S3 (storage classes, encryption, lifecycle rules)
- EC2 (instances, security groups vs NACLs, AMIs conceptually)
- VPC (subnets, route tables, internet/NAT gateways)
- CloudWatch (metrics, logs, alarms)
- Networking basics (DNS, routing, public vs private patterns)
Security and governance basics
- Shared responsibility applied to real decisions
- Encryption expectations (server-side, KMS basics)
- Logging and auditing with CloudTrail (what you log and why)
Deployment and operations mindset
- Environments and configurations
- Monitoring and incident awareness
- Cost awareness as part of architecture
If any of these feels fuzzy, labs will fix it faster than passive reading.
Hands-On Labs: The Skill Multiplier (No Fluff)
Labs are where AWS goes from “interesting” to “I can actually do this.”
You want labs that provide:
- Guided steps
- Immediate feedback
- A clear “done” state
- Opportunities to revisit concepts (like IAM permissions) repeatedly
Lab approach that works (especially on a budget)
Use a “3-pass” method:
- Pass 1 (Setup + Basic Build): Follow instructions and deploy.
- Pass 2 (Fix + Harden): Break something intentionally (or check security/cost) and fix it.
- Pass 3 (Improve + Document): Add monitoring, logging, and a short README explaining your design choices.
This is how you turn labs into portfolio material.
Budget-Friendly Lab Starter Kit (What to Build First)
Below are beginner-friendly lab projects that align with typical certification objectives. They also produce artifacts you can show in a portfolio.
1) Secure S3 Bucket with Lifecycle and Notifications
Goal: Learn S3 fundamentals + real security hygiene.
Skills you build:
- Bucket policies, IAM role access patterns
- Encryption configuration
- Lifecycle rules (move to infrequent access, expire objects)
- Event notifications (basic trigger patterns)
Portfolio-ready deliverables
- A short diagram: S3 + IAM policy flow
- Screenshot of bucket encryption and lifecycle settings
- A README: what you protected and why
What to improve
- Add least-privilege IAM permissions (no “*”)
- Turn on access logging or integrate CloudTrail event observation
2) EC2 + Web Server in a VPC (Public Subnet + Security Group)
Goal: Build a simple, secure compute environment.
Skills you build:
- VPC basics: subnet types and routing
- Security group rules (ingress/egress)
- Instance access patterns (SSH concepts)
- Basic scaling thinking (even if you don’t scale yet)
Portfolio-ready deliverables
- A VPC diagram (public subnet, route to internet)
- EC2 deployment walkthrough notes
- Security group screenshots with explanation
Hardening ideas
- Restrict inbound rules to your IP (when possible)
- Add CloudWatch monitoring for CPU and network metrics
3) CloudWatch Logs + Alarms for “Something Actually Useful”
Goal: Monitor an application and alert on meaningful events.
Skills you build:
- Logs aggregation
- Metrics and alarms
- Alarm actions conceptually
Portfolio-ready deliverables
- Screenshots of dashboards and alarms
- A “response plan” section in README (“if alarm triggers, then do X”)
Make it real
- Trigger a test condition (like increasing load or logging a specific pattern)
- Show how you’d interpret the alarm
4) Serverless “Hello World” That Grows into a Mini App
Start tiny, then expand:
- Lambda function
- API Gateway
- DynamoDB (optional but great for portfolio depth)
Skills you build
- IAM role permissions for Lambda
- Event-driven architecture concepts
- Request/response shaping
- DynamoDB access patterns (basic key-value style first)
Portfolio-ready deliverables
- API endpoint screenshot and sample request/response
- IAM role policy explanation
- A short write-up of why serverless was a good fit
Hardening ideas
- Add logging and log retention
- Add throttling or input validation
- Add structured errors (status codes, response schemas)
5) Infrastructure-as-Code (IaC) with Terraform or CloudFormation
This is where you level up fast.
Why it matters
- Certifications increasingly assume you understand infrastructure setup concepts
- Hiring managers love repeatability and clean configuration
Portfolio-ready deliverables
- Git repo with IaC templates
- “How to deploy” steps
- Cost notes and cleanup instructions
Minimal viable target
- Provision: VPC + S3 + IAM role + Lambda or EC2 basics
- Then destroy everything and document how you avoided surprise bills
Real Portfolio Projects: Examples You Can Copy (Conceptually)
A portfolio isn’t just a certificate list. It’s proof that you can build and explain.
Your portfolio should include:
- Problem statement
- Architecture diagram (even a simple one)
- Implementation steps
- Security and cost considerations
- Monitoring and operational thoughts
- Links to code/repos and documentation
Portfolio Project 1: “Secure Image Upload Service” (S3 + Lambda + API Gateway)
What it does
- A user uploads an image
- The system stores it in S3
- Lambda processes it (resize/validate metadata conceptually)
- API Gateway returns status and metadata
Architecture sketch
- API Gateway → Lambda → S3 (store)
- Lambda (or event) → processing steps
- CloudWatch logs + alerts
Core AWS concepts
- S3 event notifications
- IAM least privilege between services
- Encryption expectations
- Observability with CloudWatch
What to show
- Screenshot of S3 bucket settings (encryption + lifecycle)
- Example API request and response
- CloudWatch log entries for processing
How it helps your certification
- Builds intuition for event-driven workflows (often emphasized later in Dev and SysOps cert learning)
Portfolio Project 2: “Budget-Friendly Web App” with EC2 + CloudWatch + Auto Scaling (Lightweight)
Even if you keep it simple, the goal is to show:
- Networking basics
- Monitoring
- A path to scaling
What it does
- A basic website hosted via EC2 (or container conceptually)
- CloudWatch metrics monitor performance
- Optional: Auto Scaling group or scaling policy
Core AWS concepts
- VPC/subnets and security group configuration
- CloudWatch alarms and dashboards
- Cost awareness (instance sizing and scaling triggers)
What to show
- Diagram of public vs private approach
- Alarms: CPU thresholds and what you’d do next
- A cost section: instance type reasoning and estimated spend
Portfolio Project 3: “Event-Driven Order Processing” (SQS + Lambda + DynamoDB)
This project is popular because it demonstrates real cloud design thinking.
What it does
- Accepts “order events”
- Uses a queue to decouple processing
- Lambda processes orders and stores results in DynamoDB
Core AWS concepts
- Asynchronous workflows
- IAM permissions for Lambda with SQS and DynamoDB
- Error handling and retries thinking
What to show
- Flow diagram: event → queue → worker → datastore
- CloudWatch metrics for queue depth or processing failures
- README: tradeoffs (why asynchronous improves reliability)
Portfolio Project 4: “VPC Security Hardening Lab” (IAM + VPC + Logging)
This one is great if you’re aiming for security-minded roles or want to stand out.
What it does
- Sets up a VPC with public/private subnets
- Locks down access using security groups
- Enables logging where appropriate
Core AWS concepts
- Route tables and subnet intent
- Least-privilege access with IAM roles
- Observability via CloudWatch logs and auditing mindset
What to show
- Screenshot of VPC configuration
- Explanation: why each security decision exists
- A “threat scenarios” section: what you prevented and how you’d detect issues
Hands-On + Certification: How to Map Labs to Exam Objectives
A common mistake is doing random labs that don’t align to what you’re studying. Instead, connect each lab to a certification theme.
If you choose SAA (Solutions Architect Associate)
Your labs should emphasize:
- Designing multi-service patterns
- IAM and security integration
- VPC networking choices
- Storage strategies and encryption
- Monitoring considerations in architectures
If you choose DVA (Developer Associate)
Your labs should emphasize:
- Lambda + API patterns
- Permissions and secure access
- Deployment thinking (even if basic)
- Troubleshooting and logging
If you choose SOA (SysOps Associate)
Your labs should emphasize:
- Monitoring/alarms
- Operational lifecycle
- Incident response logic
- Backups and recovery concepts (light, but real)
Realistic Study Schedules (Budget, Motivation, and Momentum)
Let’s talk strategy. Many people stall because they study too long without producing evidence.
Example 8-week plan (common and doable)
This is designed for people who already passed Cloud Practitioner and want a strong start.
Weeks 1–2: Core AWS service deepening
- IAM practice (roles/policies)
- S3 encryption + lifecycle + access
- CloudWatch logs + dashboards
Weeks 3–4: One architecture track
Pick one:
- EC2 + VPC hardening
- Or serverless API + Lambda
- Or SQS + Lambda processing
Weeks 5–6: Exam alignment
- Map your lab work to what you’re studying
- Start practice questions
- Identify weak areas and fix them through targeted labs
Weeks 7–8: Portfolio packaging
- Convert labs into a clean GitHub repo + README
- Add diagrams and decision notes
- Do a final exam round or mock tests
The trick: your portfolio is the output of your study, not separate from it.
What to Include in Your Portfolio (So It Actually Gets Clicks)
Hiring managers and recruiters don’t have time to guess what you did. Make it obvious.
Portfolio structure that consistently performs
- Project title + outcome (1 sentence)
- Problem statement (what you built and why)
- Architecture diagram
- Step-by-step build summary
- Security notes (IAM least privilege, encryption, logging)
- Cost considerations (what might cost money, how you control it)
- Monitoring (CloudWatch metrics/logs)
- How to deploy and how to clean up
- Screenshots or short demo GIFs
- Repo link (clean structure, tags, releases if possible)
Keep explanations short but specific. Use bold text for important decisions.
Cost Awareness: How to Avoid “Oops, My Lab Burned My Budget”
A lot of beginners get discouraged by AWS costs—not because AWS is expensive, but because they forget cleanup and spend on always-on resources.
Cost controls that matter (and are easy)
- Set a budget alert in AWS Billing
- Use free tier where appropriate
- Use smaller instance sizes for labs
- Always plan a cleanup step
- Delete temporary logs, snapshots, and unused volumes
- Prefer serverless for bursty workloads (when it fits the use case)
Practical habit
At the end of every lab session:
- confirm resources are deleted
- confirm logs retention policies are set reasonably
- document what you cleaned up (future you will thank you)
Hands-On Labs Where You Can Go Deeper (and Still Stay Budget-Friendly)
You don’t need expensive courses to learn effectively. What you need is structure and feedback.
Lab categories to prioritize next
- Security and IAM labs (least privilege, role-based access patterns)
- Networking labs (VPC/subnets/routing/NACL vs security groups)
- Storage labs (S3 lifecycle, encryption, bucket policies)
- Compute labs (EC2 basics, scaling concepts)
- Observability labs (CloudWatch logs/alarms)
- Serverless labs (Lambda + event sources + API)
If you’re following a structured learning path, your next certifications will stop feeling random.
Common Mistakes After Cloud Practitioner (And How to Avoid Them)
Here are the most common ways people lose time after passing the Cloud Practitioner exam.
Mistake 1: Moving straight into the next cert without labs
Reading and practice questions help, but AWS skills are built by doing. Without labs, you’ll struggle to remember how services integrate.
Fix: Do at least one end-to-end project before starting heavy exam prep.
Mistake 2: Only building, never documenting
Projects without documentation don’t show competency.
Fix: For every lab, write a short README:
- what you built
- what you learned
- what you would do differently
Mistake 3: Ignoring IAM and security
Many beginners build working systems but fail to secure them properly. This will hurt you in real environments and often appears in interview questions.
Fix: Treat IAM as a first-class skill, not an afterthought.
Mistake 4: Not thinking about cost and cleanup
Cloud learning can become expensive quickly.
Fix: Build cleanup into your routine, and document cost controls.
Expert Insights: How People Get From “Passed” to “Hired”
If you want a career outcome, your learning plan should produce signals recruiters recognize.
Signals that hiring managers look for
- A clear progression (Cloud Practitioner → Associate cert or equivalent)
- Evidence of hands-on work (repos, diagrams, deployment instructions)
- Security awareness (IAM, encryption, logging)
- Operational thinking (monitoring, troubleshooting)
- Communication (short explanations of design decisions)
What to do if you’re targeting your first cloud job
- Choose SAA if you want architecture credibility.
- Build 2–3 portfolio projects with different service patterns.
- Do practice interviews focusing on architecture tradeoffs and security.
If you want a roadmap that’s designed for momentum and job readiness, revisit: Beginner-Friendly AWS Learning Path: From Cloud Practitioner to Job-Ready Cloud Skills in One Year.
A “Choose Your Path” Plan (3 Tracks)
Pick one track based on your goal. You can always switch later.
Track A: Architect Track (Fastest to broad market value)
- Cert: SAA-C03
- Labs: VPC + S3 + EC2 + CloudWatch
- Portfolio: 2 projects (one serverless, one VPC/EC2)
Outcome: broad architecture credibility + strong interview performance.
Track B: Developer Track (Best if you like building apps)
- Cert: DVA-C02
- Labs: Lambda + API Gateway + DynamoDB
- Portfolio: 2–3 projects (serverless workflows + API endpoints)
Outcome: strong alignment with modern cloud development roles.
Track C: Ops/DevOps Track (Best if you like reliability and monitoring)
- Cert: SOA-C02
- Labs: CloudWatch, alarms, operational patterns
- Portfolio: 2 projects with monitoring + “runbook” docs
Outcome: clear operational competency and troubleshooting capability.
How to Keep Learning After Your Next Certification (Yes, beyond that)
Passing the next certification is not the finish line. It’s validation that you can study and understand AWS deeply enough to pass an exam.
To keep advancing:
- Create a monthly “cloud build sprint”
- Add one new service pattern every month
- Improve your portfolio with better documentation
- Practice incident thinking (“what would break?” “how would I detect it?”)
If you want a longer-term view that matches the spirit of this roadmap, use this as a guiding framework: AWS Cloud Practitioner Roadmap: From First Cloud Cert to Confident Cloud Practitioner.
Frequently Asked Questions (Practical and Honest)
Should I get SAA, DVA, or SOA after Cloud Practitioner?
If you want the broadest credential and strongest general market value, choose SAA-C03. If you love building applications, DVA-C02 fits better. If you’re more operations-focused, SOA-C02 is ideal.
How many portfolio projects should I build?
Aim for 2–3 strong portfolio projects rather than many small ones. Each project should have:
- documentation
- diagrams
- security notes
- monitoring
- cleanup instructions
Can I skip certification and just build?
You can, but certifications often accelerate structured learning and improve credibility. The best approach for most people is “build while you study.”
How long should it take to prepare for an Associate cert?
Common prep ranges from 6–12 weeks depending on your weekly time, lab experience, and comfort with exam-style questions.
Your Next 14 Days: A Simple, Effective Starting Plan
If you’re ready to act today, here’s a focused mini-plan.
Day 1–3: IAM + S3 fundamentals
- Create an S3 bucket
- Configure encryption
- Create an IAM role for least-privilege access
- Enable logging or verify access via audit events
Day 4–7: CloudWatch monitoring
- Deploy a simple service (EC2 or Lambda)
- Send logs to CloudWatch
- Create one alarm (for a metric you can trigger)
Day 8–10: VPC basics (if your target is SAA)
- Create a VPC with public subnet
- Deploy an EC2 instance
- Restrict security groups and validate connectivity
Day 11–14: Portfolio packaging
- Write a README for Project #1
- Add a diagram
- Screenshot the key settings
- Clean up resources and document cleanup steps
This turns your learning into an artifact you can share.
Final Takeaway: Your Next Step Is Evidence
After AWS Cloud Practitioner, the biggest upgrade isn’t memorizing more services—it’s building real systems and documenting your decisions clearly.
Your roadmap should include:
- One strong next certification (usually SAA if you’re unsure)
- Hands-on labs that harden your security and architecture instincts
- Real portfolio projects that prove you can deploy, monitor, and explain AWS systems
If you follow the hybrid approach—structured cert prep plus evidence-driven labs—you’ll stop feeling stuck and start building momentum that’s visible to recruiters, hiring managers, and future teammates.
Good luck—and if you tell me your target (Architect vs Developer vs SysOps) and how many hours per week you can study, I can suggest a tailored 6–10 week plan and project list.
