Which Cert Comes After AWS Solutions Architect Associate?
Quick answer: Choose by the job you want next, not by what is trending. Going deeper in cloud engineering points to Developer Associate or CloudOps Engineer Associate; architecture points to Solutions Architect Professional after a year of hands-on work; DevOps points to Terraform Associate then DevOps Engineer Professional; security points to the AWS Security Specialty. PMP only makes sense if you will actually manage projects.↗ Share on X
The right certification after AWS Solutions Architect Associate depends on one question: what job do you want in 12 months? If the answer is "build things in the cloud," take Developer Associate. If it is "run and troubleshoot production," take CloudOps Engineer Associate. If it is "design big systems," wait until you have a year of real AWS work and then take Solutions Architect Professional. If it is "automate everything," do Terraform Associate first and DevOps Engineer Professional second. If it is "security," go straight to the AWS Security Specialty. And if nobody is asking you to manage projects, do not take the PMP just because it is famous.
That is the decision. Below is the reasoning, the details of each path, and a way to pick in ten minutes.
First: do not collect certifications
PMP Wrong Answers: A Review Routine That Raises Your Score →
How to Memorize AWS Architecture Diagrams Fast Without Drawing →
PMP Study Tracker: Free Google Sheets Setup in One Hour →The most common mistake after passing SAA is to immediately book the next AWS exam because the momentum feels good. Six months later you have four associate-level badges, no project you can talk about, and interviewers asking "so what did you build?"
A certification opens a door. Hands-on work is what you say once you walk through it. The best sequence is almost always: one cert, three to six months of using it on real or practice projects, then the next cert that the work pointed you toward. Every path below assumes you are doing something with your hands between exams.
Level up — free guides in your inbox
The five paths at a glance
| If you want this job | Next exam | Level | Rough exam fee (USD) | Typical study time with SAA done |
|---|---|---|---|---|
| Cloud or backend engineer | AWS Developer Associate | Associate | $150 | 4 to 8 weeks |
| Cloud operations, SRE, support | AWS CloudOps Engineer Associate | Associate | $150 | 6 to 10 weeks |
| Cloud architect | AWS Solutions Architect Professional | Professional | $300 | 3 to 5 months, after 1+ year hands-on |
| DevOps or platform engineer | HashiCorp Terraform Associate, then AWS DevOps Engineer Professional | Associate then Professional | about $70, then $300 | 3 to 4 weeks, then 3 to 4 months |
| Cloud security | AWS Security Specialty | Specialty | $300 | 2 to 4 months |
Fees change, so confirm on the vendor's site before you pay. Study times assume you already hold SAA and can give it around 6 to 8 hours a week.
Path 1: Developer Associate, for builders
Tech Cert Roadmap for Full-Time Workers: A 12-Week Plan →
How to Explain Cloud Certification Gaps in Interviews →
AWS Exam Questions: Read Them Fast and Cut Wrong Answers →This exam is about writing and deploying code on AWS: Lambda, API Gateway, DynamoDB, SQS, the SDKs, CI/CD with CodePipeline. If your day job is or will be writing applications, this is the natural second step and it overlaps heavily with what you already studied.
Who it is for: developers, backend engineers, anyone who wants "cloud" on a software résumé.
Who should skip it: if you do not write code and do not plan to, the exam will feel abstract and the badge will not change your interviews.
What to build between exams: a small serverless application with an API, a database and a deployment pipeline. Put it on GitHub. That one project will carry more interviews than the certificate.
Path 2: CloudOps Associate, for operations
This is the operations exam. It replaced the older SysOps Administrator exam and covers monitoring, logging, cost control, networking troubleshooting, backups and automation with CloudFormation and Systems Manager. It is widely considered the hardest of the associate exams because it tests whether you have actually touched the console under pressure.
Who it is for: support engineers moving to cloud, system administrators, anyone aiming at an SRE or cloud operations role.
What to build: a monitored environment with alarms, a dashboard, automated patching and a documented incident runbook. Break something on purpose and fix it.
Path 3: Architect Professional, but not yet
This is the most prestigious AWS exam and the one people most often take too early. It assumes you have designed and operated real systems: multi-account setups, migrations, hybrid networking, disaster recovery with actual recovery time targets. The questions are long scenarios with four plausible answers.
The honest rule: do not book it until you have at least a year of hands-on AWS work, or you will memorize patterns you cannot defend in an interview. If you are set on architecture but do not have that year yet, take Developer Associate or CloudOps first and get the experience through work or serious side projects.
Who it is for: people who already lead design discussions, or senior engineers moving to an architect title.
Path 4: Terraform, then DevOps Professional
DevOps roles live and die on infrastructure as code, and Terraform is the tool most job postings name. The HashiCorp Terraform Associate exam is short, cheap and practical: state, modules, providers, workspaces. Three to four weeks of study with SAA behind you.
After Terraform, the AWS DevOps Engineer Professional exam covers pipelines, deployment strategies, monitoring and governance at scale. It is a professional-level exam and deserves the same "have real experience first" warning as the architect one.
A side note on Kubernetes: if the job postings you want mention it, the Certified Kubernetes Administrator is worth putting ahead of the DevOps Professional. It is a hands-on, terminal-based exam, which many employers trust more than multiple choice.
What to build: a Terraform repo that stands up a full environment from zero, with a pipeline that runs plan and apply on every change.
Path 5: Security Specialty, for defenders
The AWS Security Specialty covers identity and access, encryption and key management, logging, incident response and network protection. Security roles pay well and are short of qualified people, but the exam assumes you understand the services deeply, not just the vocabulary.
Who it is for: anyone already drawn to IAM policies, anyone in a compliance-heavy industry, anyone who wants a path to a cloud security engineer title.
What to build: take an existing project and harden it. Least-privilege roles, encrypted everything, centralized logging, an alert that fires on a suspicious action. Document each change and why.
What about PMP?
The Project Management Professional certification is not a technical cert and does not stack on SAA in any way. It is valuable for exactly one group: people who are, or are about to be, managing projects with budgets, timelines and other people's work. It also requires documented project management experience before you can even sit the exam, so it is not a quick add.
If your manager has told you a project lead role is coming, PMP is a good next step and a different article. If not, it will not move a cloud engineering career.
Other AWS exams and when they fit
- Data Engineer Associate: if you work with pipelines, data lakes, Glue, Redshift. Good second cert for data-leaning people.
- Machine Learning Engineer Associate: only if you are already doing ML work. The exam assumes modeling knowledge.
- AI Practitioner: foundational, below SAA. Not a step forward for you.
- Advanced Networking Specialty: for network engineers moving to cloud. Narrow but highly paid.
Pick your path in ten minutes
1. Open three job postings for the role you want in a year. Real ones, in your city or remote.
2. Write down every certification and tool they mention. Count them.
3. The certification that appears most is your next exam. The tool that appears most is your next project.
4. If nothing appears more than once, choose Developer Associate if you code and CloudOps if you do not.
5. Book the exam date now, eight weeks out. An unbooked exam is a wish, not a plan.
Keep SAA alive
AWS certifications expire after three years. Passing a higher-level AWS exam renews the lower ones, so earning Solutions Architect Professional later also renews your Associate. Put the expiry date in your calendar today with a reminder six months before.
Your next step this week
Do the ten-minute job-posting exercise above tonight. Tomorrow, book the exam it points to and start the matching project the same day, even if it is just creating the repository. By the time the exam date arrives, you will have both the badge and the thing to talk about when they ask what you built with it.
FAQ
Should I take Solutions Architect Professional right after the Associate?
Usually not. The Professional exam assumes a year or more of real AWS design work. Most people do better taking Developer Associate or CloudOps first, gaining hands-on experience, and then attempting the Professional.
Is Terraform Associate worth it if I already have AWS certifications?
Yes, for DevOps and platform roles. Terraform appears in most infrastructure job postings, the exam is short and inexpensive, and it proves a skill that AWS exams do not test directly.
Does PMP help a cloud engineering career?
Only if you will manage projects. PMP is a management certification with its own experience requirements. For engineering, architecture or DevOps roles, a technical certification plus a real project is far more useful.