Skip to main content

The AWS certification path in 2026, the order that actually works

There is no single "AWS certification path." There are six of them, one per role family, and the order that works depends on what you're trying to do for a living. Most posted paths get this wrong by treating the cert ladder like a video game tech tree where you have to climb every rung. You don't. Below is the honest 2026 sequence, broken out by role, with the certs to skip and the certs to stack.

The map​

AWS publishes 12 active certifications in 2026. They group into four tiers:

Trying to chase every box on this list is a rookie mistake. The right move is to pick the role family you want, then run a depth-first sequence through it. Stop when the next cert no longer buys you a salary or job-access bump.

Path 1, the cloud generalist​

You're early career, you want a broad cloud skill set, you're not yet sure if your destiny is architect, engineer, or DevOps.

  1. CLF-C02. Two to four weeks of study. Skip only if you've worked hands-on in AWS for six months or more.
  2. SAA-C03. The single highest-leverage AWS cert in 2026. It opens cloud engineer, junior architect, and platform roles. See the SAA-C03 study time article for honest hours estimates.
  3. Stop here for at least 12 months. Get the cert work-tested. Real production experience, including the kind where things break at 2am, is what unlocks the value of the next tier.

After a year of work, branch into Path 2, 3, or 4 below depending on what your role has become.

Path 2, the solutions architect​

You design systems. You sit in design reviews. Your job title contains the word "architect."

  1. SAA-C03 (associate).
  2. SAP-C02 (professional). The hardest single AWS exam in 2026 and the highest-paying. 173 thousand US dollar median in 2026, often higher in finance and healthcare verticals. Plan for 150 to 200 hours of prep on top of associate fluency.
  3. Optionally, layer one Specialty. SCS-C02 if your work touches compliance or financial services. Advanced Networking if you're in a hybrid-cloud or telco environment.

Skipping the SOA-C02 and DVA-C02 in this path is correct. Architects do not need them.

Path 3, the developer​

You write the code that runs in AWS. Lambda, ECS, EKS, API Gateway, DynamoDB, the application layer.

  1. CLF-C02, optional. Most working developers can skip it.
  2. DVA-C02. Tests Lambda, DynamoDB, API Gateway, Cognito, KMS, X-Ray, and the AWS SDKs. The strongest AWS cert for backend engineers in cloud-native shops. Roadmap.
  3. DOP-C02 (DevOps Professional) if you also own deployment pipelines, IaC, and observability. 159 thousand US dollar median in 2026. Roadmap.

DOP-C02 has SAA-C03 and DVA-C02 as informal prerequisites. The exam expects fluency at both associate levels. It's the second-most-difficult AWS exam after SAP-C02 and the right destination for senior platform engineers and SREs.

Path 4, the operations or sysops engineer​

You run the infrastructure. You're on call. You debug other people's terraform.

  1. CLF-C02, optional.
  2. SOA-C02. The most operational of the three associates: CloudWatch, Systems Manager, Trusted Advisor, Service Quotas, AWS Config, AWS Backup. Roadmap.
  3. DOP-C02.

SOA-C02 is the weakest standalone cert in the AWS catalog in 2026. Hiring managers value SAA-C03 more even for ops roles. Take SOA-C02 only if your specific job demands it or you're stacking toward DOP-C02.

Path 5, the security engineer​

You own AWS security posture. Your role is in a SOC, GRC team, or platform-security org.

  1. SAA-C03. You need architecture context to design secure systems.
  2. SCS-C02 (Security Specialty). Tests IAM at depth, KMS, GuardDuty, Inspector, Macie, AWS Config, Security Hub, incident response, identity federation, encryption at rest and in transit. 151 thousand US dollar median in 2026. Roadmap.
  3. Layer a non-AWS security cert. CISSP if you have five years of experience, Security+ if you don't. The combo of SCS-C02 plus CISSP is one of the strongest cloud-security profiles you can hold in 2026.

The cybersecurity-specific cert sequencing is in the cybersecurity certification roadmap.

Path 6, the ML engineer​

You build ML systems on AWS. SageMaker, Bedrock, model deployment, ML Ops.

  1. SAA-C03 for cloud architecture context.
  2. MLS-C01 (Machine Learning Specialty). Heavy on SageMaker, feature engineering, model selection, deployment patterns. 145 thousand US dollar median in 2026. Roadmap.

If you came from a data science background and AWS is new to you, do CLF-C02 first to learn the vocabulary, then SAA-C03, then MLS-C01. If you came from cloud and ML is new, the order above is fine, but plan for additional ML-fundamentals study outside the cert blueprint.

Costs to budget​

US 2026 voucher prices, before any discount programs:

TierExam fee
Foundational (CLF-C02)$100
Associate (SAA, DVA, SOA)$150
Professional (SAP, DOP)$300
Specialty (SCS, MLS, etc.)$300

Total for a full architect path (CLF + SAA + SAP + SCS) is $850 in raw exam fees, before prep materials. Most US employers reimburse. Many AWS retake vouchers and discount codes circulate through AWS re:Invent, Skill Builder Practice Exams, and AWS Partner programs.

What to skip​

A few common time-sinks worth flagging:

  • All three associates as a stack. Unless your employer explicitly pays per cert, taking SAA + DVA + SOA back to back is overkill. Pick one and move up the tier.
  • SOA-C02 as a first cert. The weakest entry point. SAA-C03 is more valuable in every market.
  • Specialty before Associate. The Specialty exams assume Associate-level fluency. Skipping the Associate to chase a Specialty produces a brittle pass that doesn't transfer to your actual job.
  • Renewal exams when a higher exam is on your roadmap anyway. Passing SAP-C02 renews SAA-C03. Don't take the same exam again if you're about to take its parent.

Pacing the whole arc​

The honest year-by-year timeline for someone working full-time:

  • Months 0 to 2: CLF-C02.
  • Months 3 to 8: SAA-C03.
  • Months 9 to 18: Real work experience. Optionally a second Associate (DVA or SOA) if you're staying generalist.
  • Months 18 to 30: A Professional (SAP-C02 or DOP-C02).
  • Months 30+: A Specialty if it matches your role.

The candidates who finish the full arc fastest are the ones who don't try to compress it. Cert prep without working experience between exams produces a thin profile. The certs are accelerators, not substitutes.

Common questions​

Should I get all 12 AWS certs?​

No. Holding all 12 in 2026 is a hobbyist signal, not a career signal. Hiring managers value depth in your role family more than breadth across families. Three certs in the right order beat seven in the wrong order.

Can I skip CLF-C02?​

If you have six months of hands-on AWS experience, yes. If you're new to cloud, no. The CLF-C02 vocabulary is the foundation the SAA-C03 assumes you already have. Skipping it without that experience is the most common reason candidates fail SAA-C03 on a first attempt.

How do I pick between SAP-C02 and DOP-C02?​

Job title test. If you're an architect who designs systems, SAP-C02. If you're a senior platform engineer or SRE who owns deployment, DOP-C02. They overlap, but each is built around a different daily reality.

What about AWS re/Start, AWS Educate, Cloud Quest?​

Useful free supplements. None of them replace exam-targeted prep. AWS Skill Builder is the official course platform. ARIA pairs with whichever course material you're using; the chatbot vs adaptive tutor article covers why.

Pick your path, then run a diagnostic​

Decide your role family first. Then run the free CAT evaluation for the next cert in your sequence. Fifteen minutes, four per-domain skill estimates, a phased roadmap that matches your real starting level. Doing this before booking an exam date is the cheapest correction you can make to a multi-month plan. Skipping the diagnostic is the most expensive.