AWS Interview Questions

You avoid the upfront cost and lead time of buying physical hardware, you can scale resources up or down quickly based on actual demand, and AWS handles the underlying physical infrastructure, power, cooling, hardware failures, so you can focus on your own application instead.

A Region is a genuinely separate geographic area, like us-east-1, containing multiple Availability Zones. An Availability Zone is one or more genuinely distinct data centers within that region, with independent power and networking, so a failure in one Availability Zone doesn't take down another one in the same region.

IaaS (Infrastructure as a Service) provides raw computing resources, like EC2, where you manage the operating system yourself. PaaS (Platform as a Service) provides a managed environment to run your own code without managing the underlying servers, like Elastic Beanstalk. SaaS (Software as a Service) provides a genuinely complete, ready-to-use application, like Gmail.

The Management Console is the web-based graphical interface for actually managing AWS resources. Beyond that, the AWS CLI lets you manage resources from the command line, and the AWS SDK lets your own application code interact with AWS services directly, both genuinely useful for automating tasks the console alone would require doing manually.

The Free Tier lets a genuinely new AWS account use a limited amount of many services at no cost, typically for the first 12 months, letting someone actually learn and experiment with AWS services without incurring real charges, as long as usage genuinely stays within the specified limits.

EC2 (Elastic Compute Cloud) provides genuinely resizable virtual servers, called instances, in the cloud. It's one of the most fundamental AWS services, letting you actually run an application on a virtual machine without owning or managing any actual physical hardware yourself.

An instance type defines the actual amount of CPU, memory, and network capacity an EC2 instance gets, like t3.micro or m5.large. Different types exist because genuinely different workloads have different needs, a memory-intensive database needs a genuinely different balance of resources than a compute-intensive video encoding job.

An AMI is a genuine template containing the information needed to actually launch an EC2 instance, including the operating system and any pre-installed software. You can use an AWS-provided AMI, a genuinely community-shared one, or create your own custom AMI from an existing, already-configured instance.

Stopping an instance genuinely shuts it down but preserves its attached storage, letting you restart it later with the exact same data intact. Terminating an instance genuinely, permanently deletes it, and any data on its default root storage is genuinely lost unless it was explicitly configured to persist separately.

A key pair consists of a genuine public key AWS stores on the instance and a genuine private key you download and keep yourself, used to securely authenticate when connecting to a Linux instance via SSH, rather than relying on a genuinely simple, less secure password.

On-Demand pricing charges by the hour or second with no genuine long-term commitment. Reserved Instances offer a genuinely significant discount in exchange for a one or three-year commitment. Spot Instances offer the genuinely deepest discount by using AWS's own spare capacity, but can be reclaimed by AWS with genuinely short notice.

S3 (Simple Storage Service) is an object storage service letting you actually store and retrieve any amount of data, files, images, backups, from anywhere, accessed through a genuinely simple web-based API rather than a traditional file system.

A bucket is the genuinely top-level container for objects stored in S3. Bucket names must genuinely be unique across all of AWS, beyond just within your own account, since S3 bucket names are used as part of a genuinely globally accessible URL.

S3 Standard is for genuinely frequently accessed data. S3 Infrequent Access costs less for storage but more per retrieval, fitting data accessed genuinely less often. S3 Glacier offers genuinely much cheaper storage for long-term archival, with a genuinely longer retrieval time. Different classes exist to let you balance storage cost against retrieval speed and cost based on how the data is genuinely actually used.

Bucket policies define genuine access rules at the bucket level, IAM policies control what a genuinely specific user or role is allowed to do, and Access Control Lists (ACLs) can genuinely grant access at the individual object level, though bucket policies and IAM are now the more genuinely commonly recommended approach.

Versioning keeps genuinely every version of an object whenever it's overwritten or deleted, rather than only keeping the genuinely most recent one. It solves the problem of genuinely accidental deletion or an unwanted overwrite, letting you recover a genuinely previous version of an object rather than losing it permanently.

S3 stores data as genuinely independent objects, accessed over the network through an API, well suited for files and backups. EBS provides genuinely block-level storage attached directly to a single EC2 instance, behaving like a genuine hard drive that instance's own operating system can directly read and write to.

IAM manages genuine access to AWS resources, letting you create users, groups, and roles, and define genuinely precisely what each one is allowed to actually do within your AWS account, following the principle of least privilege.

An IAM user represents a genuinely specific person or application with its own long-term credentials. An IAM role doesn't have genuinely permanent credentials of its own, and is instead genuinely assumed temporarily by a user, an application, or an AWS service, like an EC2 instance needing genuinely temporary access to S3.

An IAM policy is a genuinely JSON document defining specific permissions, which actions are genuinely allowed or denied on which specific resources. Policies can genuinely be attached to a user, a group, or a role, to control exactly what that identity is actually allowed to do.

A group lets you genuinely attach a policy once to the group itself, and every user added to that group automatically inherits those same genuine permissions. Attaching policies directly to individual users instead requires genuinely repeating that same configuration for every single user, which becomes harder to manage consistently as the number of users genuinely grows.

It means genuinely granting only the minimum permissions actually needed to perform a specific task, rather than broad, genuinely excessive access just in case it might be needed later. It matters because it genuinely limits the real damage a compromised credential or a genuine mistake could actually cause.

MFA requires a genuinely second form of verification, like a code from an authenticator app, in addition to a password, when signing in. It's genuinely recommended, especially for the root account with genuinely unrestricted access to the entire AWS account, since a compromised password alone wouldn't be enough for an attacker to actually gain access.

A VPC is a genuinely logically isolated section of AWS where you can launch resources, like EC2 instances, within a network you genuinely define yourself, including its own IP address range, subnets, and routing configuration.

A subnet is a genuinely smaller segment of a VPC's own IP address range, typically genuinely tied to a specific Availability Zone. Resources are launched into a specific subnet, and subnets are genuinely commonly divided into public (reachable from the internet) and private (not directly reachable) categories.

A public subnet has a genuine route to an internet gateway, letting resources within it actually communicate directly with the internet. A private subnet genuinely has no such direct route, keeping resources within it isolated from genuinely direct internet access, commonly used for something like a database that shouldn't genuinely be reachable from outside at all.

A security group acts as a genuinely virtual firewall controlling inbound and outbound traffic for an EC2 instance (or another resource), based on genuinely defined rules specifying allowed ports, protocols, and source or destination IP ranges.

An internet gateway is the genuine component that allows communication between resources in a VPC and the actual public internet. Without one genuinely attached to a VPC, resources within it can't genuinely communicate with the internet at all, regardless of any other, individual configuration.

A security group operates at the individual instance level and is genuinely stateful, automatically allowing a genuine response to an already-allowed request. A NACL operates at the genuine subnet level and is stateless, requiring genuinely explicit rules for both inbound and outbound traffic separately.

RDS (Relational Database Service) is a genuinely managed relational database service, handling routine tasks like backups, patching, and replication automatically, for engines like MySQL, PostgreSQL, and others, so you don't need to genuinely manage that underlying database administration work yourself.

Lambda lets you run genuinely small pieces of code without provisioning or managing a server at all, automatically scaling and charging only for the genuinely actual compute time your code consumes while it's actually running, rather than for a server sitting genuinely idle.

CloudFront is AWS's genuine content delivery network (CDN), caching content at genuinely edge locations closer to actual end users around the world, reducing latency and load on the genuinely original source server for content like images, videos, and static website files.

SNS (Simple Notification Service) is a genuine publish-subscribe messaging service, letting a single published message be delivered to multiple subscribers at once, like email, SMS, or another AWS service. SQS instead is a genuine queue, where a message is typically consumed and processed by just one single receiver, making SNS the better fit when several different consumers all genuinely need to react to the exact same event.

DynamoDB is a genuinely fully managed NoSQL database, storing data as key-value pairs or documents rather than genuinely structured relational tables, built for consistently fast performance at genuinely any scale, commonly used for an application needing genuinely predictable, low-latency access to data.

RDS handles genuinely routine operational tasks, backups, patching, failover, automatically. Running a database on EC2 yourself requires you to genuinely handle all of that operational work manually, giving genuinely more control at the cost of significantly more ongoing operational effort.

A load balancer distributes genuinely incoming traffic across multiple targets, like EC2 instances, improving both availability and fault tolerance. An Application Load Balancer operates at the genuine HTTP/HTTPS layer, supporting content-based routing. A Network Load Balancer operates at a genuinely lower layer, suited for extremely high-performance, low-latency use cases.

An EBS (Elastic Block Store) volume is genuinely persistent block storage attached to an EC2 instance, surviving that instance being stopped or even terminated if configured to do so. An instance store is genuinely temporary storage physically attached to the actual host, and its data is genuinely lost if the instance is stopped or fails.

An EBS snapshot is a genuine backup of a single volume's data at a specific point in time. An AMI is a genuinely broader template that can include a snapshot of the root volume plus configuration needed to actually launch a genuinely new, fully functioning EC2 instance from it.

Configure scaling policies based on a genuinely relevant metric, like CPU utilization or request count, with a genuinely reasonable cooldown period to avoid excessive, rapid scaling actions. Setting a genuinely sensible minimum instance count also ensures the application maintains baseline capacity even before a scaling event actually triggers.

VPC peering connects two genuinely separate VPCs, letting resources in each communicate with each other using genuinely private IP addresses, as if they were part of the exact same network. It solves the genuine problem of two separate teams or accounts needing their own resources to actually communicate directly and securely.

A security group is stateful and applies at the individual instance level, evaluating genuinely only allow rules. A NACL is stateless and applies at the subnet level, evaluating both genuine allow and deny rules in a specific, numbered order, which gives it the ability to genuinely explicitly block specific traffic that a security group alone genuinely can't.

A route table contains genuine rules, called routes, determining where network traffic from a subnet is actually directed. Each subnet is genuinely associated with exactly one route table, which determines whether that subnet's traffic can genuinely reach the internet, another VPC, or stays entirely internal.

A NAT Gateway lets resources in a genuinely private subnet initiate outbound connections to the internet, like downloading a software update, while still genuinely preventing any inbound connection from the internet from actually reaching them directly.

Public subnets host the genuine load balancer and any bastion host. Private subnets host the genuine application servers, reachable only from the load balancer. A genuinely further isolated, private subnet hosts the database layer, reachable only from the application servers, keeping each genuine tier appropriately isolated from direct external access.

A lifecycle policy automatically transitions objects between genuinely different S3 storage classes, or deletes them entirely, based on their genuine age. It solves the problem of manually managing storage costs over time, automatically moving genuinely infrequently accessed data to cheaper storage without requiring manual, ongoing intervention.

EFS (Elastic File System) provides genuinely shared file storage that multiple EC2 instances can mount and access simultaneously. EBS instead is genuinely block storage attached to just one single instance at a time (in the standard case), making EFS the better fit when multiple instances genuinely need to share the exact same files.

It speeds up transferring data into and out of S3 over genuinely long geographic distances, by routing traffic through AWS's own genuinely globally distributed edge locations rather than a genuinely direct, potentially slower path over the public internet.

Cross-region replication automatically copies objects from a bucket in one region to a bucket in another region. A genuinely common reason is disaster recovery, ensuring data genuinely survives even if an entire AWS region were to become unavailable, or to reduce latency for users genuinely located closer to the second region.

Storage Gateway connects a genuinely on-premises environment to AWS cloud storage, letting an existing on-premises application continue using genuinely familiar storage protocols while actually storing data in the cloud behind the scenes, useful during a gradual, genuinely incremental cloud migration.

Multi-AZ automatically maintains a genuinely synchronized standby replica of an RDS database in a genuinely different Availability Zone, and automatically fails over to that standby if the primary database instance genuinely becomes unavailable, improving overall availability.

Aurora is AWS's own genuinely cloud-native relational database engine, compatible with MySQL and PostgreSQL at the API level, but built on a genuinely different underlying storage architecture designed specifically for the cloud. It typically offers meaningfully better performance and availability than the equivalent standard RDS engine, at a somewhat higher cost.

A Read Replica genuinely serves read traffic to offload the primary database, and can genuinely be promoted to a standalone database if needed, but doesn't automatically fail over. A Multi-AZ standby exists genuinely purely for failover and high availability, and isn't genuinely used to directly serve read traffic in the standard configuration.

The partition key determines which genuine physical partition an item is actually stored on. Choosing one well genuinely matters because a poorly chosen key can lead to uneven, genuinely concentrated traffic on a small number of partitions, hurting performance, while a genuinely well-distributed key spreads traffic evenly across the table's underlying partitions.

DynamoDB is a genuinely NoSQL, key-value and document database, built for consistently fast performance at genuinely any scale with a genuinely flexible schema. RDS is a genuinely relational database, fitting data with clear, structured relationships and a genuine need for complex joins and transactions across multiple tables.

The function's own actual code, its runtime (the language and version it's genuinely written in), its configured memory and timeout settings, and any genuine trigger, an event source like an S3 upload or an API Gateway request, that actually invokes it.

API Gateway provides a genuinely managed way to actually create, publish, and manage a REST (or WebSocket) API. It genuinely commonly pairs with Lambda by routing an incoming API request directly to a specific Lambda function, letting you build a genuinely fully serverless API with no server to manage at all.

A cold start happens when Lambda genuinely needs to initialize a fresh execution environment for a function that hasn't genuinely run recently, adding real, noticeable latency to that specific invocation compared to a warm invocation reusing an already-initialized environment.

A single Lambda invocation is genuinely limited to 15 minutes maximum. This implies Lambda fits genuinely short-lived, event-driven tasks well, but isn't the right fit for a genuinely long-running batch job or a persistent, continuously-running service.

Deploy application servers across genuinely multiple Availability Zones behind a load balancer, use a Multi-AZ database deployment, and ensure any genuinely stateful component, like session data, is stored somewhere genuinely shared and accessible rather than local to a single specific instance.

Backup and restore is the genuinely cheapest but slowest to recover. Pilot light keeps a genuinely minimal version of critical infrastructure always running, scaled up during an actual disaster. Warm standby keeps a genuinely scaled-down but fully functional copy always running. Multi-site active-active runs genuinely full capacity in multiple regions simultaneously, offering the genuinely fastest recovery at the genuinely highest cost.

RTO is the genuinely maximum acceptable time to actually restore service after a disaster. RPO is the genuinely maximum acceptable amount of data loss, measured in time, that's genuinely acceptable. Together they genuinely determine which of the disaster recovery strategies is actually appropriate for a given specific application's own real requirements.

A genuinely multi-region architecture, replicating data and running application instances in more than one region, with a genuinely global traffic routing service, like Route 53 with health checks, directing users to a genuinely healthy region automatically if one becomes unavailable.

AWS is genuinely responsible for the security of the cloud, the actual underlying infrastructure, while the customer is genuinely responsible for security in the cloud, correctly configuring their own resources, IAM permissions, and data protection. It matters because a genuine security failure often traces back to the customer's own side of that shared responsibility, not AWS's own infrastructure.

CloudWatch collects and tracks genuine metrics, logs, and events from AWS resources and applications, letting you actually monitor performance, set alarms on a genuinely specific metric crossing a threshold, and automatically trigger a genuine action in response, like scaling an Auto Scaling group.

An alarm watches a genuinely specific metric and changes state when it crosses a defined threshold, and that state change can genuinely trigger an action, like sending a notification through SNS, or genuinely scaling an Auto Scaling group up or down automatically.

CloudFormation lets you actually define your entire AWS infrastructure as genuine code, in a template file, and then create, update, or delete that entire stack of resources together consistently. It solves the genuine problem of manually clicking through the console to configure resources, which is genuinely error-prone and hard to reliably reproduce.

IaC means genuinely defining infrastructure through version-controlled code rather than manual configuration. Beyond CloudFormation, tools like Terraform provide genuinely similar capability across multiple cloud providers. The genuine benefit is repeatability, code review for infrastructure changes, and the ability to actually recreate an entire environment reliably and consistently.

Configure a CloudWatch alarm on a genuinely relevant metric, like error rate or latency, and connect it to an SNS topic that actually sends a notification, an email, an SMS, or a message to a tool like Slack or PagerDuty, ensuring the genuinely right person is alerted quickly when something actually goes wrong.

Fargate is a genuinely serverless compute engine for containers, letting you run ECS or EKS workloads without genuinely provisioning or managing the actual underlying EC2 instances yourself. AWS handles the genuine underlying infrastructure entirely, and you're charged based on the actual resources your containers genuinely consume.

Individual services genuinely run as containers on ECS or EKS, communicating through an API Gateway or genuinely directly with each other, with a message queue like SQS or an event bus like EventBridge handling genuinely asynchronous communication between services that don't need an immediate response.

SQS (Simple Queue Service) is a genuinely managed message queue, letting one component place a message for another to process later, decoupling the sender from needing the receiver to be genuinely immediately available. It solves the genuine problem of tight coupling between services, and lets a receiver process messages at its own pace even under a genuinely sudden burst of load.

EventBridge is a genuine event bus, letting a service publish an event that can be genuinely routed to multiple different targets based on defined rules, fitting a genuinely event-driven, publish-subscribe architecture. SQS instead is genuinely a point-to-point queue, where a message is typically consumed by genuinely just one consumer.

Data arrives through a genuine event source, like Kinesis or SQS, triggers a Lambda function or a container service to actually process it, and the result is genuinely stored or forwarded to a downstream consumer, all connected through genuinely managed AWS services rather than a custom-built, genuinely bespoke pipeline.

Step Functions lets you genuinely define a workflow as a state machine, coordinating multiple Lambda functions (or other AWS services) in a genuinely defined sequence, including handling retries, error handling, and parallel execution. It solves the genuine problem of manually coordinating a genuinely complex, multi-step workflow through custom, hard-to-maintain code.

Start with AWS Cost Explorer to actually identify where spending is genuinely concentrated, then look for genuinely low-risk wins first, unused or oversized resources, Reserved Instance or Savings Plan opportunities for genuinely predictable, steady-state workloads, before considering a genuinely deeper architectural change.

A Savings Plan commits to a genuinely consistent amount of compute spend, measured in dollars per hour, over a one or three-year term, offering genuinely flexible discounts across instance families and even across regions. A Reserved Instance commits to a genuinely specific instance type in a specific region, offering genuinely less flexibility but sometimes a slightly deeper discount.

Encrypt data both at rest and in transit, apply the principle of least privilege genuinely rigorously through IAM, enable logging through CloudTrail for a genuine audit trail, and use a service like AWS Config to genuinely continuously monitor for a configuration drifting away from your defined, intended security baseline.

CloudTrail records genuinely every API call made within an AWS account, who made it, when, and what genuinely changed, providing an actual audit trail. It's genuinely essential for security investigations and compliance, letting you actually reconstruct exactly what happened during a genuine incident.

AWS Secrets Manager or Systems Manager Parameter Store stores secrets securely, and an application retrieves what it genuinely needs at runtime through IAM-controlled access, rather than secrets being hardcoded into application code or configuration files checked genuinely into source control.

I'd weigh the workload's genuine characteristics, how long it runs, how predictable its load is, and how much control over the underlying environment it genuinely needs. A genuinely short-lived, event-driven task fits Lambda well. A genuinely long-running, steady service often fits a container. A workload needing genuinely deep control over the operating system usually fits EC2 directly.

Route 53 is AWS's genuine DNS service, translating a domain name into an actual IP address. Beyond basic resolution, it supports health checks and several routing policies, like latency-based or geolocation routing, letting it direct traffic to the genuinely closest or healthiest available endpoint, which is why it's often used as part of a multi-region failover strategy.

Migrate incrementally, starting with genuinely lower-risk workloads to build organizational confidence and expertise, running the old and new environments genuinely in parallel during a transition period, and validating that the migrated workload genuinely performs correctly before actually cutting traffic over entirely.

I check it against the genuine Well-Architected Framework's pillars, particularly reliability and security, whether it accounts for genuine failure of an Availability Zone rather than assuming everything simply always works, and whether the genuinely estimated cost is reasonable relative to the actual expected business value.

Use AWS Organizations and Service Control Policies to genuinely enforce hard constraints centrally, and automate genuinely softer conventions, like resource tagging, through a tool that actually flags or blocks non-compliant resources in CI, rather than relying purely on individual teams remembering to genuinely follow a written guideline.

I'd look at how much genuinely duplicated effort exists across teams solving the exact same underlying infrastructure problems independently, and how much genuinely inconsistent security or reliability practice has resulted from that fully decentralized approach. A shared platform team genuinely pays for itself once that duplicated effort and inconsistency become a real, measurable cost.

I'd check CloudWatch metrics across every layer, compute, database, load balancer, looking for genuine correlation with the timing of the observed spikes. A genuinely common cause is a downstream dependency, like a database or a third-party API, becoming genuinely slow under specific conditions that don't show up consistently in every single request.

Combine CloudWatch metrics and alarms for genuine infrastructure-level signals with application-level monitoring for genuine business metrics, like error rate and request latency, alerting on meaningful deviation from an established baseline rather than only on an outright, hard failure.

Treat the resource's actual interface as a genuine contract with every consuming team. Additive changes are generally safe. Changing or removing something existing needs a documented deprecation period and direct communication before actual removal, rather than a silent breaking change that surfaces as someone else's unrelated-seeming production incident.

I'd check the AWS Service Health Dashboard first to genuinely rule out an actual AWS-side outage, then work through recent changes and CloudWatch metrics systematically. Mitigating genuine user impact, rolling back a recent deploy if the timing genuinely lines up, takes priority over fully understanding root cause immediately.

Start from actual load testing at realistic traffic patterns, verify Auto Scaling limits and any relevant AWS service quotas are genuinely sufficient for the expected peak, and check that any downstream dependency, like a database, can genuinely handle the increased load too, beyond just the application layer itself.

This is a judgment question interviewers use to see how you reason under genuine uncertainty, not to test a specific textbook fact. A strong answer names the actual constraint that forced the decision, the realistic options that were genuinely on the table, why you picked one knowing it wasn't guaranteed to be right, and what you'd do differently with what you know now.

I'd walk through an actual, real security review together, showing concretely what a compromised credential with genuinely overly broad permissions could actually access, rather than explaining least privilege as an abstract best practice on its own. Seeing the genuinely real, concrete blast radius tends to shift that habit far more effectively.

I wouldn't lead with IaC as an abstract best practice. I'd point to a specific, real, already-experienced incident where a manually configured resource caused a genuine problem that was hard to actually trace or reproduce, and show concretely how IaC would have actually prevented or at least sped up diagnosing that exact same issue.

I'd bring the actual, concrete workload characteristics, expected duration, traffic pattern, and cost at genuinely expected scale into the discussion, rather than a general, abstract preference for serverless or traditional infrastructure. Most disagreements like this genuinely resolve once both sides are looking at the exact same concrete numbers together.

I'd translate the opportunity into terms leadership already tracks: a specific percentage of spend going toward genuinely idle or oversized resources, identified through Cost Explorer, and what that recovered spend could instead fund elsewhere. Framed as recovered budget with a concrete number attached, it competes far better for prioritization than framed as a general infrastructure cleanup.