AWS Interview Questions and Answers: 60 Questions from Easy to Hard

AWS interview questions: Easy questions (freshers)

1. What is the difference between an AWS Region and an Availability Zone?

A Region is a separate geographic area, such as Mumbai (ap-south-1) or Hyderabad (ap-south-2), and Regions are isolated from each other. Each Region contains several Availability Zones; an AZ is one or more data centres with independent power, cooling and networking, linked to the other AZs by fast, low-latency connections. Spreading an application across at least two AZs means one failing zone does not take it down. Choose a Region by user latency, data residency needs, service availability and price. Edge locations, used by CloudFront and Route 53, are a separate layer.

2. Explain the AWS shared responsibility model.

AWS is responsible for security of the cloud: the physical data centres, hardware, global network and the virtualisation layer. The customer is responsible for security in the cloud: IAM users and permissions, encryption choices, security group rules, and patching whatever they manage, such as the operating system on EC2. The split moves with the service. On EC2 you patch the OS; on RDS AWS patches the database engine but you still decide who can connect; on S3 or Lambda AWS runs almost everything, yet a public bucket or an over-broad IAM policy is still your mistake.

3. What is Amazon EC2, and how do you read an instance type name like m7g.large?

EC2 provides virtual servers, called instances, launched from an AMI (the operating system image) and sized by instance type. In m7g.large, m is the family (balanced general purpose), 7 is the generation, g means an AWS Graviton (ARM) processor, and large is the size. Other common families are t (burstable), c (compute-optimised) and r (memory-optimised). Graviton instances usually cost less for the same work if your software runs on ARM. Storage normally comes from EBS volumes, network access is controlled by security groups, and Linux On-Demand instances are billed per second, with a one-minute minimum.

aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query "Reservations[].Instances[].[InstanceId,InstanceType]" \
  --output table

4. What is Amazon S3, and what are its main storage classes?

S3 is object storage: you store files (objects) in buckets and access them by key over HTTPS, with no disks or file system to manage. One object can be up to 5 TB, and S3 Standard is designed for eleven nines (99.999999999%) of durability by storing data across multiple AZs. Storage classes trade price against access cost and speed: Standard for frequent access, Intelligent-Tiering when the pattern is unknown, Standard-IA and One Zone-IA for infrequent access, and the Glacier classes for archives. Since December 2020 S3 has offered strong read-after-write consistency.

aws s3 mb s3://corehrx-demo-reports --region ap-south-1
aws s3 cp report.pdf s3://corehrx-demo-reports/2026/report.pdf
aws s3 ls s3://corehrx-demo-reports/2026/

5. What is IAM, and what are users, groups, roles and policies?

IAM controls who can do what in an AWS account. A user is an identity with long-term credentials, a group attaches the same permissions to many users, a role is an identity that trusted principals assume to get temporary credentials, and a policy is a JSON document that allows or denies actions on resources. Everything is denied unless a policy allows it. Current best practice is to give people access through IAM Identity Center (single sign-on) instead of individual IAM users, give applications roles, and grant least privilege. IAM is a global service, not tied to one Region.

# Shows which account and identity your CLI credentials belong to
aws sts get-caller-identity

6. What is the difference between an IAM user and an IAM role?

An IAM user has long-term credentials, a password and possibly access keys, that stay valid until someone rotates or deletes them. A role has no permanent credentials: a trusted principal assumes it and receives temporary credentials from AWS STS that expire automatically. Applications running on AWS should use roles: an EC2 instance gets one through an instance profile, a Lambda function through its execution role, and the SDK picks the credentials up with no keys in code. Roles also handle cross-account access and federated logins. Leaked long-term access keys are a frequent cause of account compromise.

7. What is a VPC, and what makes a subnet public or private?

A VPC is your own isolated network in a Region, defined by an IP range such as 10.0.0.0/16 and split into subnets, each of which lives in exactly one Availability Zone. A subnet is public when its route table sends 0.0.0.0/0 to an internet gateway; instances in it are reachable from the internet only if they also have a public IP and the security group allows it. A private subnet has no such route, so its instances cannot be reached from outside; they use a NAT gateway for outbound access. Put load balancers in public subnets and app servers and databases in private ones.

8. What is the difference between a security group and a network ACL?

A security group applies to an instance's network interface and is stateful: if inbound traffic is allowed, the reply goes out automatically. It supports allow rules only and can reference other security groups, such as allowing port 8080 only from the load balancer's group. A network ACL applies to a whole subnet and is stateless, so return traffic, including ephemeral ports, must be allowed explicitly. It supports both allow and deny rules, evaluated in rule-number order. Use security groups as the main control and NACLs for broad subnet-level blocks, such as denying a bad IP range.

9. What is Amazon EBS, and how does it differ from instance store and S3?

EBS is block storage that attaches to an EC2 instance like a disk. A volume lives in one Availability Zone and persists independently of the instance, so data survives a stop or reboot, and you back it up with snapshots that can be copied to other Regions. Instance store is physical disk on the host: very fast, but the data is lost when the instance stops or the host fails, so use it only for caches and scratch data. S3 is object storage reached through an API rather than mounted as a disk. gp3 is the usual general-purpose EBS volume type.

10. What is Elastic Load Balancing, and when do you use an ALB versus an NLB?

Elastic Load Balancing spreads incoming traffic across healthy targets, such as EC2 instances, containers or IP addresses, in several Availability Zones. An Application Load Balancer works at layer 7: it understands HTTP and HTTPS and can route by path or host name, for example /api to one target group and /admin to another, and it can also invoke Lambda. A Network Load Balancer works at layer 4 for TCP, UDP and TLS, handles very high throughput with low latency, and offers a static IP per AZ. Both run health checks and stop sending traffic to failing targets.

11. What is EC2 Auto Scaling, and how does it decide when to add instances?

An Auto Scaling group keeps the number of instances between a minimum and a maximum, launching them from a launch template across the AZs you choose. It replaces instances that fail health checks and changes capacity through policies: target tracking (keep average CPU near 50%), step scaling on CloudWatch alarms, scheduled scaling for known peaks such as a morning login rush, and predictive scaling based on past patterns. With a load balancer attached, new instances register automatically. Use launch templates; the older launch configurations are deprecated.

aws autoscaling put-scaling-policy \
  --auto-scaling-group-name web-asg \
  --policy-name keep-cpu-at-50 \
  --policy-type TargetTrackingScaling \
  --target-tracking-configuration '{"PredefinedMetricSpecification":{"PredefinedMetricType":"ASGAverageCPUUtilization"},"TargetValue":50.0}'

12. What is Amazon RDS, and what does AWS manage for you?

RDS is a managed relational database service for MySQL, PostgreSQL, MariaDB, Oracle, SQL Server and Db2, plus Aurora, AWS's cloud-built engine compatible with MySQL and PostgreSQL. AWS handles provisioning, OS and engine patching, automated backups with point-in-time recovery, monitoring and Multi-AZ failover; you choose the instance size, storage, parameters and who can connect. You get no SSH access to the host. Place RDS in private subnets, allow access only from the application's security group, and enable encryption at creation, because an existing unencrypted instance cannot simply be switched to encrypted.

13. What is AWS Lambda, and what kind of work suits it?

Lambda runs your code in response to events without servers to manage: an HTTP request through API Gateway, a file arriving in S3, a message in SQS, or a schedule. You upload a function, choose its memory (CPU scales with it), and pay per request and for compute time. One invocation can run for at most 15 minutes, and functions should be stateless because AWS creates and discards execution environments. It suits spiky, event-driven work such as image resizing or webhooks; steady, high-traffic workloads are often cheaper on containers or EC2.

import json

def lambda_handler(event, context):
    records = event.get("Records", [])
    for record in records:
        print("New object:", record["s3"]["object"]["key"])
    return {"processed": len(records)}

14. What is the difference between CloudWatch and CloudTrail?

CloudWatch monitors how things are running: metrics such as CPU or request count, logs from applications and Lambda, alarms that notify or act when a metric crosses a threshold, and dashboards. CloudTrail audits who did what: it records API calls in the account, such as who deleted a bucket or changed a security group, with the caller, time and source IP. An easy way to remember: CloudWatch answers 'is it healthy?', CloudTrail answers 'who changed it?'. Note that EC2 memory and disk usage are not default metrics; you need the CloudWatch agent for them.

# Stream a Lambda function's logs live (AWS CLI v2)
aws logs tail /aws/lambda/resize-images --follow --since 15m

15. What is Amazon CloudFront, and why put it in front of a website?

CloudFront is AWS's content delivery network. It caches content at edge locations close to users, including several cities in India, so images, scripts and even some API responses load faster and less traffic reaches the origin, which can be an S3 bucket, a load balancer or any HTTP server. It serves HTTPS with free ACM certificates, which must be requested in us-east-1 to be used with CloudFront, and works with AWS WAF and Shield for protection. For a private S3 origin, use Origin Access Control so only CloudFront can read the bucket.

16. What is Route 53, and what is an alias record?

Route 53 is AWS's DNS service: it hosts your domain's records, can register domains, and runs health checks. Beyond simple records it offers routing policies such as weighted, latency-based, failover and geolocation. An alias record is a Route 53 extension that points a name at an AWS resource such as a load balancer, a CloudFront distribution or an S3 website endpoint. Unlike a CNAME, an alias works at the zone apex (example.com itself), follows the resource's changing IP addresses automatically, and queries to aliases that point at AWS resources are not charged.

17. What is the difference between Amazon SQS and Amazon SNS?

SQS is a queue: producers send messages, they wait in the queue, and consumers poll for them and delete each one after processing, so every message is handled by one consumer. It decouples services and absorbs traffic spikes. SNS is publish/subscribe: a message published to a topic is pushed at once to every subscriber, such as SQS queues, Lambda functions, HTTPS endpoints, email or SMS. Use SQS when work must be done reliably at the consumer's pace, SNS when one event must reach many receivers, and both together for fan-out.

18. What is DynamoDB, and when would you choose it over RDS?

DynamoDB is a fully managed NoSQL key-value and document database. You define a primary key, either a partition key alone or a partition key plus sort key, and it serves reads and writes in single-digit milliseconds at almost any scale, with no servers, patching or connection pools to manage. Choose it when access patterns are known and simple, such as sessions, carts or activity by user ID, and traffic is large or spiky. Choose RDS when you need joins, ad-hoc queries or reporting, because DynamoDB queries efficiently only through its keys and indexes.

19. How do you connect to an EC2 instance securely?

The traditional way is SSH with a key pair, which needs port 22 open in the security group, ideally only from your own IP, plus a public IP or a bastion host. The better modern option is Systems Manager Session Manager: the SSM agent on the instance connects outbound to AWS, so you need no inbound ports, no SSH keys and no bastion, access is controlled through IAM, and sessions can be logged. The instance needs a role with the AmazonSSMManagedInstanceCore policy and a network path to the SSM endpoints, and your machine needs the Session Manager plugin for the CLI.

aws ssm start-session --target i-0abc123def4567890

20. How do you secure a new AWS account and its root user?

The root user has unrestricted access to the account, so use it only for the few tasks that require it, such as changing account settings. Enable MFA on it, never create access keys for it, and protect its email inbox. Do daily work as an IAM Identity Center user or a role with only the permissions you need. Turn on CloudTrail for all Regions, enable GuardDuty to flag unusual activity such as crypto-mining instances, and create an AWS Budgets alert so an unexpected bill is noticed early rather than at the end of the month.

aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{"BudgetName":"monthly-limit","BudgetLimit":{"Amount":"50","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
  --notifications-with-subscribers '[{"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":80,"ThresholdType":"PERCENTAGE"},"Subscribers":[{"SubscriptionType":"EMAIL","Address":"ops@example.com"}]}]'

AWS interview questions: Medium questions (1-3 years)

21. Explain the EC2 pricing options and when you would use each.

On-Demand is pay-as-you-go with no commitment, right for unpredictable or short-lived workloads. Savings Plans give a large discount for committing to a fixed spend per hour for one or three years; Compute Savings Plans apply across instance families, Regions, Fargate and Lambda. Reserved Instances are the older, more rigid commitment tied to an instance type, and similar reservations exist for databases. Spot Instances use spare capacity at the deepest discount but can be reclaimed with a two-minute warning, so they suit stateless, fault-tolerant work such as batch jobs and CI runners. A common mix: Savings Plans for the baseline, On-Demand for peaks, Spot for batch.

22. How does AWS evaluate IAM policies when a request is made?

Every request starts as an implicit deny. AWS gathers all applicable policies: identity policies, resource policies such as a bucket policy, permission boundaries, session policies and, in an organization, SCPs and resource control policies. An explicit Deny in any of them wins. Otherwise the request needs an Allow, while boundaries and organization policies only set the maximum: they never grant access themselves. Within one account, an allow in either the identity policy or the resource policy is usually enough; across accounts, both sides must allow it. The policy below allows reading and writing one S3 prefix only.

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow",
     "Action": ["s3:GetObject", "s3:PutObject"],
     "Resource": "arn:aws:s3:::resumes-bucket/uploads/*"},
    {"Effect": "Allow",
     "Action": "s3:ListBucket",
     "Resource": "arn:aws:s3:::resumes-bucket",
     "Condition": {"StringLike": {"s3:prefix": "uploads/*"}}}
  ]
}

23. How does an instance in a private subnet reach the internet, and when should you use VPC endpoints instead?

A private subnet has no route to the internet gateway, so outbound traffic, for OS updates or a payment API, goes through a NAT gateway placed in a public subnet. The private route table points 0.0.0.0/0 at the NAT gateway, which forwards the traffic from its Elastic IP and blocks connections started from outside. A standard (zonal) NAT gateway lives in one AZ, so for high availability run one per AZ and route each private subnet to the one in its own zone. For AWS services, VPC endpoints are better: gateway endpoints for S3 and DynamoDB are free, and interface endpoints reach most other services privately.

aws ec2 create-route \
  --route-table-id rtb-0a1b2c3d4e5f67890 \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-0123456789abcdef0

24. What is the difference between RDS Multi-AZ and read replicas?

They solve different problems. Multi-AZ is for availability: RDS keeps a synchronous standby in another AZ and, if the primary or its zone fails, fails over automatically by pointing the same DNS endpoint at the standby, typically within a minute or two. In the classic single-standby setup the standby serves no reads. Read replicas are for scaling reads: they copy data asynchronously, so they can lag, have their own endpoints, can live in other Regions, and can be promoted manually during disaster recovery. Production databases usually run Multi-AZ, plus replicas when read traffic needs them.

25. How do you secure data in an S3 bucket, and how do you share one private file?

Access is decided by the caller's IAM policies plus the bucket policy, with any explicit deny winning. New buckets have Block Public Access on and ACLs disabled by default; keep both unless a bucket truly must be public. New objects are encrypted at rest with SSE-S3 by default; choose SSE-KMS when you need key-level access control and an audit trail. Enforce HTTPS with a bucket policy that denies requests where aws:SecureTransport is false. To let someone download a single private file, generate a presigned URL with a short expiry instead of making the object public.

# Link valid for one hour, signed with your credentials
aws s3 presign s3://resumes-bucket/uploads/cand-1042.pdf --expires-in 3600

26. How do S3 versioning and lifecycle rules work together to control cost?

Versioning keeps every version of an object, so an overwrite or delete can be undone; a delete just adds a delete marker. Once enabled it can be suspended but not removed, and old versions are billed as storage, so pair it with lifecycle rules. Rules act by prefix, tag or age: move logs to Standard-IA after 30 days and Deep Archive after 180, expire noncurrent versions after 90 days, and abort incomplete multipart uploads, which otherwise cost money invisibly. Apply the JSON with aws s3api put-bucket-lifecycle-configuration.

{
  "Rules": [{
    "ID": "logs-tiering",
    "Status": "Enabled",
    "Filter": {"Prefix": "logs/"},
    "Transitions": [
      {"Days": 30, "StorageClass": "STANDARD_IA"},
      {"Days": 180, "StorageClass": "DEEP_ARCHIVE"}
    ],
    "NoncurrentVersionExpiration": {"NoncurrentDays": 90},
    "AbortIncompleteMultipartUpload": {"DaysAfterInitiation": 7}
  }]
}

27. How do you choose partition and sort keys when designing a DynamoDB table?

Start from the access patterns, not the entities, because DynamoDB queries efficiently only by key. Pick a partition key with many distinct values that spreads traffic evenly, such as user_id, and use the sort key for ranges within it, such as order_date, so 'orders of user X in October' becomes one Query. Avoid low-cardinality partition keys such as status or a single date, which create hot partitions. Add a global secondary index for another access pattern, remembering that GSI reads are eventually consistent. Avoid Scan in production paths, and keep items small; the maximum item size is 400 KB.

aws dynamodb query \
  --table-name Orders \
  --key-condition-expression "user_id = :u AND order_date BETWEEN :from AND :to" \
  --expression-attribute-values '{":u":{"S":"U1001"},":from":{"S":"2026-10-01"},":to":{"S":"2026-10-31"}}'

28. What is a Lambda cold start, and how do you reduce it?

A cold start happens when Lambda must create a new execution environment: download the code, start the runtime and run the initialisation code outside the handler. It adds latency to that one request, small for a lean Python or Node.js function and larger for a big Java one. Reduce it by keeping the package and its dependencies small, creating SDK clients and connections outside the handler so warm invocations reuse them, and giving the function more memory, which also gives more CPU. For strict latency targets, use provisioned concurrency, or SnapStart on runtimes that support it, such as Java.

29. How do you build a serverless API with API Gateway and Lambda?

API Gateway receives the HTTPS request, handles routing, throttling, authorisation and CORS, and calls Lambda through a proxy integration that passes the whole request as the event. The function returns an object with statusCode, headers and a string body. HTTP APIs are simpler and cheaper and cover most needs, including JWT authorisers; REST APIs add API keys with usage plans, request validation, response caching and direct AWS WAF integration. For a new JSON API, start with an HTTP API unless you need one of those. Lambda function URLs are an even simpler choice for a single function.

import json

def lambda_handler(event, context):
    params = event.get("queryStringParameters") or {}
    city = params.get("city", "Bengaluru")
    body = {"message": f"Jobs in {city}", "count": 0}
    return {
        "statusCode": 200,
        "headers": {"Content-Type": "application/json"},
        "body": json.dumps(body),
    }

30. What is the SQS visibility timeout, and what is a dead-letter queue for?

When a consumer receives a message, SQS hides it for the visibility timeout instead of deleting it. If the consumer deletes it in time, it is gone; if the consumer crashes, the message reappears and is retried. Set the timeout longer than the worst processing time; with a Lambda trigger, AWS recommends at least six times the function timeout. After maxReceiveCount failed receives, a redrive policy moves the message to a dead-letter queue, so one bad message cannot loop forever. Standard queues deliver at least once, so consumers must be idempotent. Long polling cuts empty responses and cost.

aws sqs receive-message \
  --queue-url https://sqs.ap-south-1.amazonaws.com/123456789012/emails \
  --max-number-of-messages 10 \
  --wait-time-seconds 20 \
  --visibility-timeout 120

31. What is the SNS to SQS fan-out pattern, and why use it?

Fan-out means one event triggers several independent consumers. Publish the event, say OrderPlaced, once to an SNS topic and subscribe several SQS queues to it: one for invoicing, one for email, one for analytics. Each queue gets its own copy, so a slow or failing consumer does not affect the others, and each retries at its own pace with its own dead-letter queue. Subscription filter policies let a queue receive only the events it needs. Each queue's access policy must allow the topic to send to it. EventBridge is an alternative when you need rich routing rules across many event types.

aws sns subscribe \
  --topic-arn arn:aws:sns:ap-south-1:123456789012:order-events \
  --protocol sqs \
  --notification-endpoint arn:aws:sqs:ap-south-1:123456789012:invoice-queue \
  --attributes '{"FilterPolicy":"{\"eventType\":[\"OrderPlaced\"]}"}'

32. How do you set up a useful CloudWatch alarm for an EC2-based application?

An alarm watches a metric, or a metric math expression, and moves to ALARM when the metric breaches a threshold for a set number of periods; it then notifies an SNS topic or triggers an action such as scaling. The example fires when average CPU stays above 80% for two consecutive five-minute periods, which avoids paging someone for a short spike. EC2 sends no memory or disk-space metrics by default, so install the CloudWatch agent for those. Decide how missing data should count, and alarm on what users feel, such as ALB 5xx errors and latency, not only CPU.

aws cloudwatch put-metric-alarm \
  --alarm-name web-high-cpu \
  --namespace AWS/EC2 --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-0abc123def4567890 \
  --statistic Average --period 300 --evaluation-periods 2 \
  --threshold 80 --comparison-operator GreaterThanThreshold \
  --alarm-actions arn:aws:sns:ap-south-1:123456789012:ops-alerts

33. What is the difference between ECS, EKS and Fargate?

ECS is AWS's own container orchestrator: simpler to learn, tightly integrated with IAM, load balancers and CloudWatch, and with no control-plane fee. EKS is managed Kubernetes: you pay for each cluster's control plane and it is more complex, but it is portable and brings the Kubernetes ecosystem, which matters if the team already uses Helm or operators. Fargate is not an orchestrator but a serverless way to run containers for either ECS or EKS: you set CPU and memory per task or pod and never manage nodes, at a higher unit price. Use EC2 capacity for GPUs, DaemonSets or the lowest steady-state cost.

34. How should an application on AWS get its database password and API keys?

Never put secrets in code, AMIs, or environment files committed to Git. AWS Secrets Manager stores secrets encrypted with KMS, controls access through IAM, records access in CloudTrail and can rotate database credentials automatically; it charges per secret. Systems Manager Parameter Store offers free standard parameters, including SecureString values encrypted with KMS, and suits configuration and simpler secrets without built-in rotation. The application fetches the secret at start-up using its IAM role and caches it. For RDS, a master password managed by Secrets Manager or IAM database authentication removes static passwords from your hands.

aws secretsmanager get-secret-value \
  --secret-id prod/jobs-app/db \
  --query SecretString --output text

35. How does encryption at rest work with AWS KMS?

KMS uses envelope encryption. When a service such as S3, EBS or RDS encrypts data, KMS generates a data key; the service encrypts your data with that data key and stores the data key only in encrypted form, protected by a KMS key that never leaves KMS unencrypted. To read the data, the service asks KMS to decrypt the data key, which succeeds only if the caller is allowed to use the KMS key. Bulk encryption stays fast, and access to one key controls who can decrypt. Customer managed keys add key policies, automatic rotation and a CloudTrail record of every use.

36. How do ALB listeners, target groups and health checks work together?

A listener, for example HTTPS on port 443 with an ACM certificate, has rules that forward requests to target groups based on host, path, headers or query strings. A target group is a set of instances, IPs, containers or a Lambda function, plus a health check: the ALB calls a path such as /health and sends traffic only to targets that return the expected status code. Make the health endpoint cheap but meaningful. Sticky sessions pin a user to one target with a cookie but spread load unevenly; storing sessions in ElastiCache or DynamoDB is better. Add an HTTP listener that redirects to HTTPS.

37. What routing policies does Route 53 offer, and when would you use each?

Simple returns one record set. Weighted splits traffic by percentage, useful for canary releases such as 90/10. Latency-based sends each user to the Region that gives them the lowest latency. Failover sends traffic to a primary while its health check passes and to a secondary, such as a static maintenance page, when it fails. Geolocation routes by the user's country or continent, for example Indian users to Mumbai, and geoproximity routes by distance with an adjustable bias. Multivalue answer returns several healthy IPs. DNS answers are cached for the TTL, so keep it short on records you may need to fail over.

38. What is infrastructure as code, and how do CloudFormation, CDK and Terraform compare?

Infrastructure as code describes AWS resources in version-controlled files and creates them with a tool instead of console clicks, so environments are repeatable, reviewed through pull requests and easy to rebuild. CloudFormation is AWS's native service and tracks state for you. The AWS CDK lets you write the same thing in TypeScript or Python and generates CloudFormation. Terraform is multi-cloud and keeps state in a file you must store safely, typically in S3 with locking. Whatever the tool, review the plan or change set before applying, and check for drift when people change things by hand.

resource "aws_s3_bucket" "uploads" {
  bucket = "corehrx-demo-uploads"
}

resource "aws_s3_bucket_versioning" "uploads" {
  bucket = aws_s3_bucket.uploads.id
  versioning_configuration {
    status = "Enabled"
  }
}

39. What are the six pillars of the AWS Well-Architected Framework?

The framework is AWS's set of best practices for reviewing a workload, grouped into six pillars. Operational excellence: automate changes, monitor, and learn from incidents. Security: least privilege, encryption and traceability. Reliability: recover from failure automatically, test recovery and scale horizontally. Performance efficiency: choose the right resource types and use managed services. Cost optimisation: pay only for what you need and measure spend. Sustainability, added in 2021, reduces the environmental impact of running workloads. In design questions, use the pillars to structure your answer and name the trade-offs between them.

40. What is the difference between VPC peering, Transit Gateway and PrivateLink?

VPC peering connects two VPCs privately, across accounts or Regions, with no extra hop. It is not transitive, the CIDR ranges must not overlap, and a full mesh becomes unmanageable beyond a handful of VPCs. Transit Gateway is a regional hub: each VPC or VPN attaches once, and its route tables decide who can talk to whom, which suits many VPCs and on-premises links, at a cost per attachment and per GB. PrivateLink exposes a single service, behind a Network Load Balancer, to other VPCs as an interface endpoint, without joining the networks, and it works even when CIDRs overlap.

AWS interview questions: Hard questions (experienced)

41. Design a highly available, scalable architecture on AWS for a job portal.

I would put Route 53 and CloudFront with AWS WAF in front, then an Application Load Balancer across three AZs in public subnets. The application runs on ECS Fargate or an EC2 Auto Scaling group in private subnets, scaling on requests per target. Data goes to Aurora MySQL with a replica in another AZ, ElastiCache Redis holds sessions and hot search results, S3 stores resumes and static assets, and SQS with workers handles emails and PDF generation. App servers stay stateless so any of them can fail. I would then state the RTO and RPO targets, a rough monthly cost, and what to simplify for an MVP.

42. A website on EC2 is unreachable from the internet. How do you troubleshoot it?

Work from the outside in. Check the instance status checks: a failed system check points to the AWS host, a failed instance check to the OS, so look at the system log or console screenshot. Then the network path: does the instance have a public or Elastic IP, does its subnet's route table send 0.0.0.0/0 to an internet gateway, does the security group allow the port from your IP, and does the NACL allow the inbound port and the outbound ephemeral ports? Then the host: is the service listening, is a local firewall blocking? VPC Flow Logs show ACCEPT or REJECT, and Reachability Analyzer checks the path.

aws ec2 describe-instance-status \
  --instance-ids i-0abc123def4567890 \
  --include-all-instances

43. A Lambda function attached to a VPC times out when it calls an external API. Why, and how do you fix it?

A Lambda function in a VPC uses network interfaces in your subnets and never gets a public IP, even in a public subnet, so it has no internet access through an internet gateway. Calls to an external API, or to AWS services through their public endpoints, hang until the function times out. Fix it by placing the function in private subnets whose route table points to a NAT gateway, or by adding VPC endpoints for the AWS services it calls, such as a gateway endpoint for S3 or interface endpoints for SQS and Secrets Manager. Check that its security group allows outbound traffic, and attach Lambda to a VPC only when it needs private resources.

44. Lambda functions are exhausting connections on an RDS MySQL database. How do you solve it?

Each concurrent Lambda execution environment opens its own connection, so a traffic spike that scales the function to hundreds of environments can hit MySQL's max_connections and cause 'Too many connections' errors for the whole application. Put RDS Proxy in between: it keeps a warm pool of database connections and shares them among many clients, and it also shortens failover time and can authenticate through IAM and Secrets Manager. Also open the connection outside the handler so warm invocations reuse it, cap the function's reserved concurrency at what the database can handle, and buffer write bursts through SQS.

45. What disaster recovery strategies does AWS describe, and how do you choose one?

Start from two numbers: RPO, how much data you can afford to lose, and RTO, how long you can be down. The four strategies trade cost for speed. Backup and restore copies backups to another Region and rebuilds with infrastructure as code: cheapest, with an RTO of hours. Pilot light replicates data continuously, for example with an Aurora global database, while app servers stay off until needed. Warm standby runs a scaled-down full copy that scales up on failover. Multi-site active-active serves traffic from two Regions at full capacity: lowest RTO, highest cost and complexity. Whichever you pick, test the failover regularly.

46. A role's IAM policy allows s3:GetObject, but the request still gets Access Denied. What do you check?

Check every layer that can deny. First, an explicit Deny anywhere: the bucket policy, an SCP or resource control policy, a permission boundary or a session policy. Second, encryption: for SSE-KMS objects the caller also needs kms:Decrypt, allowed by the KMS key policy. Third, ownership: if ACLs are still enabled, an object uploaded by another account may not belong to the bucket owner. Fourth, network conditions: a VPC endpoint policy, or a bucket policy that requires a specific aws:SourceVpce or IP range. Also confirm the resource ARN: GetObject needs bucket/key, ListBucket needs the bucket ARN. CloudTrail records the denied call.

47. An AWS access key was accidentally pushed to a public GitHub repository. What do you do?

Treat it as an active incident. Deactivate the key in IAM at once, delete it once nothing legitimate depends on it, and rotate anything else in the same commit; deleting the commit is not enough, because automated scanners find keys within minutes. Then search CloudTrail in every Region for actions by that access key ID: new IAM users, roles or keys, unfamiliar or GPU instances used for crypto-mining, new Lambda functions, and changed bucket policies. Remove what the attacker created, review the bill, open an AWS Support case, then fix the cause by moving to roles and adding secret scanning to CI.

48. Your company asks you to cut the AWS bill by 30%. How do you approach it?

Measure first: Cost Explorer grouped by service, account and tag shows where the money goes, usually EC2, RDS, data transfer and NAT gateways. Quick wins: delete idle resources such as unattached EBS volumes, old snapshots, unused Elastic IPs and idle load balancers, rightsize with Compute Optimizer, move gp2 volumes to gp3, and stop non-production environments at night. Then commitments: Savings Plans for steady compute and reservations for databases. Then architecture: Spot for batch and CI, Graviton, S3 lifecycle rules, CloudFront to cut transfer, and VPC endpoints instead of NAT for S3. Finally, add Budgets alerts and tagging so costs do not creep back.

49. How would you set up access across multiple AWS accounts for a growing company?

Use AWS Organizations with separate accounts for production, staging, security logging and shared services, because the account is the strongest boundary for permissions, quotas and blast radius. Attach SCPs to organizational units as guardrails, such as denying anyone the ability to stop CloudTrail or use unapproved Regions. People sign in once through IAM Identity Center and receive permission sets per account, with no IAM users. Workloads crossing accounts assume a role whose trust policy names the other account, as below, and the caller also needs sts:AssumeRole permission in its own account. Control Tower can set up this baseline.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::111122223333:root"},
    "Action": "sts:AssumeRole",
    "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
  }]
}

50. How do you make sure a payment event from SQS is processed only once?

Standard SQS queues and most event sources deliver at least once, so a consumer may see the same payment event twice and must not credit a wallet twice. Give every message a stable business ID, such as the gateway's payment ID, and record it with a conditional write as part of the side effect. In DynamoDB, a put with attribute_not_exists succeeds only the first time; a duplicate fails with ConditionalCheckFailedException and is skipped. TransactWriteItems can record the event and apply the balance update atomically. FIFO deduplication helps but does not replace an idempotent consumer. Powertools for AWS Lambda has a ready-made idempotency utility.

aws dynamodb put-item \
  --table-name ProcessedEvents \
  --item '{"event_id": {"S": "pay_9f2c41"}, "processed_at": {"S": "2026-11-01T10:15:00Z"}}' \
  --condition-expression "attribute_not_exists(event_id)"

51. When would you choose an SQS FIFO queue over a standard queue, and what is the role of the message group ID?

Standard queues give very high throughput with at-least-once delivery and best-effort ordering. FIFO queues guarantee order within a message group and exactly-once processing, deduplicating by ID within a five-minute window, at lower throughput unless high-throughput mode is enabled. The key design choice is MessageGroupId: messages in one group are processed one at a time, in order, while different groups run in parallel. Use something like the order ID, so each order's events stay ordered while the system still scales. One group ID for everything serialises the whole queue, and a failing message blocks the rest of its group.

aws sqs send-message \
  --queue-url https://sqs.ap-south-1.amazonaws.com/123456789012/payments.fifo \
  --message-body '{"orderId":"ORD-1001","event":"PAID"}' \
  --message-group-id ORD-1001 \
  --message-deduplication-id evt-77821

52. How do you deploy a new version of an application on AWS with zero downtime?

Rolling deployments replace instances or tasks in batches behind the load balancer; ECS does this by default while keeping a minimum healthy percentage. Blue/green builds a complete new environment and switches traffic in one step, through ALB weighted target groups or CodeDeploy, keeping the old version for instant rollback. Canary sends a small share first, such as 10% for ten minutes, and continues only if alarms stay quiet; Lambda aliases support weighted traffic natively. The hard part is the database: make schema changes backward compatible (expand, migrate, then contract) so old and new code can run side by side.

53. How do you give pods in an EKS cluster their own AWS permissions?

Do not rely on the worker node's instance role, because every pod on that node would share it. EKS offers two ways to map a Kubernetes service account to an IAM role. IRSA uses the cluster's OIDC provider: the role's trust policy trusts that provider for a specific namespace and service account, and the SDK exchanges the pod's projected token for temporary credentials. EKS Pod Identity is the newer, simpler option: install the Pod Identity Agent add-on and create an association between the service account and the role, with no per-cluster OIDC setup. Also stop pods reaching node credentials by requiring IMDSv2 with a hop limit of 1.

aws eks create-pod-identity-association \
  --cluster-name prod \
  --namespace payments \
  --service-account payments-api \
  --role-arn arn:aws:iam::123456789012:role/payments-api

54. How would you design monitoring and observability for a production workload on AWS?

Cover metrics, logs and traces, tied to what users experience. Metrics: ALB request count, 5xx rate and p99 latency, queue age and database connections, with alarms on symptoms rather than every CPU spike, and composite alarms to cut noise. Logs: structured JSON in CloudWatch Logs with a request ID, retention set for each log group, because the default is to keep logs forever, and Logs Insights for queries. Traces: X-Ray or OpenTelemetry through ADOT to see where a slow request spends its time. Add per-service dashboards, SLOs, and a runbook linked from every alarm.

fields @timestamp, @message
| filter @message like /ERROR/
| stats count(*) as errors by bin(5m)
| sort errors desc

55. Your RDS MySQL database is the bottleneck for a read-heavy application. How do you scale it?

First find out whether the load is reads or writes and which queries cause it, using the slow query log and CloudWatch Database Insights. Fix queries and indexes before buying a bigger instance. For reads, cache hot results in ElastiCache, add read replicas, and send reporting queries to a replica; Aurora supports up to 15 replicas that share the same storage with low lag. Use RDS Proxy if connection counts are the problem. Writes are harder: scale up, batch writes, move simple high-volume data such as sessions or activity logs to DynamoDB, and shard by tenant only as a last resort.

56. A client requires that their customer data stays in India. How do you enforce this on AWS?

First clarify the rule. India's DPDP Act does not require all personal data to stay in India by default, but sector rules can, for example RBI's rule that payment system data be stored only in India, and many clients demand it by contract. Run workloads in Mumbai and Hyderabad, block other Regions with an SCP like the one below, keep backups and replicas within those two Regions, encrypt with customer managed KMS keys, and log with CloudTrail. AWS's sample region-deny SCP exempts more global services than this short version. Keep personal data out of responses that CloudFront caches at edges worldwide.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyOutsideIndia",
    "Effect": "Deny",
    "NotAction": ["iam:*", "organizations:*", "sts:*", "support:*", "route53:*", "cloudfront:*"],
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {"aws:RequestedRegion": ["ap-south-1", "ap-south-2"]}
    }
  }]
}

57. Your NAT gateway charges are unexpectedly high. What is causing it, and how do you reduce them?

NAT gateways charge per hour and per GB processed, so heavy traffic through them adds up quickly. Common causes: instances pulling large container images or S3 objects through the NAT, and private subnets in one AZ routed to a NAT gateway in another, which adds cross-AZ data transfer on top. Fixes: add a free gateway endpoint for S3 and DynamoDB, add interface endpoints for ECR and other busy services where the volume justifies their hourly price, run one NAT gateway per AZ with matching routes, and keep container images in ECR rather than public registries. VPC Flow Logs show which instances send the traffic.

58. Instances in an Auto Scaling group keep launching and getting terminated in a loop. How do you debug it?

Find out which health check is failing. With ELB health checks, an instance is replaced when the target group check fails, so confirm the health check path and port return the expected code, that the instance's security group allows the load balancer's security group on that port, and that the health check grace period is longer than the app's real start-up time. If the app never starts, read the user data and cloud-init logs and the application logs; a missing secret or IAM permission is common. The scaling activity history shows the reason for each termination, and suspending ReplaceUnhealthy keeps an instance alive for debugging.

aws autoscaling describe-scaling-activities \
  --auto-scaling-group-name web-asg --max-items 5

aws autoscaling suspend-processes \
  --auto-scaling-group-name web-asg \
  --scaling-processes ReplaceUnhealthy

59. Can you run production workloads on Spot Instances safely? How?

Yes, for stateless, interruptible work: web tiers behind a load balancer, containers, batch, CI and big data jobs. Diversify across many instance types and all AZs, use the price-capacity-optimized allocation strategy, and keep a baseline of On-Demand capacity, covered by Savings Plans, in a mixed instances policy, for example 30% On-Demand. Handle the two-minute interruption notice: enable Capacity Rebalancing in the Auto Scaling group, drain connections when the notice arrives, and make sure work can be checkpointed or retried. Never put a single-instance database or other stateful component only on Spot.

60. How do you handle very large files and high request rates in S3?

S3 scales request rates automatically, supporting at least 3,500 write and 5,500 read requests per second per partitioned prefix, so spreading keys across prefixes raises the ceiling. For large files, use multipart upload: recommended above about 100 MB and required above 5 GB, it uploads parts in parallel and retries only failed parts. Byte-range GETs parallelise downloads. For uploads from users' browsers, issue presigned URLs so files go straight to S3 instead of through your servers. Transfer Acceleration helps distant uploaders, and a lifecycle rule should clean up abandoned multipart uploads.

# The CLI switches to multipart automatically above this size
aws configure set default.s3.multipart_threshold 64MB
aws configure set default.s3.max_concurrent_requests 20
aws s3 cp backup-2026-10.tar.gz s3://corehrx-demo-backups/