Interview Questions
AWS Interview Questions and Answers
AWS interviews range from core service knowledge (EC2, S3, IAM) to scenario questions about designing a resilient, cost-effective architecture -- both matter.
Example: A minimal least-privilege IAM policy
JSON{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::my-app-uploads/*"
}
]
}
// Grants read/write to objects in ONE specific bucket only --
// not s3:* on Resource: "*", which would be far broader than needed.Frequently Asked Questions
EC2 gives you a full virtual machine you manage yourself -- you control the OS, install your own runtime, and pay for the instance whether or not it's actively doing work. Lambda is serverless -- you deploy just your function code, AWS runs it on-demand in response to triggers, and you pay only for actual execution time, with no server to manage or keep running.
S3 (Simple Storage Service) is object storage -- for files/blobs, not a filesystem or a database. Storage classes trade cost against retrieval speed/frequency: S3 Standard (frequent access), S3 Infrequent Access (cheaper storage, a retrieval fee), S3 Glacier (very cheap, but retrieval can take minutes to hours) -- picking the right class for how often data is actually accessed is a real cost-optimization lever.
IAM (Identity and Access Management) controls who/what can do what in your AWS account, via users, roles, and policies. Least privilege means granting only the specific permissions a role actually needs (as in the example policy above) rather than broad access "just in case" -- it's the standard security practice for limiting the blast radius if a credential is ever compromised.
A Security Group is a stateful firewall attached to individual resources (like an EC2 instance) -- if you allow inbound traffic on a port, the corresponding outbound response is automatically allowed too. A Network ACL is stateless and operates at the subnet level -- inbound and outbound rules must both be configured explicitly, and it applies to everything in that subnet.
An Auto Scaling Group automatically adds or removes EC2 instances based on demand (e.g. CPU utilization), keeping the fleet sized to actual load. A Load Balancer distributes incoming traffic across whatever instances currently exist in that group -- together they let an application handle variable traffic without manually provisioning for peak load year-round.
RDS is a managed relational database service (MySQL, PostgreSQL, SQL Server, etc.) -- structured schema, SQL, joins, transactions. DynamoDB is a managed NoSQL key-value/document database, built for very high throughput and predictable low-latency access at scale, with a much more constrained query model in exchange.
At minimum, deploy across multiple Availability Zones (physically separate data centers within a region) so a single AZ outage doesn't take the whole application down -- most managed services (RDS Multi-AZ, ALB, Auto Scaling Groups) support this natively. Full multi-region deployment (for disaster recovery from an entire region going down) is a further, more expensive/complex step, usually reserved for systems with strict availability requirements.