AWS is the most widely used cloud platform, and AWS skills are asked in DevOps, backend, data and cloud engineer interviews. These AWS interview questions cover core services such as EC2, S3, IAM and VPC for freshers, then high availability, serverless, databases, security, cost optimisation and architecture design for experienced engineers.
30 questions · Updated
Fundamentals, definitions and simple scenarios. Good for freshers and warm-ups.
A region is a geographic area, such as Mumbai (ap-south-1), with multiple isolated availability zones.
Each availability zone is one or more data centres with separate power and networking, connected to the others with low latency.
Spreading resources across availability zones protects an application from a single data centre failure.
EC2 provides virtual servers that you manage, including the operating system.
Lambda runs code in response to events without managing servers, billed per request and duration, and suits short, event-driven tasks.
ECS runs Docker containers, either on EC2 instances or serverless with Fargate.
EKS is the managed Kubernetes option.
S3 is object storage for files of any size, with very high durability.
Storage classes include S3 Standard for frequently accessed data, Intelligent-Tiering which moves data automatically based on access, Standard-IA and One Zone-IA for infrequent access, and Glacier Instant Retrieval, Flexible Retrieval and Deep Archive for archives.
Lifecycle rules move objects between classes automatically.
On-Demand: pay per second with no commitment, flexible but most expensive.
Savings Plans and Reserved Instances: commit to one or three years of usage for discounts of up to about 70%.
Spot Instances: use spare capacity at up to 90% off, but AWS can reclaim them with two minutes' notice, which suits fault-tolerant batch jobs.
Dedicated Hosts serve licensing and compliance needs.
EBS provides block storage volumes attached to one EC2 instance in one availability zone, like a hard disk, for operating systems and databases.
EFS is a managed network file system that many instances can mount at once across zones.
S3 is object storage accessed over HTTP, virtually unlimited and very durable, for files, backups, static websites and data lakes.
An Amazon Machine Image is a template for launching EC2 instances, containing the operating system, configuration and installed software. You can use AWS or marketplace AMIs or create your own from a configured instance, often with tools such as Packer, so new instances in an Auto Scaling group start identical and quickly.
An Elastic IP is a static public IPv4 address that you allocate to your account and attach to an instance or network interface, so the address stays the same when the instance is stopped or replaced.
AWS charges for all public IPv4 addresses.
Most architectures use load balancers and DNS names instead of fixed IPs.
CloudWatch collects metrics from AWS services and applications, stores and searches logs (CloudWatch Logs and Logs Insights), creates dashboards, and triggers alarms that notify teams through SNS or take automatic actions such as scaling. It also offers synthetic monitoring, application insights and tracing through X-Ray integration.
Route 53 is AWS's DNS service and domain registrar. It routes users to resources with routing policies such as simple, weighted (for gradual traffic shifts), latency-based, geolocation and failover with health checks, and supports alias records that point a domain's root to load balancers, CloudFront or S3 at no query cost.
CloudFront is AWS's content delivery network.
It caches content at edge locations around the world, including India, so users get static files, images, videos and even API responses faster.
It provides HTTPS, protection with AWS WAF and Shield, origin access control so S3 buckets stay private, and edge functions for small customisations.
AWS is responsible for security of the cloud: physical data centres, hardware, networking and the virtualisation layer.
Customers are responsible for security in the cloud: their data, IAM users and permissions, operating system patches on EC2, network configuration such as security groups, encryption choices and application security.
Managed services shift more responsibility to AWS.
Applied problems, trade-offs and questions about your own projects.
IAM controls who can do what in AWS.
Users represent people or applications with long-term credentials, groups collect users to share permissions, and roles provide temporary credentials that services, such as an EC2 instance or Lambda function, or users can assume.
Policies are JSON documents that allow or deny actions on resources.
Best practice is least privilege and roles instead of access keys.
A Virtual Private Cloud is an isolated network in AWS with its own IP range, subnets, route tables and gateways.
A public subnet has a route to an internet gateway, which suits load balancers.
A private subnet has no direct internet route, which suits application servers and databases; they reach the internet for updates through a NAT gateway.
Security groups are stateful firewalls attached to resources such as EC2 instances: they only have allow rules, and return traffic is allowed automatically. Network ACLs are stateless firewalls at the subnet level, with numbered allow and deny rules evaluated in order, and return traffic must be allowed explicitly.
RDS is a managed relational database service for MySQL, PostgreSQL, SQL Server, Oracle and MariaDB, handling backups, patching and Multi-AZ failover.
Aurora is AWS's own MySQL- and PostgreSQL-compatible database with higher performance, storage that grows automatically and fast replicas.
DynamoDB is a serverless NoSQL key-value database with single-digit millisecond latency at any scale.
An Application Load Balancer works at layer 7 (HTTP and HTTPS): it routes by path, host name or headers, supports WebSockets, authentication and AWS WAF, and suits web applications and microservices. A Network Load Balancer works at layer 4 (TCP, UDP and TLS), handles millions of requests per second with very low latency and static IP addresses, and suits non-HTTP and extreme-performance workloads.
An Auto Scaling group keeps a set number of EC2 instances running from a launch template, replaces unhealthy instances and spreads them across availability zones.
Scaling policies adjust capacity: target tracking (for example keep average CPU at 50%), step scaling based on alarms, scheduled scaling for known peaks, and predictive scaling.
It integrates with load balancers for health checks.
SQS is a message queue: producers send messages and consumers poll and process them, which decouples services and absorbs spikes; FIFO queues guarantee order.
SNS is publish-subscribe: one message is pushed to many subscribers, such as queues, Lambda functions, email or SMS.
EventBridge is an event bus with content-based routing rules, schedules, and events from AWS services and SaaS apps.
Keep Block Public Access enabled, grant access with IAM policies and bucket policies following least privilege, enable default encryption (SSE-S3 or SSE-KMS), enforce HTTPS, enable versioning and object lock for important data, log access, and serve public content through CloudFront with origin access control. Pre-signed URLs give temporary access to private objects.
API Gateway receives HTTP requests and triggers Lambda functions, which run code without servers, scale automatically and charge per request and duration, with data often stored in DynamoDB. Challenges include cold starts (reduced with smaller packages, provisioned concurrency or SnapStart), the 15-minute time limit, connection management to relational databases (RDS Proxy) and observability across many functions.
Infrastructure as code defines cloud resources in files kept in version control, so environments are repeatable, reviewed and easy to recreate.
CloudFormation is AWS's native YAML or JSON tool; the AWS CDK lets you write it in TypeScript or Python; Terraform (or OpenTofu) works across many clouds and providers with HCL.
Changes are planned, reviewed and applied through pipelines.
Both store configuration and secrets encrypted with KMS.
Systems Manager Parameter Store is free for standard parameters and suits configuration values and simple secrets.
Secrets Manager costs more but adds automatic rotation, for example of database passwords, cross-account sharing and replication across regions.
Applications read them at runtime with IAM permissions instead of hard-coding secrets.
System design, deep internals, leadership and tough follow-ups.
I put the application in an Auto Scaling group across at least two availability zones behind an Application Load Balancer, with the database on RDS or Aurora Multi-AZ, sessions in ElastiCache, static assets on S3 served through CloudFront, and DNS in Route 53 with health checks.
CloudWatch alarms, backups and infrastructure as code complete the setup.
For disaster recovery, data is replicated to a second region.
I find waste with Cost Explorer and tags, right-size over-provisioned instances, stop or schedule non-production resources outside working hours, use Savings Plans or Reserved Instances for steady workloads and Spot Instances for fault-tolerant jobs, apply S3 lifecycle policies, delete unused EBS volumes, snapshots and idle load balancers, and reduce data transfer and NAT gateway costs. Budgets and alerts catch surprises.
Protect the root account with MFA and never use it day to day, use IAM Identity Center with roles and least privilege, and use AWS Organizations with service control policies across accounts. Encrypt data with KMS, block public S3 access, keep resources in private subnets, store secrets in Secrets Manager, and enable CloudTrail, GuardDuty, Security Hub and AWS Config for monitoring and compliance.
From cheapest and slowest to most expensive and fastest: backup and restore (restore data and rebuild infrastructure, recovery in hours), pilot light (core data replicated and minimal services ready to scale up), warm standby (a scaled-down but running copy in another region) and multi-site active-active (full capacity in several regions). The choice depends on the recovery time objective (RTO) and recovery point objective (RPO).
It is a set of best practices organised into six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability.
Teams use it to review architectures, identify risks and plan improvements, for example multi-AZ deployments for reliability or right-sizing for cost.
The Well-Architected Tool guides reviews with questions for each pillar.
Separate accounts for production, staging, development, security and shared services limit the blast radius of mistakes and attacks and make billing clear. AWS Organizations groups accounts with consolidated billing and service control policies that restrict what accounts can do, Control Tower sets up a governed landing zone, and IAM Identity Center gives users single sign-on into the accounts they need.
Assess the existing applications and dependencies, then choose a strategy for each from the 7 Rs: retire, retain, rehost (lift and shift), relocate, replatform (small optimisations such as moving to RDS), repurchase (switch to SaaS) and refactor (redesign as cloud-native). Migrate in waves, starting with low-risk applications, using tools such as Application Migration Service and Database Migration Service, then optimise.
Users upload directly to an S3 bucket with pre-signed URLs.
An S3 event notification sends a message to SQS, which buffers work and allows retries, and a Lambda function processes each file, for example resizing images or parsing invoices, writing results to DynamoDB and output files to another bucket.
Failed messages go to a dead-letter queue, Step Functions orchestrate multi-step processing, and CloudWatch alarms watch errors and queue depth.
See all DevOps Engineer interview questions, covering Linux, Git, Docker, Kubernetes, CI/CD (GitHub Actions, Jenkins) and more.