AWS Interview Questions and Answers: 25 Questions on Services, Security, and Design

AWS interviews come in two kinds. Some test whether you know what the services do and when to choose each one. Others give you a scenario, such as a web app that must survive a failure or a bill that has doubled, and watch how you reason about reliability, security, and cost. This guide has 25 questions with answers in both styles.

Service details and limits change often, so for exact numbers, check the AWS documentation. The interviewer mostly wants to hear your reasoning.

Core services

1. What is the difference between EC2, Lambda, and containers (ECS or EKS)?

EC2 gives you virtual servers that you manage. Lambda runs code in response to events with no servers to manage, and you pay per invocation and duration, with limits on run time and size. Containers on ECS or EKS sit in between: you package the app, and the service schedules it, either on servers you manage or on Fargate, which removes server management.

Pick Lambda for event-driven or spiky work, containers for long-running services and portability, and EC2 when you need full control of the machine.

2. What are the S3 storage classes?

S3 offers classes for different access patterns: Standard for frequent access, Intelligent-Tiering for unknown or changing access, Standard-IA and One Zone-IA for infrequent access, and the Glacier classes for archives with different retrieval times. Lifecycle rules move objects between classes automatically.

3. How do you secure an S3 bucket?

Block public access at the account and bucket level, use bucket policies and IAM roles that grant only what's needed, enable encryption (SSE-S3 or KMS), turn on versioning for recovery, enable access logging, and use VPC endpoints when traffic shouldn't cross the internet.

4. What is the difference between EBS, EFS, and S3?

EBS is block storage attached to one EC2 instance, like a disk. EFS is a shared network file system that many instances can mount. S3 is object storage accessed over an API, suited to files, backups, and static assets.

5. What's the difference between RDS, Aurora, and DynamoDB?

RDS runs managed relational databases such as MySQL and PostgreSQL. Aurora is AWS's relational engine, compatible with MySQL and PostgreSQL, built for higher availability and performance. DynamoDB is a managed NoSQL key-value and document database that scales horizontally and needs you to design around access patterns. Choose relational for joins and transactions across many tables, DynamoDB for known key-based access at large scale.

Networking

6. What is a VPC and what are its main parts?

A VPC is your private network in AWS. It has subnets (public and private), route tables, an internet gateway for public traffic, NAT gateways so private subnets can reach the internet outbound, and security groups and network ACLs for traffic control.

7. What's the difference between a security group and a network ACL?

A security group is a stateful firewall attached to an instance or network interface, with allow rules only. A network ACL is a stateless firewall at the subnet level and supports allow and deny rules. Return traffic must be allowed explicitly in an ACL.

8. What's the difference between public and private subnets?

A public subnet has a route to an internet gateway, so resources there can be reached from the internet if they have a public address and allow it. A private subnet has no direct route, so you put databases and application servers there and let them reach out through a NAT gateway.

9. How would you connect on-premises systems to AWS?

Site-to-site VPN for a quick encrypted link over the internet, or Direct Connect for a dedicated network connection with steadier performance. Many setups use both, with the VPN as backup.

10. What does Route 53 do?

It's AWS's DNS service. It also supports health checks and routing policies such as weighted, latency-based, geolocation, and failover routing.

Security and identity

11. What is IAM, and what does least privilege mean?

IAM controls who can do what in AWS. Least privilege means giving each user, role, or service only the permissions it needs. Prefer roles with temporary credentials over long-lived access keys, and use policy conditions and permission boundaries where useful.

12. What's the difference between an IAM user, group, role, and policy?

A user is an identity with long-term credentials. A group is a set of users. A role is an identity that can be assumed temporarily by a person, service, or another account. A policy is a document that defines permissions and is attached to any of the above.

13. How do you manage secrets?

Store them in Secrets Manager or Systems Manager Parameter Store, not in code or environment files in a repository. Grant access through IAM roles, rotate them, and encrypt them with KMS.

14. What does KMS do?

AWS Key Management Service creates and controls encryption keys. Many services use it for encryption at rest, and you control who can use each key through key policies and IAM.

Reliability and scaling

15. How do you make an application highly available?

Spread it across at least two Availability Zones. Put a load balancer in front, use an Auto Scaling group to replace failed instances, use a Multi-AZ database, and avoid storing state on one server. For regional failure, add a second region with data replication and DNS failover, and decide whether the cost is worth it.

16. What's the difference between an Application Load Balancer and a Network Load Balancer?

ALB works at layer 7 for HTTP and HTTPS and supports path- and host-based routing. NLB works at layer 4 for TCP and UDP, handles very high throughput with low latency, and gives static IP addresses.

17. How does auto scaling work?

An Auto Scaling group keeps a number of instances between a minimum and maximum. Scaling policies add or remove instances based on metrics such as CPU, request count, or a schedule. Health checks replace unhealthy instances.

18. What are RTO and RPO? What are the main disaster recovery strategies?

RTO is how long you can be down, and RPO is how much data you can lose. The usual strategies from cheapest and slowest to most expensive and fastest are backup and restore, pilot light, warm standby, and multi-site active-active.

19. When would you use SQS, SNS, or EventBridge?

SQS is a queue for decoupling producers and consumers and smoothing load. SNS is publish-subscribe, pushing a message to many subscribers. EventBridge routes events between services and SaaS sources based on rules. A common pattern is SNS to several SQS queues, so each consumer processes at its own pace.

Operations and cost

20. How do you monitor an AWS application?

CloudWatch for metrics, logs, and alarms, X-Ray or similar tracing for request paths, and CloudTrail for API activity and audit. Alarms should go to a person or an automation, and dashboards should show the signals that matter, such as error rate and latency.

21. What is infrastructure as code, and which tools do you use?

Defining infrastructure in files that are versioned and reviewed. On AWS, the main tools are CloudFormation and CDK, with Terraform widely used as a third-party option. Benefits are repeatability, review, and easy rebuilds.

22. Your AWS bill doubled. What do you do?

1. Open Cost Explorer and group by service, account, and tag to find what changed.
2. Check for new or resized resources, data transfer, and unattached volumes or idle instances.
3. Check for a traffic spike or a runaway process.
4. Fix the cause, then set budgets and alerts so you notice sooner.
5. Look for long-term savings, such as right-sizing, Savings Plans or reserved capacity, spot instances for flexible work, and storage lifecycle rules.

23. How do you reduce data transfer costs?

Keep traffic within a region and AZ when you can, use VPC endpoints for AWS services instead of NAT gateways, use a CDN such as CloudFront for content delivery, and compress data.

Scenario questions

24. Design a highly available web application on AWS.

"I'd put the app in an Auto Scaling group across two or three AZs in private subnets behind an Application Load Balancer in public subnets. The database would be Multi-AZ RDS or Aurora, with backups and read replicas if reads are heavy. Static content goes to S3 behind CloudFront. Sessions go in ElastiCache or the database, not on instances. I'd deploy with infrastructure as code, monitor with CloudWatch alarms, and keep secrets in Secrets Manager."

Then discuss tradeoffs: cost, recovery time, and whether multi-region is needed.

25. A Lambda function is timing out. How do you investigate?

Check CloudWatch logs and duration metrics, look for slow downstream calls such as a database or API, check cold start effects and memory settings (more memory also gives more CPU), and check whether it's waiting on a VPC connection or limits. Fix with timeouts and retries, caching, a larger memory setting, or moving long work to a queue or a container.

How to prepare

Build one small project that uses a VPC, a load balancer, a database, and a bucket, and practice explaining each choice. Learn the Well-Architected pillars (operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability), because many scenario answers map onto them. For related design practice, see our system design interview guide, and for coding rounds the coding interview assistant guide.

Practice saying your designs out loud, then check a transcript for places where you jumped to a service name without a reason. Follow the employer's rules on AI tools during a live interview.