Question 1

What's the difference between an IAM role and an IAM user?

Accepted Answer

An IAM user represents a permanent identity (a person or application) with its own long-term credentials (password and/or access keys). An IAM role has no long-term credentials — it's assumed temporarily by a user, an AWS service (like an EC2 instance or Lambda function), or an external identity, and grants short-lived, auto-rotating credentials via STS. Roles are the recommended way to grant an EC2 instance or Lambda function permissions, instead of embedding a user's access keys in code.

Question 2

How does AWS evaluate multiple IAM policies when deciding whether to allow a request?

Accepted Answer

AWS collects every applicable policy (identity-based on the user/role, resource-based on the target, permission boundaries, SCPs, session policies), then evaluates them together: an explicit Deny in any policy always wins regardless of any Allow; if there's no explicit deny, an explicit Allow in at least one applicable policy is required; with neither, the default is an implicit deny. This is why a resource being 'allowed' in one policy can still be blocked entirely by a single Deny statement elsewhere.

Question 3

What's the difference between a Security Group and a Network ACL?

Accepted Answer

Security Groups operate at the instance (ENI) level and are stateful — if you allow inbound traffic on a port, the matching return traffic is automatically allowed out, regardless of outbound rules. Network ACLs operate at the subnet level and are stateless — you must explicitly allow both the inbound request and the outbound response, and rules are evaluated in numbered order with an explicit deny possible (SGs only support Allow rules). SGs are the primary tool for day-to-day access control; NACLs are typically used as a coarser subnet-level backstop.

Question 4

Why would you put an EC2 instance in a private subnet, and how does it reach the internet for updates?

Accepted Answer

A private subnet has no route to an Internet Gateway, so instances in it aren't directly reachable from (or routable to) the public internet — appropriate for application and database tiers that should never accept inbound internet traffic. For outbound access (e.g. package updates), the subnet's route table sends 0.0.0.0/0 traffic to a NAT Gateway sitting in a public subnet, which performs the address translation; inbound connections still can't reach the private instance directly.

Question 5

What are the S3 storage classes, and how would you choose between them?

Accepted Answer

S3 Standard for frequently accessed data; Standard-IA/One Zone-IA for infrequent access with a retrieval fee (cheaper storage, costs more per GB retrieved); Intelligent-Tiering when access patterns are unpredictable (it auto-moves objects between tiers); Glacier Instant/Flexible/Deep Archive for long-term archival where retrieval can take minutes to hours in exchange for the lowest storage cost. The decision is driven by how often the data is actually read and how quickly you'd need it back if you did.

Question 6

What's the difference between an Application Load Balancer and a Network Load Balancer?

Accepted Answer

An ALB operates at Layer 7 (HTTP/HTTPS) and can route based on path, host header, or query string, making it suited for microservices and content-based routing. An NLB operates at Layer 4 (TCP/UDP), preserving the client's source IP and handling millions of requests with ultra-low latency, making it suited for extreme throughput or non-HTTP protocols. Choose ALB when you need application-aware routing; choose NLB when you need raw performance or a static IP per AZ.

Question 7

How does Auto Scaling decide when to add or remove EC2 instances?

Accepted Answer

An Auto Scaling Group is configured with a launch template, min/max/desired capacity, and one or more scaling policies — target tracking (e.g. keep average CPU at 50%), step scaling (add N instances when a CloudWatch alarm crosses a threshold), or scheduled scaling (for predictable traffic patterns). CloudWatch alarms watching the group's metrics trigger the policy, which then launches or terminates instances to move desired capacity toward the target, always respecting the configured min/max bounds.

Question 8

What's the difference between EBS and instance store (ephemeral) storage?

Accepted Answer

EBS volumes are network-attached block storage that persists independently of the instance lifecycle — you can stop/start the instance, detach/reattach the volume, and take point-in-time snapshots to S3. Instance store volumes are physically attached to the host and are lost the moment the instance is stopped or terminated (not just rebooted) — they're only appropriate for data that's fully disposable, like a cache or scratch space, never for anything you can't afford to lose.

Question 9

How would you design a highly available RDS setup, and what does Multi-AZ actually protect against?

Accepted Answer

Enable Multi-AZ, which provisions a synchronously-replicated standby in a different Availability Zone; AWS automatically fails over to the standby (via a DNS endpoint flip, typically under a minute) if the primary's AZ has an outage, the instance fails, or during planned maintenance. Multi-AZ is for availability, not read scaling — the standby isn't readable. For read scaling you add Read Replicas (asynchronous, can be cross-region, and are independently readable) on top of Multi-AZ.

Question 10

What's the difference between CloudFront and an ALB, and when would you use both together?

Accepted Answer

CloudFront is a global CDN that caches content at edge locations close to users, reducing latency and origin load for both static and dynamic content, and also provides DDoS absorption and TLS termination at the edge. An ALB distributes traffic across backend targets within a region. A common production pattern is CloudFront in front of an ALB: CloudFront handles edge caching, TLS, and geographic distribution, while the ALB handles regional load balancing to the actual application servers.

Question 11

How do you troubleshoot an EC2 instance that fails a health check and gets terminated by Auto Scaling?

Accepted Answer

First check the health check type (EC2 status check vs. ELB target health check) — an ELB health check failure usually means the app isn't responding correctly on the configured path/port even though the instance itself is 'healthy'. Pull the instance's system log (`Get system log` in the console, or `aws ec2 get-console-output`) and, if it's already terminated, check CloudWatch Logs (if configured) or the Auto Scaling group's activity history for the termination reason. Common causes: the app takes longer to start than the health check grace period, a security group blocking the health check port, or the health check path returning a non-2xx status.

Question 12

What's the difference between a Savings Plan and a Reserved Instance?

Accepted Answer

A Reserved Instance commits to a specific instance family/size/region/OS for 1 or 3 years in exchange for a discount, and is fairly rigid (though convertible RIs allow some flexibility). A Savings Plan commits to a dollar-per-hour spend instead of a specific instance configuration, automatically applying the discount to any matching usage (EC2, Fargate, and Lambda for Compute Savings Plans) — making it more flexible when workloads or instance types are expected to change over the commitment period.

Question 13

How does Lambda scale, and what is a 'cold start'?

Accepted Answer

Lambda scales by running each concurrent invocation in its own execution environment, spinning up new environments automatically as concurrent requests increase, up to the account/function concurrency limit. A 'cold start' is the latency added when a new execution environment must be initialized (downloading code, starting the runtime, running any top-level initialization) versus a 'warm' invocation that reuses an already-initialized environment — mitigated with Provisioned Concurrency for latency-sensitive functions.

Question 14

What's the difference between a VPC Endpoint (Gateway) and a VPC Endpoint (Interface)?

Accepted Answer

A Gateway endpoint (supported for S3 and DynamoDB only) adds a route in your route table so traffic to that service stays on the AWS network without traversing a NAT Gateway or internet gateway, at no additional cost. An Interface endpoint (powered by AWS PrivateLink) creates an ENI with a private IP in your subnet for the target service, supports a much broader range of AWS and third-party services, and incurs an hourly + data processing charge. Use Gateway endpoints for S3/DynamoDB to cut NAT Gateway data costs; use Interface endpoints for everything else that needs private connectivity.

Question 15

How do you rotate a database credential used by an application without downtime?

Accepted Answer

Store the credential in AWS Secrets Manager with automatic rotation enabled; Secrets Manager creates a new credential, updates the database, and the application retrieves the current secret at runtime (rather than having it hardcoded or baked into an image) via the Secrets Manager API or a cached sidecar. This avoids any window where the app is using a credential that's already been invalidated, as long as the app re-fetches the secret rather than caching it indefinitely.

Question 16

What's the difference between CloudWatch Alarms and CloudWatch Events/EventBridge?

Accepted Answer

CloudWatch Alarms watch a single metric against a threshold over time and trigger an action (SNS notification, Auto Scaling policy, etc.) when it's breached — they're about metric-based conditions. EventBridge (formerly CloudWatch Events) reacts to discrete events — an API call happening, a resource state changing, a scheduled time being reached — routing them to targets like Lambda, SQS, or Step Functions. Alarms answer 'is this metric outside its healthy range'; EventBridge answers 'did this specific thing just happen'.

Question 17

Why would a request to an S3 bucket be denied even though the bucket policy allows it?

Accepted Answer

S3 access is the intersection of every applicable control: the bucket policy, the IAM policy on the calling identity, the object/bucket ACL (if used), and — critically — the account or bucket's Block Public Access settings, which override a permissive bucket policy by default. A request can be correctly allowed by the bucket policy and still be denied because Block Public Access is enabled, or because the IAM policy on the caller doesn't grant s3:GetObject at all.

Question 18

What's the difference between Route53 routing policies: simple, weighted, and latency-based?

Accepted Answer

Simple routing returns a single resource with no health checks or logic — one record, one answer. Weighted routing splits traffic across multiple resources by assigned proportion, useful for canary releases or A/B testing. Latency-based routing returns the resource in the region with the lowest measured latency for the requester, useful for globally distributed applications where you want users routed to their nearest healthy region automatically.

Question 19

How would you reduce a growing AWS bill without changing application architecture?

Accepted Answer

Start with Cost Explorer to find the actual top cost drivers (often EBS volumes left attached to terminated instances, idle load balancers, over-provisioned RDS instances, or NAT Gateway data processing charges). Then: right-size EC2/RDS instances using CloudWatch utilization data, move cold S3 data to cheaper tiers via lifecycle rules, delete unattached EBS volumes and old snapshots, and commit to Savings Plans for steady-state compute. These are pure cost-hygiene fixes that don't touch the application itself.

Question 20

What is the shared responsibility model, and where's the line for a service like RDS versus EC2?

Accepted Answer

AWS is responsible for security 'of' the cloud (physical infrastructure, hypervisor, managed-service internals); the customer is responsible for security 'in' the cloud (data, IAM configuration, network controls, and — for unmanaged services — the OS and everything above it). On EC2, the customer patches the OS and manages the application; on RDS, AWS manages the underlying OS and database engine patching, and the customer is responsible for IAM access, security groups, and the data itself — the managed service moves the line further toward AWS, but never removes the customer's side entirely.

AWS Interview Questions & Answers

All 20 Questions

Explore More