AWS Interview Questions and Answers for 2026

Answer: AWS is a collection of rented computing services: compute, storage, databases, networking, and higher-level managed platforms, delivered on demand with per-use billing. The shared responsibility model splits security duties: AWS secures the cloud, the facilities, hardware, and the hypervisor, while you secure what you put in it, data, IAM configuration, OS patching on EC2, and network exposure. AWS interview questions on this topic want the boundary drawn precisely: with Lambda or S3 your side shrinks to configuration and data.

Answer: A region is an independent geographic cluster of data centers with its own API endpoints, pricing, and service catalog; resources do not replicate across regions unless you do it deliberately. An Availability Zone is one or more data centers inside a region with independent power and networking, connected by low-latency links. The design consequence to state: deploy across at least two AZs for high availability, because an AZ can fail while the region stays healthy.

Answer: EC2 gives you virtual machines with full control of the operating system, instance size, storage, and network placement, billed per second while running. Choose it when you need OS-level access, custom kernels or agents, licensing tied to cores, or steady workloads where reserved capacity beats per-invocation pricing. This choice, control versus operational burden, is the axis most AWS interview questions about compute travel along, so name both sides.

Answer: The first segment is the family: t bursts CPU credits for spiky load, m balances compute and memory, c favors compute, r favors memory, i and d favor storage. The digit is the generation, so a c6i is newer than a c5, and the suffix is size, with 2xlarge roughly doubling the resources of xlarge. Picking a family from a workload description is a standard warm-up in AWS interview questions.

Answer: An Amazon Machine Image is the template an EC2 instance boots from: one or more EBS snapshots for the root volume, launch permissions saying who may use it, and block-device mappings. You can start from AWS-owned or marketplace images, or build your own with golden-image pipelines or tools like Packer. AMIs are regional, so copying one to another region is a deliberate step, a detail that shows up in disaster-recovery follow-ups.

Answer: Stop powers the instance down: EBS volumes and their data persist, ephemeral instance-store data is lost, and public IPv4 addresses change on next start. Hibernate writes memory to the root volume so the instance resumes where it left off. Terminate deletes the instance and, unless delete-on-termination is disabled, its EBS volumes; that flag is the difference between a cleanup and an outage, which is why it earns a sentence in AWS interview questions about instance lifecycle.

Answer: A key pair is a public key AWS keeps and a private key you download once; the instance trusts the public half so you can SSH in as its default user, like ec2-user on Amazon Linux or ubuntu on Ubuntu images. Connect with ssh -i key.pem user@host, and the client refuses a key file with permissive modes, so chmod 400 first. Losing the private key means baking a new one in or using Session Manager, a repair story interviewers like hearing.

Answer: EBS is network-attached block storage that lives independently of any one instance, so volumes survive stop and start and can be detached and reattached. The daily choices are gp3 SSD with a baseline of 3,000 IOPS and 125 MB/s you can raise independently of size, io2 for provisioned extreme IOPS, and st1 or sc1 hard-disk classes for sequential or archival throughput. Storage-class tradeoffs like this recur through AWS interview questions because root-cause costs and performance both hang on them.

Answer: Instance store is physically attached disk on the host: very fast, included in the instance price, and ephemeral, the data vanishes on stop, hibernate, or host failure. It fits scratch space, caches that repopulate themselves, and replicated data stores that hold state on many nodes anyway. The sentence to volunteer: anything you would mourn losing belongs on EBS, not instance store, because that distinction is the entire point of the question.

Answer: A snapshot is a point-in-time backup of an EBS volume stored redundantly by AWS, incremental after the first, so only changed blocks bill. Take them while the volume is attached for most workloads, quiesce databases first if you need transactional guarantees, and automate retention with Data Lifecycle Manager. Snapshots are regional and copyable across regions, which makes them the backbone of simple DR answers, and that DR framing is what AWS interview questions on backups usually chase.

Answer: S3 is object storage at effectively unlimited scale: you PUT and GET named objects in buckets over HTTP, with eleven nines of durability. An object is the data plus metadata plus a key; objects are immutable, so updates are new versions, and size runs from zero bytes to 5 TB. The contrast to volunteer is block versus object storage: you cannot mount S3 as a random-access disk, you fetch whole objects, and that distinction anchors a family of AWS interview questions about storage choice.

Answer: Storage classes price the same bucket differently by access pattern: Standard for hot data, Intelligent-Tiering to move objects automatically, Standard-IA and One Zone-IA for rarely touched data with retrieval fees, and the Glacier family, Instant, Flexible, and Deep Archive, for archival with minimum storage durations and restore delays. Choosing one is arithmetic: storage rate times volume against retrieval rate times access frequency. Storage-class selection is one of the most reliable cost questions in AWS interview questions, so practice the arithmetic out loud.

Answer: Once enabled on a bucket, every write creates a new version instead of overwriting, and deletes add a delete marker rather than removing data, so mistakes are reversible. It is a prerequisite for cross-region replication and it protects against accidental overwrite and ransomware-style mass deletion. The caveat worth stating: old versions bill at full storage rates, so versioning without a lifecycle expiry rule quietly grows the bill, a pairing interviewers expect you to mention together.

Answer: A lifecycle rule transitions or expires objects automatically by age or prefix: move logs to Standard-IA after 30 days, to Glacier Flexible after 90, expire them after a year. Two high-value moves to mention: transition noncurrent versions with an expiry so versioning stays affordable, and add an AbortIncompleteMultipartUpload rule, because abandoned multipart parts bill silently. Lifecycle rules are the operational half of storage-class questions in AWS interview questions, and quoting the multipart cleanup rule signals real production experience.

Answer: Every S3 object is encrypted at rest by default with SSE-S3, keys managed by S3. The options upgrade from there: SSE-KMS uses a KMS key you control, which adds CloudTrail audit of every decrypt and key-policy-based access control, at the cost of KMS request rates and per-request pricing; SSE-C supplies your own key per request. Say the default-encryption-first sentence, then the audit tradeoff, because that progression is exactly what AWS interview questions on S3 security listen for.

Answer: It is a set of switches, at the bucket and the account level, that overrides anything else and refuses public access: public bucket policies, public ACLs, and public objects cannot be served no matter what the policies say. Defaults are all-on for new buckets, and the professional habit is enabling the account-level switch everywhere except confirmed public-asset buckets. It exists because misconfigured buckets are the classic cloud leak, which makes this setting a recurring prop in AWS interview questions about exposure.

Answer: IAM is the identity and access control plane: it holds users, groups, roles, and policies, and decides whether every API call to every service is allowed. It is global, not regional, and it is free. Two framing sentences that land well: everything in AWS is an API call, and IAM is the policy engine those calls pass through, which is why IAM questions open most security segments of AWS interview questions.

Answer: A JSON document of statements, each with an Effect of Allow or Deny, a Principal for resource policies, an Action list like s3:GetObject, a Resource ARN, and optional Condition blocks narrowing by IP, time, encryption context, or tags. Read one aloud in an interview by saying who can do what to which resource under what constraints. Being able to read, and not just paste, policy JSON is the gate most AWS interview questions about IAM are actually testing.

Answer: A user is a permanent identity with long-lived credentials for a person or system; a group bundles policies for many users; a role is assumable identity with temporary credentials that anything, a person, an EC2 instance, another account’s service, can adopt. The working rule to state: humans get federation or SSO, workloads get roles, and almost nobody needs a long-lived IAM user anymore. That modernization stance is the answer AWS interview questions on identity are listening for.

Answer: An access key is a pair of an access key ID and a secret access key for programmatic API calls, created per IAM user. Handle them like passwords: never in code or commits, rotate on schedule, delete the unused, and prefer roles, instance profiles, or OIDC federation so the keys never need to exist. Volunteering that you would audit for keys with iam generate-credential-report turns a definitional answer into the operational one AWS interview questions hope for.

Answer: Multi-factor authentication adds a second proof, usually a TOTP code from a hardware or virtual token, to console sign-in and, via aws sts get-session-token, to API calls. Non-negotiable places: the root account, which should barely exist, and every human with console access; enforcement happens with an IAM policy condition on aws:MultiFactorAuthPresent. Mentioning that root MFA plus a locked root is the first hardening step of any account review is the detail AWS interview questions on this topic reward.

Answer: A Virtual Private Cloud is your own isolated network slice in a region: an IPv4 CIDR range you choose, divided into subnets placed one per Availability Zone, with route tables, gateways, and firewalls you control. Everything you launch, instances, databases, load balancers, lands inside one, and peering or Transit Gateway connects VPCs together. Because every deployment question assumes this substrate, VPC fluency is the foundation the rest of the bank of AWS interview questions builds on.

Answer: Only its route table: a subnet is public if 0.0.0.0/0 routes to an internet gateway, private if outbound traffic goes through a NAT gateway instead, or has no internet route at all. An instance with no public IP in a public subnet is still reachable inward, which trips people up. Public and private are routing facts, not labels, and stating that one sentence cleanly is the point of this staple of AWS interview questions.

Answer: The prefix length says how many bits are fixed: /16 fixes the first sixteen, leaving about 65,536 addresses, while a /24 subnet carves out 256. AWS reserves five addresses per subnet, and you cannot overlap CIDRs between a VPC and anything you peer or attach to it. Being able to compute usable host counts on the spot is a quiet differentiator in AWS interview questions, because sizing subnets is real daily work.

Answer: It is the VPC-attached, horizontally scaled door between your subnets and the public internet: one per VPC, free, and it performs NAT for instances with public addresses. A subnet reaches it only if a route table entry points 0.0.0.0/0 at it, so gateway plus route is the pair to name. When connectivity fails, checking that pair before anything else is the disciplined opener interviewers want to hear in AWS interview questions about egress.

Answer: It lets instances in private subnets open outbound connections to the internet, for patches, package mirrors, external APIs, while blocking all inbound sessions. It lives in a public subnet, is Availability Zone-scoped, and bills per hour plus per gigabyte processed, so placing one per AZ avoids cross-AZ data charges and a single-AZ dependency. That combination of purpose, placement, and price is the complete shape of the answer this common entry in AWS interview questions expects.

Answer: It is the per-subnet forwarding decision list: destination CIDR on the left, target on the right, local route always present for traffic inside the VPC. Every subnet references exactly one main or custom table, longest-prefix match wins, and targets include internet gateways, NAT gateways, peering connections, Transit Gateway, and VPC endpoints. When any connectivity story starts, this is the first file to read, and saying so sets up the diagnostic habit scenario-tier AWS interview questions reward.

Answer: It is a stateful firewall attached to an instance’s network interface: allow rules only, referencing ports, protocols, and sources as CIDRs or other security groups, with all outbound allowed by default. Stateful means approved inbound sessions get their replies automatically, and traffic not matching any allow rule is dropped. Reference other groups instead of CIDRs wherever you can, because that keeps rules meaningful when instances change, a habit AWS interview questions about security hygiene consistently probe.

Answer: A network ACL is a stateless, numbered filter at the subnet boundary: it evaluates allow and deny rules lowest number first, applies to every instance in the subnet, and must explicitly admit return traffic because it remembers nothing. Security groups work per interface, remember sessions, and only allow. Use NACLs as a coarse deny layer for known-bad ranges and let groups do the fine work; that division of labor is the takeaway AWS interview questions want from the comparison.

Answer: An Elastic IP is a static public IPv4 address you allocate to your account and attach to an instance or NAT gateway, surviving stops and starts so DNS can point at something stable. Since February 2024 every public IPv4 address, Elastic or auto-assigned, bills about $0.005 per hour, attached or not, so unattached addresses are pure waste. Mentioning that pricing change and auditing for orphaned EIPs with aws ec2 describe-addresses is a current-events detail that lifts beginner-tier AWS interview questions answers.

Answer: RDS is managed relational databases: AWS runs the compute, storage, patching, backups, and failover while you manage schema and tuning. Engines are MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server, with Aurora as the cloud-native sibling offering MySQL and PostgreSQL compatibility. The framing that serves AWS interview questions well: RDS buys you the undifferentiated operational work of running a database, backups, replication, failover, so compare it against self-managed on EC2 in those terms.

Answer: Multi-AZ keeps a synchronous standby in a second Availability Zone and switches to it automatically on failure by changing the DNS endpoint, typically within 60 to 120 seconds, with no connection-string change in your application. It is an availability feature, not a scaling one: the standby serves no reads. Distinguishing availability from scalability is precisely what this question tests, and it is among the most common AWS interview questions at the database tier.

Answer: A read replica is an asynchronous copy of the primary that serves read traffic, offloading reports, dashboards, and heavy selects; you can add several, place them cross-region, and promote one to a standalone primary if disaster strikes. Because replication lags, a replica can serve slightly stale data, which is the caveat to state. Multi-AZ for failure, replicas for scale, that pairing is the sentence AWS interview questions on RDS architecture are listening for.

Answer: DynamoDB is a managed key-value and document store that scales horizontally to any throughput by partitioning data automatically, with single-digit-millisecond latency and no joins or ad-hoc queries. Choose it for known access patterns at scale, sessions, carts, telemetry, rankings, and stay with RDS when you need relational modeling, transactions across entities, or flexible querying. Access-pattern-first design is the mental shift this common fixture of AWS interview questions is really checking.

Answer: Lambda runs your code on demand, billed per invocation and per gigabyte-second, with no servers to patch and scaling handled by the service. The headline limits: 15 minutes maximum per invocation, memory from 128 MB to 10,240 MB with CPU scaling alongside memory, and deployment packages up to 250 MB unzipped outside containers. Limits define architecture in serverless, so long jobs and huge dependencies push you back toward containers, a judgment this recurring member of AWS interview questions exists to test.

Answer: Event sources span API Gateway and application load balancers for HTTP, S3 uploads, DynamoDB and Kinesis streams, SQS queues, EventBridge schedules and rules, SNS notifications, and direct SDK calls. Synchronous sources like API Gateway return the result to the caller, asynchronous ones like S3 retry on failure, and stream sources deliver per-shard with batching. Sorting sources by invocation model is the depth signal AWS interview questions on serverless look for next.

Answer: CloudWatch is the metrics, logs, and alarms service: services emit standard metrics like CPUUtilization automatically, applications and agents add custom metrics, and alarms watch a metric against a threshold for a number of periods and can notify SNS, scale an Auto Scaling group, or trigger recovery. Logs ship to CloudWatch Logs where you query them with Logs Insights. Metrics plus alarms is the observability backbone, and alarm-design follow-ups are where AWS interview questions take this topic.

Answer: CloudTrail records API calls across your account: who did what, from where, when, and with which credentials, retained 90 days in event history or shipped to S3 indefinitely by a trail. It is the audit backbone for incident response, compliance, and answering what changed after any break. Pairing it with CloudWatch in one sentence, metrics versus API history, cleanly separates the two services, which is exactly what this item in AWS interview questions is checking.

Answer: The metadata service answers at 169.254.169.254 from inside every instance: instance type, network config, IAM role credentials, user-data, and spot interruption notices. IMDSv2 replaces plain GETs with session tokens obtained by PUT, so SSRF payloads that merely read URLs cannot fetch credentials, and you can enforce it per instance with HttpTokens=required. Newer generations default toward v2, and migration is the first hardening line, which is why metadata topics thread through modern AWS interview questions.

Answer: Three kinds. Cluster packs instances close together for the lowest latency and highest inter-instance bandwidth, suited to tightly coupled HPC, at the cost of a larger correlated failure domain. Spread isolates a small number of critical instances, seven per group per Availability Zone, across distinct underlying hardware. Partition divides instances into labeled partitions, so topology-aware systems like Cassandra or HDFS can place replicas across racks. Naming the failure-domain tradeoff is what elevates this answer in AWS interview questions.

Answer: On-demand covers spiky and unpredictable load at list price; Reserved Instances or Savings Plans commit one or three years for the steady baseline, the deepest discounts with the least operational risk; Spot takes interrupted-when-needed capacity at up to 90 percent off for fault-tolerant work like batch, CI runners, and stateless workers. A healthy production profile is mostly committed, some on-demand headroom, aggressive Spot where the workload tolerates eviction. That split, with the reasoning attached, is the budgeted answer AWS interview questions on pricing strategy expect.

Answer: AWS reclaims Spot capacity with a two-minute warning delivered to instance metadata at meta-data/spot/instance-action and as an EventBridge event, then the instance goes away. Engineer for it: checkpoint state to S3 or a database, drain from load balancers on the signal, run enough instances across pools that eviction of a few changes nothing, and prefer diversified instance types in a Spot Fleet or ASG with capacity-optimized allocation. Treating interruption as a normal input, not an outage, is the maturity signal AWS interview questions on Spot hunt for.

Answer: The first snapshot copies every used block to S3-backed storage; each later one records only blocks changed since the previous snapshot, so restores reassemble the chain and deletes just remove delta blocks. Snapshots are crash-consistent, so quiesce databases or freeze the filesystem when you need application-level integrity. Automation comes from Data Lifecycle Manager policies or AWS Backup plans with retention and cross-region copy rules. Explaining the incremental chain is the mechanism half, and the DLM mention is the operations half, and strong AWS interview questions answers deliver both halves.

Answer: gp2 ties performance to size at roughly three IOPS per GB with a burst bucket, which forced people to overprovision gigabytes to buy IOPS. gp3 breaks that link: every volume starts at 3,000 IOPS and 125 MB/s regardless of size, and you provision more of each independently, up to 16,000 IOPS and 1,000 MB/s, while paying about 20 percent less than gp2. Unless something exotic requires io2, new volumes should be gp3, and migrating a fleet for savings is a story that lands well in AWS interview questions about cost hygiene.

Answer: Three steps, no reboot: aws ec2 modify-volume --volume-id vol-xxx --size 200 grows the block device, the instance sees a larger disk within seconds, then the OS partition stretches with growpart /dev/nvme0n1 1, and the filesystem fills the partition with resize2fs or xfs_growfs depending on type. Confirm with lsblk and df -h. Knowing the storage layer, partition layer, and filesystem layer are three separate things is the entire point of this practical, frequently asked entry in AWS interview questions.

Answer: EBS is a block device attached to one instance or one AZ-anchored attachment: fast, simple, per-volume. EFS is managed NFS that mounts concurrently from many instances across AZs, grows and shrinks with use, and fits shared web roots, home directories, and container storage, with lifecycle tiers for cold files. FSx is the family of specialized filesystems: Lustre for HPC throughput, Windows for SMB and Active Directory, ONTAP and OpenZFS for enterprise features. Attachment count, protocol, and performance shape decide it, and drawing that triangle cleanly is what AWS interview questions on shared storage grade.

Answer: Since December 2020, S3 is strongly consistent for all writes: after a successful PUT or DELETE, reads and list operations reflect the new state everywhere, with no reader-side caching caveats to work around. Before that, new-object writes had eventual consistency, and a lot of folklore still says otherwise, so stating the current model with the date is a credibility move. The operational caveat that remains is your own layer: CDN caches and client-side caching can serve stale data long after S3 is consistent, which is the nuance sharp AWS interview questions pursue past the definition.

Answer: S3 scales per key-name prefix: each prefix sustains on the order of 3,500 writes and 5,500 reads per second, so hashing random hex into key prefixes spreads hot workloads across partitions. Multipart upload splits one large object into parts uploaded in parallel, each independently retried, which speeds big transfers and recovers from flaky networks; parts beyond the first must be at least 5 MB and the object tops out at 5 TB. The trap to name: aborted-incomplete-but-never-cleaned parts bill forever unless a lifecycle rule aborts them, a gotcha that features in cost-focused AWS interview questions.

Answer: A presigned URL embeds a signature over method, path, and expiry generated from your credentials, letting an unauthenticated client upload or download one object directly from S3 without traffic proxying through your app. Edges worth naming: the permission is evaluated at request time against the signer, so revoking the signer’s access kills the URL even before expiry; PUT and GET differ, so sign the method you mean; and long-lived URLs are leaked credentials, so minutes-scale TTLs plus throwaway roles are the pattern. Direct-to-S3 uploads via presigned PUTs come up constantly in AWS interview questions about offloading application servers.

Answer: Identity policies attach to principals in your account; bucket policies attach to the bucket and are the only place you can grant cross-account access or anonymous access directly. In the same account, an explicit deny wins, otherwise a single Allow from either side is enough; across accounts, both the identity side and the resource side must allow. That evaluation asymmetry, union within the account, intersection across accounts, explains most real AccessDenied mysteries and is therefore one of the highest-value facts in AWS interview questions about S3 and IAM.

Answer: Object Lock enforces write-once-read-many retention: versions cannot be deleted or overwritten for a retention period, in Governance mode where privileged users can bypass with a permission, or Compliance mode where nobody, not even the root user, can shorten it. Legal holds are an indefinite flag on top. It requires versioning enabled at bucket creation and exists for records retention and ransomware defense. Naming both modes and who can escape which is the depth check this WORM topic gets in security-leaning AWS interview questions.

Answer: CRR copies objects asynchronously to a destination bucket in another region through an IAM service role. Prerequisites: versioning enabled on both buckets, the role permitted to read source and write destination, and KMS re-encryption configured if the destination encrypts with a customer-managed key. It replicates objects written after enabling, not history, unless you backfill, and same-region replication exists for latency and partitioning. Knowing that existing objects do not replicate is the classic trap follow-up in AWS interview questions on DR.

Answer: Athena runs serverless SQL, Presto under the hood, directly over S3 objects, using a Glue Data Catalog for schemas and paying per terabyte scanned. Cost discipline follows: partition by date or tenant, store data in Parquet instead of CSV, and prune columns, because every one of those multiplies the scanned-byte bill downward. For single-field pulls from individual objects, S3 Select avoids full downloads. The pattern, warehouse-less analytics over object storage, is a favorite architecture probe in modern AWS interview questions.

Answer: A request carries principal, action, and resource. First, any explicit deny in any applicable policy ends it. Second, the ceilings: service control policies for the organization and any permission boundary on the principal must permit the action, since they can only restrict. Third, the allow hunt: identity policies, resource policies, and session policies are checked, with resource and identity allows unioning within the account but requiring agreement across accounts. Nothing allows, the implicit deny wins. Reciting that order without notes is the single most bankable skill in AWS interview questions about IAM.

Answer: Both are ceilings, not grants: a permission boundary is a managed policy attached to a role or user that caps what its identity policies can ever enable, and an SCP does the same at AWS account or OU level across an organization. A boundary that allows nothing useful bricks the role even with AdministratorAccess attached, because the effective permission is the intersection. Use boundaries to delegate safely, giving a team admin rights over their own roles without letting them escalate past the cap, a delegation pattern senior AWS interview questions probe deliberately.

Answer: A Condition block filters a statement by request context: operator like StringEquals or IpAddress applied to keys. The workhorses: aws:PrincipalOrgID to allow only principals from your organization, aws:RequestedRegion to enforce a region allowlist, s3:prefix scoped to ListBucket for console-friendly prefixes, aws:MultiFactorAuthPresent for MFA-gated destructive actions, and kms:EncryptionContext for crypto hygiene. Conditions turn coarse allow statements into precise contracts, and writing one live is a common stretch goal in AWS interview questions beyond the basics.

Answer: An instance profile wraps an IAM role so an EC2 instance can adopt it; the credentials arrive through the metadata service and rotate automatically without any code change or secret storage. Compared with baking access keys into files or environment variables, roles remove a whole secret-leak class, survive credential rotation, and scope naturally per workload. The SSRF caveat, metadata v2 enforcement, is the advanced footnote. This roles-versus-keys argument is a reliability fixture in AWS interview questions because it separates people who have shipped secrets from people who have leaked them.

Answer: STS mints short-lived credentials: a principal calls sts:AssumeRole on a role whose trust policy names it, receives temporary keys, and operates as that role until expiry. Cross-account follows the same shape plus an external ID the trusting account demands, which blocks the confused-deputy problem when the target principal is another customer of a shared tool. Sessions can carry tags and policies that further narrow scope. Trust policy on the target plus identity permission on the caller, said in one breath, is the complete answer AWS interview questions want here.

Answer: A security group is stateful: it tracks connections, so an inbound allow automatically admits the reply, and it filters at each network interface with allow-only rules. A network ACL is stateless: every packet, inbound and outbound, is matched against numbered rules lowest-first, supports explicit denies, and return traffic must clear an inbound rule covering the client’s ephemeral port range, typically 1024 to 65535. That is why NACL rules talk about ephemeral ports and group rules never do. Engineers who can explain the tracking difference rarely fail follow-ups, which is why this pair anchors networking AWS interview questions.

Answer: The internet gateway connects a VPC to the internet bidirectionally for instances with public addresses. The NAT gateway is a managed, AZ-scoped translator that gives private subnets outbound-only access, scales automatically, and cannot be targeted by security groups because it needs none. The NAT instance is the legacy DIY version on an EC2 box: scriptable, cheap, but a single point of failure you patch yourself. Managed-first is the correct instinct, and knowing the NAT gateway takes no security group is a detail that consistently surprises interviewers in AWS interview questions about egress design.

Answer: Peering is a direct, non-transitive network link between two VPCs: add routes on both sides, update security group references, and traffic flows privately. The structural limit is the non-transitivity: A peered to B and B peered to C gives A no path to C, every pair needs its own connection, and overlapping CIDR blocks cannot peer at all. Ten-plus VPCs therefore strain peering meshes, which is the natural segue into Transit Gateway. Reciting the transitivity trap correctly is the pass bar for this question in AWS interview questions.

Answer: Transit Gateway is a managed regional router: VPCs and VPNs attach once to the hub, and its route tables decide what can talk to what, including transitive paths across many networks. It wins once you pass a handful of VPCs or need hybrid attachment, one VPN to on-premises reachable by every attached VPC, with segmentation managed through multiple route tables instead of a peering mesh. Billing is per attachment hour plus per gigabyte processed. Framing it as route-table-driven segmentation, not just a bigger cable, is what distinguishes strong answers in AWS interview questions about network growth.

Answer: The VPC provides a Route 53 Resolver at the second address of the CIDR, VPC plus two, which answers instance names, private hosted zone records, and public names, controlled by the enableDnsSupport and enableDnsHostnames attributes. Private hosted zones associate with VPCs so internal names like db.internal.example resolve only inside. Hybrid setups use Resolver inbound and outbound endpoints to bridge on-premises DNS and Route 53 forwarding rules. Knowing the plus-two address and the two enable flags is the practical core of DNS-flavored AWS interview questions.

Answer: Endpoints keep traffic to AWS services on the Amazon network, off the public path. Gateway endpoints serve only S3 and DynamoDB: free, implemented as route table entries pointing the service CIDRs at the endpoint, with an endpoint policy for scoping. Interface endpoints are PrivateLink: elastic network interfaces with private IPs placed in your subnets, billed per hour and per gigabyte, available for most other services like KMS, STS, and Secrets Manager. Gateway for the two big ones, interface for everything else, is the shorthand that answers this common cost-and-security question in AWS interview questions.

Answer: The standby receives synchronous replication, so it is always current; when health checks fail, RDS flips the DNS endpoint to the standby, typically completing within 60 to 120 seconds, while the endpoint string your application uses never changes. Your side of the deal: connection pools must retry and rebuild, because idle pooled connections die with the old host. Aurora differs structurally, storage is shared, so a replica is promoted instead and recovery is usually faster. Name the CNAME flip and the pool-retry consequence together and this answer closes cleanly, which is what AWS interview questions on failover test.

Answer: A standby replicates synchronously and serves nothing, existing purely for availability. A replica replicates asynchronously, serves reads, can lag seconds behind, exists in numbers, can sit in another region, and can be promoted to independence, a one-way operation. Use both together in serious deployments: Multi-AZ for automatic failover, replicas for read scale and cross-region DR seeding. The lag caveat drives application decisions like read-your-own-writes routing, and that second-order thinking is exactly what AWS interview questions about replication are mining for.

Answer: A parameter group holds engine configuration, think max_connections, innodb_buffer_pool_size, or log_min_duration_statement, applied to instances that reference it; some parameters apply immediately, others wait for a reboot, and the console flags which. An option group attaches add-on features that are not parameters, like the MariaDB audit plugin or Oracle TDE. Defaults are shared and mutable by AWS, so production clones a custom group and versions it, because changing defaults mid-fleet is how configuration drift starts. Group discipline is the operational moral of this entry in AWS interview questions.

Answer: DynamoDB hashes the partition key and assigns each hash range to a physical partition, so all items sharing one key value, plus their sort-key neighbors, live on one partition with that partition’s throughput ceiling. A hot partition appears when the key concentrates traffic, timestamp-only keys, single-tenant IDs, celebrity rows, and requests start throttling even though the table total looks fine. Fixes: add entropy to the key, a suffix or shard number, or switch to on-demand for spiky but non-skewed traffic. Key design as throughput design is the lesson, and it is the single most valuable DynamoDB insight in AWS interview questions.

Answer: A write capacity unit covers one 1 KB write per second, a read capacity unit one strongly consistent 4 KB read per second or two eventual ones. Provisioned mode bills for reserved capacity with auto scaling targets to ride demand; on-demand bills per request with no capacity planning, suited to new tables and spiky or unpredictable load. You can switch modes on a live table, and the cost crossover is usually near steady utilization around 30 percent of provisioned. Doing that arithmetic out loud is the bonus layer in AWS interview questions about DynamoDB economics.

Answer: A GSI has its own partition key and optional sort key, its own provisioned throughput, is always eventually consistent, and can be added or dropped on a live table; it re-projects chosen attributes into a separate physical structure. An LSI shares the table’s partition key with a different sort key, must be declared at creation, reads can be strongly consistent, and it consumes the base table’s capacity. GSIs are the everyday tool, alternate query shapes by email, status, or tenant. Framing indexes as extra tables you pay for twice is the cost-aware sentence this item in AWS interview questions rewards.

Answer: Each concurrent invocation gets its own execution environment; the account holds a regional soft cap around 1,000 by default, with burst growth on the order of a thousand new environments per ten seconds. Reserved concurrency guarantees a function a floor and caps it, protecting downstream systems or ring-fencing one function from starving others. Provisioned concurrency keeps environments pre-initialized so requests skip the cold-start tax. When a downstream database chokes, the fix is capping the function, not scaling the database to match it, an inversion that senior AWS interview questions specifically listen for.

Answer: A cold start is the latency of preparing a fresh execution environment: download your deployment, start the runtime, run initialization code, before the handler runs; it lands hardest on runtimes with heavy startup like Java and on functions loading big frameworks. Mitigations, in order of cost: trim dependencies and initialize lazily, raise memory so CPU scales with it, provisioned concurrency to keep environments warm, and SnapStart for Java, which snapshots an initialized VM. Measuring with the INIT phase in logs and p99 rather than averages is the discipline this recurring topic in AWS interview questions expects.

Answer: The function’s execution environments attach to elastic network interfaces in your chosen subnets and security groups, which is required to reach private resources like RDS or ElastiCache. Since the Hyperplane ENI redesign, attachment is no longer a cold-start penalty. The tradeoffs: no public internet unless the subnets route through NAT, and AWS service APIs need interface endpoints or a NAT path, which is why VPC-attached functions that break on S3 calls are a classic. Stating both halves, private reach gained, internet reach conditional, is what complete AWS interview questions answers look like here.

Answer: Async events retry twice with backoff by default, then drop unless you have configured otherwise; the two escape hatches are a dead-letter queue, SQS or SNS, and destinations, which route success and failure records onward with richer context including the response payload. Max event age caps how long retries persist, and stream or queue sources handle failure differently, returning batches or parking poison messages. At-least-once delivery is the contract, so handlers must be idempotent, and saying that single word with a story behind it is what AWS interview questions on serverless reliability remember.

Answer: Default EC2 metrics cover hypervisor-visible facts, CPU, network, disk I/O ops, but not memory or disk space, because the hypervisor cannot see inside the guest. The CloudWatch agent fills those gaps plus process-level stats, ships logs, and accepts StatsD and collectd. Custom metrics support dimensions, so one metric name sliced by instance or environment, and optional high resolution down to one second at higher price. Knowing that memory usage is never free by default is the tell that separates people who have alarmed on real servers from people who have read about them, a distinction AWS interview questions on observability trade on.

Answer: An alarm samples a metric over a period, for a number of evaluation periods, and fires when the breach condition holds for the configured datapoints-to-alarm ratio. Flapping usually means one-period alarms on spiky metrics; silence usually means the missing-data treatment is wrong, because the default treats absent datapoints as not breaching, which hides a dead metric rather than alarming on it. Set missing data to breach for heartbeat-style metrics, use composite alarms to correlate, and prefer anomaly detection bands for irregular baselines. Alarm semantics are graded knowledge in AWS interview questions because paging humans on broken alerts is expensive.

Answer: An ALB is layer seven: HTTP routing by path and host, header rewriting, authentication integration, and target groups that can hold containers and Lambda. An NLB is layer four: static IPs, zonal architecture, source-IP preservation, and very high packet throughput with TLS passthrough or termination. Cross-zone load balancing spreads requests evenly across AZs, always on and free for ALB, off by default and billable for NLB. Connection draining, now the deregistration delay, gives in-flight requests up to 300 seconds to finish when targets deregister. Choosing L7 flexibility against L4 raw performance is the decision this trio of AWS interview questions always circles.

Answer: An ASG holds min, desired, and max capacity, launches from a launch template, and adjusts desired on schedule or on a scaling policy. Target tracking is the default choice, keep CPU at 40 percent, keep ALB requests per target at 100, because it is a single dial that behaves sensibly; step policies handle custom metric shapes, and predictive scaling fits strong daily seasonality. Health checks replace bad instances, ELB health checks catch broken-but-running hosts, and instance refresh rolls new AMIs through the group. Policy-type judgment, not flag trivia, is what AWS interview questions about elasticity grade.

Answer: First, the exact error source: CloudTrail for the failing call shows which policy evaluated and often names the denied context. Then walk the deny chain: explicit denies in the identity policy, bucket policy, SCPs, permission boundaries, and VPC endpoint policies, because any one explicit deny beats every allow. Third, what changed in the last 48 hours, IAM changes, bucket policy edits, KMS key rotation, since SSE-KMS objects fail on the key policy, not the bucket policy. Fourth, object ownership and ACLs if the bucket predates the current defaults. That ordered story, evidence before theory, is the entire test in this most classic of S3 access-denied scenarios in AWS interview questions.

Answer: Split the two identities involved. With Origin Access Control, the bucket policy must allow the distribution’s ARN as principal; a policy that was overwritten by a hardening script is the usual culprit. If objects are SSE-KMS encrypted, the key policy must also allow CloudFront’s service principal, and KMS denials surface as access errors in the distribution. Check the origin domain too, a REST endpoint with an OAC mismatch, and confirm the response header says which leg failed. Working the two-policy chain, bucket then key, in that order is the crisp answer this layered variant deserves.

Answer: Work outward from the instance. Confirm egress intent first with curl to a known endpoint, then read the subnet’s route table: 0.0.0.0/0 must target a NAT gateway, and a route in state blackhole means the NAT was deleted. Verify the NAT lives in a public subnet with an internet route and an Elastic IP. Then the filters: outbound on the instance security group, and the network ACL, whose stateless return path needs ephemeral ports open. Finally, DNS: resolution can fail while routing is fine. Route, NAT, filters, DNS, in that order, and say the order out loud, because that narration is the point of the question.

Answer: ICMP and TCP are filtered separately, so the first split is which rule set blocks SSH. Security group inbound missing 22 from your CIDR is the common case, and the fix is additive. The subtle case is the network ACL: outbound TCP to port 22 may be allowed, but the stateless reply from the instance arrives on your ephemeral ports, and an outbound NACL without 1024 to 65535 open drops it, so the connection hangs rather than refuses. nc -vz timing distinguishes refuse, which is a filter saying no, from hang, which is a lost return path. That refuse-versus-hang distinction is the senior detail in this connectivity classic.

Answer: Rules act on new connections, so first confirm this is not a stale long-lived session behind a load balancer. Then verify you edited the group actually attached to the interface with aws ec2 describe-network-interfaces --filters Name=attachment.instance-id,Values=i-xxx, because autoscaled fleets happily run mixed groups. Check both directions: inbound on the target and outbound on the source, since default outbound can be restricted. Then the return path through any network ACLs, and finally test from inside with a loopback connection to isolate the service from the network. Most of these mysteries end at the wrong-group step, which is why it sits early in the order.

Answer: Peering is non-transitive by design: each pair needs its own connection, and routes for it, on both sides. A to C traffic currently has no route, and often no peering at all. Options in order of maturity: add a direct A-C peer if it is genuinely one pair; adopt Transit Gateway, attach all three, and let hub route tables express the policy, which also survives the next four VPCs; or use PrivateLink if only specific services, not whole networks, should be reachable. Also verify overlapping CIDRs are not silently making the route ambiguous. Naming non-transitivity first, then escalating to the hub, is exactly the reasoning chain the question is drawn to expose.

Answer: A gateway endpoint works through route tables, so the first check is whether the subnet’s route table actually contains the pl-xxxx prefix list entry targeting the endpoint; endpoints in the wrong table affect the wrong subnets. Second, the endpoint policy may be denying the traffic, which pushes clients onto fallback paths and errors, not savings. Third, the traffic may never have been S3-bound: S3 transfers inside the same region over NAT are rare, and the bill is usually dominated by other destinations like package mirrors or external APIs, which need NAT regardless. Read the NAT gateway CloudWatch bytes-out metric per subnet before crediting or blaming the endpoint.

Answer: One: confirm the function is attached to private subnets in the database’s VPC, ENIs are per subnet and security group. Two: the RDS security group must trust the Lambda security group, by group reference, on 3306 or 5432, the single most common miss. Three: connectivity to other services, if the function also calls S3 or Secrets Manager it needs interface endpoints or a NAT route, because VPC attachment removes the default public path. Four: timeout arithmetic, 15 seconds is not enough for cold init plus pool setup plus query, so separate init latency from connect latency in the logs. Most fixes land at step two, but the value you show is completing all four without guessing.

Answer: Read the Throttles metric with ConcurrentExecutions side by side. If concurrency hit the account’s regional limit, the account is saturated and another function is the thief; request a quota raise and set reserved concurrency on critical functions. If the limit is the function’s own reserved cap, someone ring-fenced it too tightly. If neither, look at the downstream: throttling often protects a database that cannot take the concurrency, so the durable fix is a queue between the trigger and the function, turning burst into steady drain. Deciding between raise, cap, and queue by reading which ceiling you hit is precisely the judgment this scenario is built to reveal.

Answer: Decompose the invocation in logs first: the INIT phase, before the handler, grows when imports or runtime startup grow, and INIT lands on every cold invocation. Compare cold versus warm durations from the reported durations; if only cold got worse, it is package weight or import-time work like clients and SDK config built at module scope. Check whether the bump raised memory pressure enough to spill, since CPU scales with memory and a starved runtime slows everything. Mitigate in order: lazy initialization, moving client construction into the handler, a memory bump, provisioned concurrency for the endpoints where p99 is contractual. INIT-versus-handler separation in the log line is the evidence that settles it.

Answer: Outside a VPC, the function reached S3 over the public endpoint using its execution role. Attached to private subnets, that public path vanished, and someone then added a VPC endpoint whose policy, or a NAT-less route table, changed what the call presents. Read the CloudTrail entry: it names the exact denied action and, for endpoint policies, the context. Fixes: add an S3 gateway endpoint in the route table with a policy permitting the role, or restore a NAT route if internet egress was intended. The teaching point to state: VPC attachment is a routing change, not an identity change, and every subsequent failure is a route or policy consequence.

Answer: Allow in the identity policy is only one vote. Walk every explicit-deny source: the identity policy itself, the bucket policy, the S3 VPC endpoint policy if the call traverses one, SCPs, and the user’s permission boundary, any single explicit deny ends it. Next the ceilings: an SCP without a matching allow, or a boundary narrower than the identity policy, silently caps permissions at their intersection. Then KMS: if objects are SSE-KMS, decrypt requires the key policy to allow the caller, and the failure names KMS, not S3. Finally confirm the right principal got the policy and not a group nobody joined. Reporting the chain in that order, deny, ceiling, key, principal, is the complete answer.

Answer: AdministratorAccess grants the caller permission to assume, but the role’s trust policy must separately name the caller as principal, and trust lives on the role, not the caller. Check the trust policy first: wrong account ID, a deleted external ID, or a condition like aws:SourceOrgID that no longer matches. Then the caller side: sts:AssumeRole on that exact role ARN, not a wildcard that excludes it, and no permission boundary subtracting it. Cross-account adds a third gate, the target account must not have an SCP forbidding the assumption. Trust policy plus identity policy, both required, in that order of likelihood, is the diagnostic the interviewer wants verbalized.

Answer: The statement matches nothing, because ListAllMyBuckets is a bucket-list operation that does not support resource-level permissions: its only valid Resource is the wildcard. Actions come in two flavors, those that accept resource ARNs and those that are account-scoped, and scoping the second kind to a resource ARN produces a statement that can never allow anything, with no warning at save time. The general tool is the IAM policy reference page listing which actions support which resource types, and aws iam simulate-principal-policy to prove the mismatch before shipping. That action-versus-resource compatibility table is deep-cut knowledge, and this scenario is exactly how AWS interview questions surface it.

Answer: Do not terminate; the fix is out-of-band access. If Systems Manager was enabled, Session Manager reaches the instance through the SSM agent regardless of SSH rules, provided the instance role permits it and the VPC has a path to the SSM endpoints, interface endpoints or NAT. From Session Manager, inspect and repair the security group with the CLI. Without SSM, options are user-data on a stop-start cycle, which runs as root at next boot to restore rules, or launching a replacement from the same AMI with correct groups and reattaching volumes. The prevention sentence closes the answer: manage groups through IaC with review, and keep the SSM role on every instance as the master key.

Answer: The two checks have different owners. System reachability failing means the AWS side, hardware or host software, and the fix is stop-start to migrate the instance to healthy hardware, or wait for AWS repair. Instance reachability failing means the OS layer: bad kernel, full disk, broken network config, failed boot, and no migration helps until the guest is fixed. Confirm which by reading the console status, then for instance-level trouble use recovery paths: EC2 Serial Console or Session Manager for a system that boots but is unreachable, root volume swap onto a rescue instance for one that does not. Naming the owner of each check before touching anything is the entire answer.

Answer: The storage grew, the filesystem did not, because they are separate layers. Verify with lsblk: the block device shows the new size while the partition, and therefore the filesystem, still shows the old. Stretch the partition with growpart /dev/nvme0n1 1, adjusting device and partition numbers to the listing, then grow the filesystem, resize2fs for ext4 or xfs_growfs for XFS, both online. On gp3 also confirm the new IOPS and throughput you want, since size alone no longer implies performance. Storage, partition, filesystem: three layers, two commands after modify-volume, and reciting that stack is the point of this repair question.

Answer: Classify before tuning: Performance Insights or the engine’s own views, pg_stat_activity or SHOW PROCESSLIST, shows whether CPU is a few heavy queries or thousands of light ones. Heavy queries: read the slow query log, check for a missing index after a deploy, and explain the worst statement. Connection exhaustion: find the leak, usually an app tier scaling out without a pool cap, set pool maxima below the instance limit, and consider RDS Proxy to absorb burst and multiplex connections. Structural fixes follow the finding: a read replica for read-heavy load, a bigger class only as a bridge. Query shape first, pool second, instance size last is the order that shows judgment.

Answer: The endpoint CNAME flipped, but the application’s connection pool kept dead sockets and, worse, some clients cache DNS past the failover window. Fix the pool: validate-on-borrow, short idle timeouts, and aggressive eviction so dead connections are replaced automatically; test with an actual reboot of the writer. Fix resolution: rely on the RDS endpoint rather than a pinned IP, keep DNS TTLs low, and ensure resolvers inside the VPC requery promptly. If sessions also broke mid-transaction, add retry logic that replays idempotently. A failover you have not rehearsed against your pool is a failover you have not done, which is the sentence that ends this answer well.

Answer: Check CloudWatch per-item throttles first: throttling on one partition key while the table total looks calm is a hot key, throttling everywhere is genuine under-provisioning. Hot key fixes: add entropy to the partition key, a shard suffix, or a write sharding scheme for counters, and on the read side add a short cache like DAX or application caching for the few celebrity items. Genuine under-provisioning: raise capacity or let auto scaling act, or move the spiky table to on-demand. Also inspect for scan patterns and missing GSIs forcing full-table reads. Distinguishing one hot partition from table-wide shortfall is the whole diagnosis, and it is the difference between redesign and a billing change.

Answer: Cost Explorer grouped by service, then by tag, then by usage type, daily granularity, to isolate which service and which day the curve bent. The usual suspects behind step-function bills: data transfer out to the internet, NAT gateway processing from a new cross-AZ pattern or a chatty job, CloudWatch custom metrics from a bad agent config, snapshot accumulation from a new backup policy, and public IPv4 charges from a fleet change. Then CloudTrail around that day, filtering on the suspect service, to find who or what created the resource. Tag discipline decides whether this takes ten minutes or a day, and saying that is part of a complete answer.

Answer: Versioning without expiry is the top suspect: every overwrite keeps the old version at full price, so churn, not growth, inflates the bill, and aws s3api list-object-versions proves it. Second, incomplete multipart uploads: abandoned parts bill forever without an abort lifecycle rule. Third, storage class drift: Intelligent-Tiering handles unknown patterns, but objects stuck in Standard that nobody read since last quarter belong in IA tiers, and lifecycle transitions cannot fix objects created before the rule. Fourth, metadata-heavy buckets with millions of tiny objects bill on request counts, not bytes. Run lifecycle rules that expire noncurrent versions and abort stale multiparts, then watch the storage-class mix report week over week.

Answer: Work the alarm’s own data path. Was the metric flowing, a dead agent or a renamed metric means the alarm evaluated on nothing, and the default missing-data treatment happily stays green. Was the statistic right, P99 over a one-minute period is not the same as an average over five. Did the state transition happen but the notification die, SNS subscription unconfirmed, or an action blocked by a policy, with the alarm history showing OK to ALARM without delivery? Was the threshold tuned to a healthy baseline so the breach never crossed it? Composite alarms and out-of-band heartbeat checks close the gaps. Alarms are systems too, and saying so, with the four failure classes, is the mature version of this answer.

Answer: Healthy checks pass, so look at what happens after routing. Read target group health plus the ALB access logs, which record the target’s response and the reason code. Common causes: the application closed keep-alive connections shorter than the ALB’s idle timeout, so the balancer forwards onto a socket the target already dropped; the target reset mid-response under memory pressure; or TLS targets present a certificate or protocol the ALB rejects only on data. Fixes: keep-alive on the target exceeding the ALB idle timeout, correct deregistration delay so in-flight requests finish, and capacity headroom on the target. The access-log reason code turns guessing into reading, and naming it first is what makes the answer credible.

Answer: NAT bills per gigabyte processed, so first find who generates bytes: VPC flow logs to the NAT gateway’s ENI, grouped by destination, name the talkers. The classic patterns: an Availability Zone using another AZ’s NAT, doubling traffic as cross-AZ plus processing, fixed by one NAT per AZ; S3 and DynamoDB calls taking the NAT path because a gateway endpoint was never added; polling loops against external APIs, or container images pulled per pod instead of per node, multiplied by autoscaling. Fix with per-AZ NATs, endpoints for AWS services, caching layers, and egress allowlists that fail fast. Flow logs to the ENI is the evidence that ends the debate about whose service is expensive.

Answer: Replication reports health in the console metrics and CloudWatch, ReplicationLatency and OperationsFailedReplication, so alarms on those first, because silent breakage is the failure mode. After a KMS change, the replication role needs decrypt on the new source key and encrypt on the destination key, and key policies must allow the role, three policy surfaces for one failure. Versioning must remain enabled on both buckets, and replica modification rules change scope if someone touched them. Backfill the gap with a batch copy job once healthy. Replication is asynchronous and unbothered, it will not alert you, which is why the first sentence of the fix is the metric, not the policy.