interview questions
AWS interview questions and answers for cloud roles
The AWS questions that come up repeatedly, grouped by what the interviewer is actually probing, with the diagnostic questions that separate candidates who have built from candidates who have read.
By the Samyak faculty team · Published · 10 min read
AWS interviews look intimidating because the service catalogue is enormous. In practice the questions cluster tightly around four things: can you reason about networking, do you understand identity, can you design for failure, and do you think about cost.
Prepare against those four and the surface area shrinks dramatically.
Networking — the largest category
An EC2 instance in a private subnet cannot reach the internet. Why?
The answer interviewers want is a method, not a cause.
Check in order: does the route table for that subnet have a route to a NAT gateway; is the NAT gateway in a public subnet with a route to an internet gateway; does the security group allow outbound traffic; does the network ACL allow both outbound and the return traffic.
That last point catches people. Security groups are stateful — return traffic is allowed automatically. Network ACLs are stateless, so you must permit the return path explicitly. Volunteering that distinction is a strong signal.
What is the difference between a security group and a network ACL?
Security groups operate at the instance level, are stateful, and only support allow rules. Network ACLs operate at the subnet level, are stateless, support both allow and deny, and are evaluated in rule-number order.
Expect the follow-up: when would you use a network ACL? Answer: to block something explicitly at the subnet boundary, since security groups cannot express a deny.
What makes a subnet public?
Not its name or its address range. A subnet is public because its route table has a route to an internet gateway. That is the whole definition, and candidates who answer with anything else usually have not built a VPC themselves.
Do you need a NAT gateway for a private subnet?
Only if resources there need outbound internet access — for package updates, for example. If they only talk to other AWS services, VPC endpoints are cheaper and keep traffic off the public internet. Mentioning endpoints is a cost-awareness signal interviewers notice.
Identity and access
Explain IAM roles versus users.
A user represents a person and has long-lived credentials. A role is assumed temporarily and issues short-lived credentials, and is what applications and AWS services should use.
The follow-up worth pre-empting: why should an EC2 instance use a role rather than access keys on disk? Because keys on disk leak, get committed to repositories, and are rarely rotated. A role’s credentials rotate automatically and never exist as a file.
How would you debug an access denied error?
Method again. Identify the principal, the action and the resource from the error. Check the identity policy, then any resource policy, then permission boundaries and service control policies. Remember that an explicit deny anywhere wins over any allow.
Saying you would start by reading the error message properly, rather than immediately widening permissions, is the answer that separates candidates.
What does least privilege mean in practice?
Starting with nothing and adding only what fails, rather than starting with broad access and intending to tighten later. Everyone knows the definition; the practical question is whether you have actually worked that way, and interviewers often ask for an example.
Availability and design
How do you make an application highly available?
Multiple availability zones, behind a load balancer, with an Auto Scaling group, and a database with multi-AZ enabled.
The follow-up: what does multi-AZ actually give you? Automatic failover to a standby, not extra read capacity. Read replicas provide read scaling. Confusing the two is common and easily probed.
What is the difference between scaling up and scaling out?
Up is a bigger instance; out is more instances. Out is generally preferred because it removes a single point of failure and can respond to load automatically. Up has a ceiling and requires downtime on most instance types.
When would you choose Lambda over EC2?
For event-driven, short-duration, spiky workloads where you would otherwise pay for idle capacity. Be ready to say when it is wrong — long-running processes, workloads needing predictable low latency where cold starts hurt, or anything exceeding the execution time limit.
Candidates who can name where their preferred tool is inappropriate consistently interview better than those who advocate for it uniformly.
Storage
S3 storage classes — how do you choose?
By access frequency and retrieval urgency. Standard for frequent access, Infrequent Access for occasional, Glacier tiers for archival where retrieval time in minutes or hours is acceptable.
Follow-up: how do you move objects between classes without doing it manually? Lifecycle policies. This is a cost question wearing a storage costume.
How do you make an S3 bucket public, and should you?
Through bucket policy or ACL, and almost never. Public buckets are among the most common causes of data exposure incidents. The right answer names CloudFront with origin access control for public content delivery, and flags Block Public Access as the setting that should stay on.
Cost
The bill went up unexpectedly. How do you investigate?
Cost Explorer grouped by service, then by tag, to identify what changed and when. Common causes worth naming: data transfer between availability zones or out to the internet, forgotten test resources left running, unattached EBS volumes and old snapshots, and NAT gateway data processing charges.
That last one catches teams out regularly, and mentioning it signals real operational exposure.
How do you reduce compute cost without reducing capacity?
Right-sizing based on actual utilisation, reserved instances or savings plans for predictable baseline load, spot instances for interruptible work, and scheduling non-production environments to shut down overnight.
The question behind the questions
Tell me about something you built on AWS.
Have one architecture ready that you can describe end to end — what it does, why each component is there, what you would change, and what broke while you were building it.
That last part matters more than candidates expect. Everyone’s first VPC has a routing problem. Being able to describe how you diagnosed it demonstrates exactly the skill the job needs, and it is impossible to fake convincingly.