Why Good Cloud Engineer Candidates Still Get Rejected

Interviewer: How does your app upload files to S3?

Candidate:
I created an IAM user, generated access keys and put
them in the config file of the app. Then boto3 uses
them to upload. It works perfectly.

Interviewer: Where is that config file stored?

Candidate: In the GitHub repo, with the code.

(Correct about S3 and boto3. The habit is the problem.)

Interviewer: How does your app upload files to S3?

Candidate:
The EC2 instance has an IAM role through an instance
profile. The role allows PutObject only on the uploads
bucket. boto3 picks up temporary credentials from the
instance metadata automatically, so there are no keys
in the code or on disk.

When I run the app locally, I use my own AWS CLI
profile with SSO instead of long-lived keys.

import boto3

# Never do this: credentials in source code
s3 = boto3.client(
    "s3",
    aws_access_key_id="AKIAEXAMPLEKEY",
    aws_secret_access_key="example-secret-do-not-use",
    region_name="ap-south-1",
)

s3.upload_file("report.pdf", "photo-share-uploads-dev", "reports/report.pdf")

import boto3

# No credentials in code. boto3 looks for them in order:
# environment variables, the shared config/SSO profile,
# then the instance or container role.
s3 = boto3.client("s3", region_name="ap-south-1")

s3.upload_file("report.pdf", "photo-share-uploads-dev", "reports/report.pdf")

# Account-wide guardrail against public buckets:
# aws s3control put-public-access-block \
#   --account-id 111122223333 \
#   --public-access-block-configuration \
#   BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Console-only description:
"I opened EC2, clicked Launch Instance, chose t3.micro,
selected my key pair, opened port 80 and 22, and then
installed Nginx manually over SSH."

Same thing as code (user data in Terraform):
resource "aws_instance" "web" {
  ami                    = data.aws_ami.al2023.id
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.private_a.id
  vpc_security_group_ids = [aws_security_group.web.id]
  iam_instance_profile   = aws_iam_instance_profile.web.name

  user_data = <<-EOF
    #!/bin/bash
    dnf install -y nginx
    systemctl enable --now nginx
  EOF

  tags = { Name = "web", Owner = "lab" }
}

import boto3

# Find running EC2 instances with no Owner tag,
# a common clean-up task in shared accounts.
ec2 = boto3.client("ec2", region_name="ap-south-1")
paginator = ec2.get_paginator("describe_instances")

for page in paginator.paginate(
    Filters=[{"Name": "instance-state-name", "Values": ["running"]}]
):
    for reservation in page["Reservations"]:
        for inst in reservation["Instances"]:
            tags = {t["Key"]: t["Value"] for t in inst.get("Tags", [])}
            if "Owner" not in tags:
                print(inst["InstanceId"], inst["InstanceType"], tags.get("Name", "-"))

SECURITY
[ ] No access keys in any code or repo I share
[ ] My examples use IAM roles, not IAM users
[ ] No database or SSH port open to 0.0.0.0/0

WAY OF WORKING
[ ] At least one project fully in Terraform or CloudFormation
[ ] I can describe a change as plan -> review -> apply
[ ] I have one small script that automates a task

LINUX
[ ] I can check a service, ports, local response and logs

COST
[ ] I can name the most expensive part of my own setup
[ ] I have set a budget alarm on my lab account

Weakest section: __________ Fix by: __________

WEEK 1: SECURITY AND IaC
  Day 1-2  Remove keys from all repos, rotate them,
           switch the CLI to SSO or a role profile
  Day 3-5  Rebuild your main project in Terraform
  Day 6-7  Add scoped IAM policies, remove port 22

WEEK 2: LINUX AND COST
  Day 8-9   Break Nginx on purpose 3 ways, fix each
            using systemctl, ss, curl and journalctl
  Day 10-11 Write one boto3 or Bash clean-up script
  Day 12    Set an AWS Budget with an email alert
  Day 13-14 Mock interview: explain every project
            through code, not console clicks

Use these naturally in your examples:

Security:
  "The instance gets credentials from its role,
   so nothing is stored on disk."

Way of working:
  "I made that change in Terraform and reviewed
   the plan before applying it."

Linux:
  "First I would check whether the service is running
   and listening, then curl it locally."

Cost:
  "That adds a NAT Gateway per AZ, which is worth it
   in production but not in my dev setup."