Top 50 AWS Interview Questions and Answers

• Compute: EC2, Lambda, ECS, EKS
• Storage: S3, EBS, EFS, Glacier
• Database: RDS, DynamoDB, Redshift, Aurora
• Networking: VPC, Route 53, CloudFront, ELB
• Security: IAM, KMS, WAF, Shield
• Management: CloudWatch, CloudTrail, Config

• EC2 — virtual servers (instances) that run continuously. You manage the OS, patches, and scaling. Billed per second/hour.
• Lambda — serverless compute service that runs code in response to events. No infrastructure management. Billed per invocation and compute time.

// Lambda example (Node.js)
        exports.handler = async (event) => {
          console.log('Event:', event);
          return { statusCode: 200, body: 'Hello from Lambda!' };
        };

• Launch Template/Configuration — defines instance settings (AMI, instance type, etc.).
• Auto Scaling Group — manages the fleet of instances.
• Scaling Policy — defines when to scale (e.g., based on CPU utilization, custom metrics, or schedule).

• Application Load Balancer (ALB) — Layer 7, HTTP/HTTPS, path-based routing, WebSocket support.
• Network Load Balancer (NLB) — Layer 4, TCP/UDP, ultra-low latency, high throughput.
• Gateway Load Balancer (GWLB) — Layer 3, deploys and scales third-party virtual appliances.
• Classic Load Balancer (CLB) — legacy, Layer 4/7, not recommended for new workloads.

• ECS (Elastic Container Service) — AWS's own container orchestration service. It runs Docker containers on a cluster of EC2 instances or using Fargate (serverless).
• EKS (Elastic Kubernetes Service) — managed Kubernetes service. It runs Kubernetes control plane and workers, compatible with standard Kubernetes tooling.

// Fargate task definition snippet
        {
          "family": "my-app",
          "requiresCompatibilities": ["FARGATE"],
          "cpu": "256",
          "memory": "512",
          "containerDefinitions": [
            { "name": "web", "image": "nginx:latest" }
          ]
        }

• Region — a geographical area with multiple Availability Zones (e.g., us-east-1 in N. Virginia).
• Availability Zone (AZ) — one or more distinct data centers within a Region, isolated from failures in other AZs.
• Edge Location — a CDN endpoint used by CloudFront to cache content closer to users (hundreds globally).

• On-Demand — pay per second/hour, no commitment. Ideal for unpredictable workloads.
• Reserved Instances — 1- or 3-year commitment, significant discount (up to 72%). Standard or Convertible.
• Spot Instances — bid for unused capacity, up to 90% discount. Can be terminated with 2-minute notice. Great for fault-tolerant workloads.
• Savings Plans — flexible pricing model with commitment to compute usage (EC2, Fargate, Lambda).
• Dedicated Hosts — physical servers dedicated to you for compliance/licensing needs.

• S3 (Simple Storage Service) — object storage for unstructured data. Accessible via API/HTTP, stores files (objects) in buckets. Designed for durability (11 9's).
• EBS (Elastic Block Store) — block storage for EC2 instances. Acts like a virtual hard drive, attached to a single instance (or multiple with EBS Multi-Attach).

• S3 Standard — high durability, availability, low latency. For frequently accessed data.
• S3 Intelligent-Tiering — automatically moves data between access tiers to optimize costs.
• S3 Standard-IA (Infrequent Access) — lower storage cost, higher retrieval fee. For data accessed less frequently.
• S3 One Zone-IA — lower cost but stored in a single AZ (less durable).
• S3 Glacier Instant Retrieval — millisecond retrieval, for archives.
• S3 Glacier Flexible Retrieval — minutes to hours retrieval, for backups.
• S3 Glacier Deep Archive — lowest cost, 12+ hours retrieval, for long-term archives.

• RDS (Relational Database Service) — managed relational databases (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, Aurora). Supports SQL, ACID transactions, joins.
• DynamoDB — NoSQL key-value and document database. Fully managed, serverless, single-digit millisecond latency at any scale. Supports JSON, pay-per-request.

• 5x better performance than standard MySQL.
• 3x better performance than standard PostgreSQL.
• Storage automatically scales up to 128 TB.
• Six copies of data across 3 AZs.
• Continuous backups to S3.

-- Redshift query example
        SELECT product_name, SUM(sales) as total_sales
        FROM sales_data
        GROUP BY product_name
        ORDER BY total_sales DESC
        LIMIT 10;

• EBS — block storage, single AZ, attached to one EC2 instance (or multi-attach), low latency.
• EFS (Elastic File System) — file storage, multi-AZ, scalable, POSIX-compliant, can be mounted by multiple EC2 instances simultaneously.
• S3 — object storage, region-level, accessed via API/HTTP, 11 9's durability, unlimited storage.

• S3 File Gateway — presents S3 as NFS/SMB file shares.
• Volume Gateway — presents iSCSI block storage volumes.
• Tape Gateway — replaces physical tape backups with virtual tapes in S3/Glacier.

• Improved read performance for read-heavy applications.
• Can be promoted to a standalone primary DB.
• Cross-region replication available.

-- Create a read replica using AWS CLI
        aws rds create-db-instance-read-replica \
          --db-instance-identifier my-replica \
          --source-db-instance-identifier my-primary-db

• Multi-AZ — provides high availability. A standby replica in another AZ is automatically promoted during failure. Failover is automatic and seamless (for disaster recovery).
• Read Replica — provides read scaling. It's a read-only copy used to offload read traffic. Failover is manual (can be promoted).

• SQL (RDS, Aurora, Redshift) — structured schema, ACID transactions, complex joins, vertical scaling.
• NoSQL (DynamoDB, ElastiCache, DocumentDB) — flexible schema, horizontal scaling, high throughput, lower latency for simple queries.

• IP address range (CIDR block).
• Subnets (public and private).
• Route tables, internet gateways, NAT gateways.
• Security groups and network ACLs.

• Security Group — operates at the instance level (ENI). Stateful (return traffic automatically allowed). Supports allow rules only. Evaluated before NACL.
• Network ACL — operates at the subnet level. Stateless (must define both inbound and outbound rules). Supports allow and deny rules. Evaluated in rule number order.

// Security Group: allow inbound HTTP from anywhere
        Inbound: 0.0.0.0/0, port 80, allow
        Outbound: (automatic, all traffic allowed)
        
        // Network ACL: allow inbound HTTP
        Inbound: 0.0.0.0/0, port 80, allow
        Outbound: 0.0.0.0/0, port 1024-65535, allow (ephemeral ports)

• Internet Gateway (IGW) — horizontally scaled, redundant VPC component that allows communication between your VPC and the internet. Attached to the VPC.
• NAT Gateway — allows instances in private subnets to initiate outbound traffic to the internet, but prevents inbound traffic from the internet. It's managed and highly available.

• Connecting applications across different VPCs.
• Sharing resources (e.g., shared services VPC).
• Multi-account architecture.

• Supports transitive routing between connected networks.
• Scales up to thousands of VPC attachments.
• Reduces network complexity.

• Simple — one record, one IP.
• Weighted — distribute traffic proportionally.
• Latency-based — route to the region with the lowest latency.
• Failover — active-passive with health checks.
• Geolocation — route based on user location.
• Geoproximity — route based on geographic distance.
• Multi-value — returns multiple healthy IPs.

• AWS Shield — managed DDoS protection service. Shield Standard is free and protects against common attacks. Shield Advanced provides 24/7 support, cost protection, and enhanced monitoring.
• AWS WAF (Web Application Firewall) — protects web applications from common web exploits (SQL injection, XSS, etc.) by filtering HTTP/HTTPS traffic based on rules.

• Free public certificates.
• Automatic renewal.
• Centralized certificate management.

// Request a certificate via AWS CLI
        aws acm request-certificate \
          --domain-name example.com \
          --validation-method DNS

• Delivering static and dynamic web content.
• Streaming video and audio.
• API acceleration.
• Protecting origin servers from direct traffic.

• Public Subnet — has a route to an Internet Gateway (IGW), allowing instances to be directly accessible from the internet. Instances get public IPs.
• Private Subnet — no route to IGW. Instances cannot be accessed directly from the internet. They use NAT Gateway/VPN for outbound internet access.

• Users — individual identities with permanent credentials.
• Groups — collections of users with shared permissions.
• Roles — assumed by users, services, or applications to grant temporary permissions.
• Policies — JSON documents defining permissions (what actions are allowed/denied on which resources).

• IAM User — a permanent identity with long-term credentials (access key + secret key). Used by individuals or applications with fixed access needs.
• IAM Role — a temporary identity that can be assumed by users, applications, or AWS services. Provides temporary security credentials via STS.

• Start with no permissions and add only what's needed.
• Use managed policies where possible.
• Regularly review and audit permissions.
• Use IAM Access Analyzer to identify unused permissions.

• Version — policy language version (e.g., "2012-10-17").
• Statement — array of permission statements.
• Sid — optional statement ID.
• Effect — "Allow" or "Deny".
• Action — list of AWS service actions (e.g., "s3:GetObject").
• Resource — list of ARNs the action applies to.
• Condition — optional conditions (e.g., IP range, date).

{
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::my-bucket/*"
            }
          ]
        }

• Cross-account access — allowing users from one account to access resources in another.
• Federation — allowing external identities (AD, Google, etc.) to access AWS.
• EC2 Instance Profiles — granting EC2 instances temporary permissions to access other AWS services.
• MFA-protected API access.

// Assume a role via STS CLI
        aws sts assume-role \
          --role-arn arn:aws:iam::123456789012:role/my-role \
          --role-session-name my-session

• Managed Policy — standalone policy that can be attached to multiple users, groups, or roles. Managed by AWS (AWS-managed) or by you (customer-managed).
• Inline Policy — embedded directly into a single user, group, or role. It's exclusive to that entity and cannot be reused.

• Consolidated Billing — combine usage across accounts for volume discounts.
• Service Control Policies (SCPs) — centrally enforce permission boundaries.
• Account Management — create, invite, and manage accounts.
• Hierarchical Structure — organize accounts into Organizational Units (OUs).

• Centralized key management.
• Integration with many AWS services (S3, EBS, RDS, etc.).
• Key rotation (automatic).
• Access controls via IAM.
• Audit capabilities with CloudTrail.

// Encrypt data using KMS via CLI
        aws kms encrypt \
          --key-id alias/my-key \
          --plaintext fileb://data.txt \
          --output text \
          --query CiphertextBlob > encrypted.b64

• Automatic rotation of secrets.
• Fine-grained access controls with IAM.
• Audit logging with CloudTrail.
• Integration with RDS, Redshift, and other services.

• KMS — focuses on encryption key management. It encrypts and decrypts data using cryptographic keys.
• Secrets Manager — focuses on storing and managing sensitive information (secrets) with automatic rotation. It may use KMS for encryption.

• Operational Excellence — run and monitor systems effectively (automation, observability).
• Security — protect data, systems, and assets (IAM, encryption, compliance).
• Reliability — recover from failures, meet business requirements (HA, DR, fault tolerance).
• Performance Efficiency — use resources efficiently (right-sizing, scaling, caching).
• Cost Optimization — avoid unnecessary costs (right-sizing, spot, reserved instances).

• High Availability (HA) — ensuring that a system remains operational and accessible with minimal downtime. Achieved through redundancy (multi-AZ, load balancing, auto-scaling).
• Disaster Recovery (DR) — the process of restoring systems and data after a catastrophic failure (e.g., region outage). Includes RTO and RPO.

• RTO (Recovery Time Objective) — the maximum acceptable amount of time to restore a system after a failure. Shorter RTO = faster recovery.
• RPO (Recovery Point Objective) — the maximum acceptable amount of data loss measured in time. Shorter RPO = less data loss.

• Consistent, repeatable deployments.
• Version-controlled infrastructure.
• Automated rollbacks.
• Resource dependencies are handled automatically.

// CloudFormation YAML snippet
        Resources:
          MyEC2Instance:
            Type: AWS::EC2::Instance
            Properties:
              InstanceType: t2.micro
              ImageId: ami-0abcdef1234567890

• CloudFormation — AWS-native IaC service. Deep integration with AWS, uses AWS-specific syntax (JSON/YAML). Only supports AWS resources.
• Terraform — open-source IaC tool by HashiCorp. Supports multiple cloud providers (AWS, Azure, GCP, etc.) and uses HCL (HashiCorp Configuration Language).

• Source: CodeCommit, GitHub, S3.
• Build: CodeBuild, Jenkins.
• Deploy: CodeDeploy, Elastic Beanstalk, ECS, S3.

• In-place — stops and restarts the application on each instance.
• Blue/Green — deploys to a new environment, then switches traffic.
• Canary — gradually rolls out changes to a subset of users.

// appspec.yml for CodeDeploy
        version: 0.0
        os: linux
        files:
          - source: /
            destination: /var/www/html
        hooks:
          AfterInstall:
            - location: scripts/restart.sh
              timeout: 300

• Metrics — collect and track operational data (CPU, memory, disk, custom metrics).
• Logs — collect, monitor, and analyze log files.
• Alarms — trigger actions based on metric thresholds.
• Dashboards — visualize metrics in customizable dashboards.
• Events — respond to changes in AWS resources (EventBridge).

• CloudWatch — monitors performance and operational metrics of AWS resources (e.g., CPU utilization, request count).
• CloudTrail — records API calls made to AWS services for auditing, security analysis, and troubleshooting.

• Continuously records resource configuration changes.
• Evaluates configurations against desired rules (e.g., S3 bucket public access).
• Provides a history of configuration changes.
• Integrates with CloudTrail for compliance auditing.