60 AWS Interview Questions and Answers (2026): EC2, S3, IAM, VPC

Last updated: October 2026

AWS shows up in far more interviews than "cloud engineer" job titles suggest. Backend developers get asked how they'd deploy their service. Data engineers get asked about S3 and Glue. DevOps engineers get grilled on VPCs and IAM. Even QA and support roles now get a few cloud basics.

The service list is huge (200+), but interviews focus on a core set: compute, storage, networking, identity, databases and monitoring. This guide covers 60 questions across those areas, from basics to the "design this for me" scenarios that come up for experienced candidates.

If you're preparing for a specific track, also see our AWS Lambda interview questions and AWS data engineer interview questions.

AWS interview questions: the quick answer

• What gets tested: EC2, S3, IAM, VPC (subnets, security groups, NAT), ELB and Auto Scaling, RDS vs DynamoDB, Lambda, CloudWatch, Route 53, and the Well-Architected pillars.
• Typical format: concept questions, then a whiteboard architecture ("host a web app that handles 10x traffic on sale days"), sometimes a hands-on console or Terraform task.
• What wins: explaining why you'd pick a service, plus cost and security awareness. "I'd put it in a private subnet" is a better answer than naming five services.
• Certifications: AWS Solutions Architect Associate helps shortlisting, especially at service companies and AWS partners.

Basic AWS interview questions (1–15)

1. What is AWS?

Amazon Web Services, Amazon's cloud platform. It offers computing power, storage, databases, networking, analytics, machine learning and much more on a pay-as-you-go basis, so companies rent infrastructure instead of buying servers.

2. What are IaaS, PaaS and SaaS? Give AWS examples.

• IaaS (infrastructure): you manage the OS and apps; AWS manages hardware. Example: EC2.
• PaaS (platform): you deploy code; AWS manages the runtime. Examples: Elastic Beanstalk, Lambda (often called FaaS).
• SaaS (software): a finished product you just use. Example: Amazon WorkMail, or any web app.

3. What are Regions and Availability Zones?

A Region is a geographic area, such as Mumbai (ap-south-1) or Hyderabad (ap-south-2). Each Region has multiple Availability Zones: separate data centres with independent power and networking, connected by low-latency links. Spreading resources across AZs protects you from a single data-centre failure.

4. What are edge locations?

Sites around the world used by CloudFront (the CDN) and Route 53 to cache content and answer DNS close to users. There are far more edge locations than Regions.

5. What is the shared responsibility model?

AWS is responsible for security of the cloud: hardware, data centres, the network and managed-service internals. You're responsible for security in the cloud: your data, IAM users and permissions, OS patches on EC2, security group rules and encryption settings.

6. What is EC2?

Elastic Compute Cloud: virtual servers you can launch in minutes. You choose the instance type (CPU, memory), an AMI (OS image), storage, network and security group, and you pay per second or per hour while it runs.

7. What are the EC2 instance families?

General purpose (t and m families), compute optimised (c), memory optimised (r and x), storage optimised (i and d) and accelerated computing (p and g for GPUs, inf and trn for ML chips). Graviton instances (with a "g" in the name, such as m7g) use AWS's ARM chips and are often cheaper for the same performance.

8. What are the EC2 pricing models?

9. What is an AMI?

An Amazon Machine Image: a template containing the OS, software and configuration used to launch EC2 instances. Teams create "golden AMIs" with their standard setup baked in.

10. What is S3?

Simple Storage Service: object storage for any amount of data, such as files, backups, logs, images and data lake files. Data is stored as objects inside buckets and is designed for 99.999999999% (eleven nines) durability.

11. What are the S3 storage classes?

S3 Standard (frequent access), Intelligent-Tiering (moves data between tiers automatically), Standard-IA and One Zone-IA (infrequent access), and the Glacier tiers (Instant Retrieval, Flexible Retrieval, Deep Archive) for archives. Colder tiers are cheaper to store but cost more, and take longer, to retrieve.

12. What is EBS?

Elastic Block Store: network-attached block storage volumes for EC2, like a hard disk. A volume lives in one AZ, persists after the instance stops, and can be backed up with snapshots. Types include gp3 (general SSD), io2 (high IOPS) and st1/sc1 (HDD).

13. EBS vs EFS vs S3?

14. What is IAM?

Identity and Access Management: controls who (users, groups, roles) can do what (actions) on which resources, through JSON policies. IAM is global, not tied to one Region.

15. What is the difference between an IAM user, group and role?

A user is a long-term identity for a person or app with credentials. A group is a collection of users that share policies. A role is an identity with temporary credentials that users, AWS services (such as an EC2 instance) or other accounts can assume. Prefer roles everywhere; avoid long-lived access keys.

Networking and security (16–30)

16. What is a VPC?

A Virtual Private Cloud: your own isolated network inside AWS. You choose the IP range (CIDR), create subnets across AZs, and control routing, internet access and firewall rules.

17. Public vs private subnets?

A public subnet has a route to an Internet Gateway, so resources with public IPs can be reached from the internet, such as load balancers and bastion hosts. A private subnet has no direct internet route; app servers and databases go here.

18. What is a NAT Gateway?

It lets instances in a private subnet make outbound internet connections, for example to download updates, without accepting inbound connections. It sits in a public subnet. NAT Gateways charge per hour and per GB processed, so they're a common hidden cost.

19. Security groups vs network ACLs?

20. How do you connect two VPCs?

VPC peering for a simple one-to-one connection (it isn't transitive). Transit Gateway as a hub to connect many VPCs and on-premises networks. PrivateLink to expose one specific service privately to other VPCs.

21. How do you connect an office data centre to AWS?

Site-to-Site VPN over the internet (quick to set up, encrypted, variable performance) or Direct Connect, a dedicated private line with consistent bandwidth, which takes longer and costs more. Many companies use a VPN as backup to Direct Connect.

22. What is a VPC endpoint?

A private connection from your VPC to AWS services without going over the internet or through a NAT Gateway. Gateway endpoints (free) cover S3 and DynamoDB; interface endpoints (PrivateLink) cover most other services. They improve security and can cut NAT costs a lot.

23. What is Elastic Load Balancing, and what types exist?

ELB spreads traffic across targets in multiple AZs. Application Load Balancer works at layer 7 (HTTP/HTTPS) with path and host-based routing. Network Load Balancer works at layer 4 (TCP/UDP) for very high performance and static IPs. Gateway Load Balancer is for third-party network appliances like firewalls.

24. What is Auto Scaling?

An Auto Scaling Group keeps the right number of EC2 instances running. It replaces unhealthy instances and adds or removes instances based on policies: target tracking (for example, keep CPU at 50%), step scaling, scheduled scaling (scale up before a 9 a.m. rush) or predictive scaling.

25. What is Route 53?

AWS's DNS service. Besides normal DNS, it supports routing policies: simple, weighted (canary releases), latency-based, failover (with health checks), geolocation and geoproximity.

26. What is CloudFront?

AWS's CDN. It caches content at edge locations so users get it faster, reduces load on the origin (S3, an ALB or any server), terminates TLS, and works with AWS WAF and Shield for protection.

27. What is an IAM policy, and how is it evaluated?

A JSON document with statements of Effect (Allow/Deny), Action, Resource and optional Conditions. Evaluation: everything is denied by default, an explicit Allow grants access, and an explicit Deny always wins.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::reports-bucket/*"
  }]
}

28. What is the principle of least privilege?

Give each identity only the permissions it needs, and nothing more. In practice: start narrow, use IAM Access Analyzer to find unused permissions, and avoid "Action": "*".

29. How do you give an EC2 instance access to S3 securely?

Create an IAM role with an S3 policy and attach it to the instance through an instance profile. The app gets temporary credentials automatically from the instance metadata service (use IMDSv2). Never put access keys in code or config files.

30. How do you protect data in S3?

Keep Block Public Access on, use bucket policies with least privilege, enable default encryption (SSE-S3 or SSE-KMS), turn on versioning (and MFA Delete or Object Lock for critical data), log access, and use VPC endpoints for private access.

Databases, serverless and monitoring (31–45)

31. What is RDS?

Relational Database Service: managed MySQL, PostgreSQL, MariaDB, Oracle, SQL Server and Db2. AWS handles provisioning, patching, backups and failover; you handle schema, queries and tuning.

32. What is Aurora, and how is it different from RDS MySQL?

Aurora is AWS's MySQL- and PostgreSQL-compatible database with its own distributed storage layer. Data is copied six ways across three AZs, it fails over faster, supports up to 15 read replicas, and offers Aurora Serverless v2 for automatic scaling. It generally costs more than standard RDS.

33. Multi-AZ vs read replicas?

Multi-AZ keeps a standby in another AZ for high availability and automatic failover; the standby isn't for reads (except in the newer Multi-AZ cluster option). Read replicas are copies, updated asynchronously, used to scale reads, and can be promoted if needed.

34. What is DynamoDB?

A fully managed NoSQL key-value and document database with single-digit-millisecond performance at any scale. You design around access patterns using a partition key (and optional sort key); it offers on-demand or provisioned capacity.

35. RDS vs DynamoDB: when do you use which?

Use RDS/Aurora when you need joins, complex queries, strong relational integrity or ad-hoc reporting. Use DynamoDB when access patterns are known, you need massive scale with predictable low latency, and you want no servers to manage, as with sessions, carts, IoT data and leaderboards.

36. What is ElastiCache?

Managed in-memory caching with Redis OSS, Valkey or Memcached. It's used to cache database results, store sessions, run leaderboards and handle rate limiting, which reduces database load and latency.

37. What is AWS Lambda?

Serverless compute: you upload a function, and AWS runs it in response to events (API calls, S3 uploads, queue messages, schedules), scaling automatically. You pay per request and per millisecond of run time. Limits to remember: a 15-minute maximum run time and up to 10 GB of memory. More in our AWS Lambda interview questions.

38. What is a Lambda cold start, and how do you reduce it?

The extra delay when AWS creates a new execution environment. Reduce it with smaller packages, fewer heavy dependencies, more memory (which also gives more CPU), provisioned concurrency for latency-sensitive APIs, and SnapStart for Java, Python and .NET.

39. SQS vs SNS vs EventBridge?

SQS is a queue: one consumer group pulls messages, and it's great for decoupling and buffering. SNS is pub/sub: one message is pushed to many subscribers. EventBridge is an event bus with content-based routing rules, schedules and integrations with SaaS apps. A common pattern is SNS fan-out to multiple SQS queues.

40. Standard vs FIFO SQS queues?

Standard queues offer nearly unlimited throughput with at-least-once delivery and best-effort ordering. FIFO queues guarantee order (within a message group) and exactly-once processing, with lower throughput limits.

41. What is API Gateway?

A managed service for creating REST, HTTP and WebSocket APIs in front of Lambda, containers or any HTTP backend. It handles authorisation, throttling, caching and request validation.

42. ECS vs EKS vs Fargate?

ECS is AWS's own container orchestrator, simpler to run. EKS is managed Kubernetes, for teams that want the Kubernetes ecosystem or portability. Fargate is a serverless compute engine for both, so you don't manage EC2 nodes. See our Kubernetes interview questions.

43. What is CloudWatch?

AWS's monitoring service: metrics (CPU, latency, custom metrics), logs (CloudWatch Logs and Logs Insights queries), alarms that trigger notifications or auto scaling, and dashboards.

44. CloudWatch vs CloudTrail?

CloudWatch tells you how your resources are performing. CloudTrail records who did what: every API call in your account, with the user, time and source IP. Use CloudTrail for audits and security investigations.

45. What is AWS Config?

A service that records resource configurations over time and checks them against rules, for example "all S3 buckets must be encrypted" or "no security group allows SSH from 0.0.0.0/0". It's useful for compliance and drift detection.

DevOps, cost and architecture (46–60)

46. What is CloudFormation?

AWS's infrastructure-as-code service. You describe resources in YAML or JSON templates and CloudFormation creates, updates and deletes them as a stack. AWS CDK lets you write the same thing in TypeScript, Python or Java. Many companies use Terraform instead, so mention that if you know it.

47. How do you build a CI/CD pipeline on AWS?

Code in GitHub or CodeCommit → build and test with CodeBuild (or GitHub Actions / Jenkins) → store artefacts in S3 or ECR → deploy with CodeDeploy, ECS rolling or blue-green, or CloudFormation/Terraform → orchestrate with CodePipeline. Add approval stages and automatic rollback on failed health checks.

48. What are the six pillars of the AWS Well-Architected Framework?

Operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. Using these as a checklist in design answers looks very structured.

49. How do you reduce an AWS bill?

Rightsize instances using Compute Optimizer, buy Savings Plans for steady usage, use Spot for fault-tolerant jobs, move to Graviton, add S3 lifecycle rules, delete idle resources (unattached EBS volumes, old snapshots, idle load balancers), cut NAT costs with VPC endpoints, and set AWS Budgets alerts. Tag everything so costs can be traced to teams.

50. RTO vs RPO, and what are the disaster recovery strategies?

RTO is how long you can be down; RPO is how much data you can afford to lose. Strategies, from cheapest and slowest to most expensive and fastest: backup and restore, pilot light, warm standby, and multi-site active-active.

51. What is the difference between high availability and fault tolerance?

High availability means minimal downtime: if something fails, you recover quickly, as with Multi-AZ RDS failing over in about a minute. Fault tolerance means no interruption at all, even during a failure, which usually needs fully redundant active components and costs more.

52. How do you store secrets in AWS?

Secrets Manager for database passwords and API keys, with automatic rotation. Systems Manager Parameter Store for configuration, with SecureString for simple secrets. Both encrypt with KMS and control access through IAM.

53. What is KMS?

Key Management Service: creates and manages encryption keys, and integrates with S3, EBS, RDS and most other services. You control who can use each key through key policies, and every use is logged in CloudTrail.

54. How do you secure an AWS account from day one?

Lock away the root user (with MFA, never used day to day), use AWS Organizations with separate accounts for prod and non-prod, sign-in through IAM Identity Center (SSO), enable CloudTrail in all Regions, GuardDuty and Security Hub, enforce MFA, apply least privilege, and set billing alerts.

55. Design a highly available web application on AWS.

1. Route 53 and CloudFront in front, with WAF.
2. An Application Load Balancer across at least 2 AZs.
3. An Auto Scaling Group of EC2 instances, or ECS/EKS tasks, in private subnets.
4. Aurora or RDS Multi-AZ in private subnets, with read replicas if reads are heavy.
5. ElastiCache for sessions and hot data.
6. S3 and CloudFront for static assets.
7. CloudWatch alarms, centralised logs, and backups with a tested restore.

56. Traffic will be 10x on a sale day. How do you prepare?

Load test ahead of time, pre-warm with scheduled scaling, raise service quotas, put CloudFront in front for static and cacheable content, add caching for hot reads, move heavy work to queues (SQS) with workers, protect the database with read replicas and connection pooling (RDS Proxy), and have a rollback plan and dashboards ready.

57. Your EC2 instance in a private subnet can't reach the internet. How do you debug it?

Check, in order: the subnet's route table has 0.0.0.0/0 pointing to a NAT Gateway, the NAT Gateway is in a public subnet with a route to the Internet Gateway, the security group allows outbound traffic, the network ACL allows outbound and return (ephemeral) ports, and DNS resolution is enabled in the VPC. VPC Reachability Analyzer can test the path for you.

58. How would you build a simple data lake on AWS?

Land raw data in S3 (partitioned by date), catalogue it with the Glue Data Catalog and crawlers, transform it with Glue jobs or EMR into Parquet, query it with Athena, govern access with Lake Formation, and visualise it in QuickSight or Power BI. More in our AWS data engineer interview questions.

59. A developer accidentally made an S3 bucket public. What do you do?

Immediately turn on Block Public Access and remove the public policy or ACLs. Check access logs and CloudTrail to see what was accessed, rotate any exposed secrets, and assess data exposure with security and legal teams. Then prevent repeats: account-level Block Public Access, an SCP or AWS Config rule, and alerts.

60. Monolith on one EC2 server vs a serverless rewrite: how would you advise a startup?

Don't rewrite for the sake of it. First get the basics right: move to an ALB with an Auto Scaling Group or containers across 2 AZs, a managed database, and backups. Then move specific pieces where serverless clearly helps, like image processing, scheduled jobs and webhooks, to Lambda. Base the decision on traffic patterns, team skills and cost.

Common mistakes candidates make

• Listing services without explaining why you'd pick them.
• Putting databases in public subnets in design answers.
• Forgetting cost entirely. Interviewers notice when NAT Gateway and data transfer never come up.
• Using IAM users with access keys where a role is the right answer.
• Single-AZ designs for anything called "production".

A 7-day AWS prep plan

Set a billing alarm on day 1. People forget, and NAT Gateways aren't free.

Which roles ask AWS, and what they pay

AWS is core for cloud engineers, DevOps and SRE roles, solutions architects, backend developers and data engineers. See the DevOps engineer salary guide and Weekday's salary pages for 2026 pay.

Related prep: DevOps interview questions, Linux interview questions, Microservices interview questions and AWS DevOps engineer resume examples.

Frequently asked questions

Is AWS good for freshers?

Yes. Many companies hire freshers into cloud support, DevOps and backend roles where AWS basics are expected. Pair the AWS Cloud Practitioner or Solutions Architect Associate certificate with 2–3 small hands-on projects.

Which AWS certification is best for interviews?

Solutions Architect Associate is the most recognised starting point. Developer Associate suits backend developers; the CloudOps Engineer Associate (formerly SysOps Administrator) or DevOps Engineer Professional suits DevOps roles.

Do I need to know coding for AWS roles?

For cloud support, basic scripting (Bash or Python) is enough. DevOps and cloud engineering roles expect scripting plus infrastructure as code (Terraform or CloudFormation). Backend roles expect real programming skills plus AWS.

AWS vs Azure vs GCP: which should I learn?

AWS has the largest share of cloud jobs in India, so it's the safest first choice. Azure is strong in enterprises already using Microsoft; GCP is common in data and analytics teams. Core concepts transfer between them.

How long does it take to prepare for an AWS interview?

With a basic IT background, 3–4 weeks of daily practice is enough for associate-level interviews. Senior architecture roles need real project experience, which no amount of reading replaces.

Ready for cloud roles? Find AWS, cloud and DevOps jobs on Weekday, and check your resume with our free ATS resume checker first.