57 Cloud & AWS interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
Cloud computing lets teams rent compute, storage and networking on demand, and AWS is a platform that offers those services. The questions cover IaaS, PaaS and SaaS, compute and networking, storage classes and databases, IAM, load balancers, Multi-AZ versus Multi-Region design, the shared responsibility model, and cost-aware architecture.
and 8 more topics.
Cloud Computing is a model for delivering IT resources (servers, storage, networking, software) over the internet on a pay-as-you-go basis, eliminating the need for upfront physical infrastructure investment. The three models differ in which layers the provider runs and which you run: - IaaS (Infrastructure…
Amazon EC2 (Elastic Compute Cloud) is a service that provides virtual machines on AWS, allowing you to launch, configure, and manage servers with various operating systems and hardware configurations. Instance types are grouped into families; the first letter tells you what the family is optimized…
AWS Lambda is serverless compute: you upload the function code and Lambda handles provisioning, scaling and availability. Lambda fits when: the workload is event-driven (S3 triggers, SQS consumers, API Gateway), tasks are short (under 15 minutes), traffic is irregular or very low, and you want…
ECS is AWS's own container service: you declare a task definition (image, CPU, RAM) and a service (how many copies to run), and AWS handles orchestration. EKS is Kubernetes with an AWS-managed control plane: you work with Pods, Deployments and Helm as in any other…
Amazon API Gateway is a managed service that sits in front of your backend: it receives HTTP or WebSocket requests from clients, authenticates and rate-limits them, then forwards them to Lambda, services on EC2/ECS, or any HTTP endpoint. You don't have to build and scale…
Amazon VPC (Virtual Private Cloud) is an isolated virtual network within AWS that gives you full control over networking: choosing an IP range (CIDR), creating subnets, and configuring route tables and gateways. What separates a public subnet from a private one is the subnet's route…
Security Groups (SG) operate at the instance level (attached to an ENI) and are stateful — when inbound traffic is allowed, the outbound response is automatically permitted without a separate rule; they support only allow rules, no deny rules; they apply to EC2, RDS, Lambda…
Amazon Route 53 is AWS's managed, highly available DNS (Domain Name System) service with a 100% uptime SLA; the name comes from DNS port TCP/UDP 53. Routing policies: - Simple routing — maps a domain to a single IP/resource with no logic - Weighted routing…
Amazon CloudFront is AWS's CDN, with hundreds of edge locations worldwide. It caches content (HTML, CSS, JS, images, video) at edges near users to cut latency and take load off the origin. The flow: a request reaches the nearest edge → on a cache HIT…
AWS's three load balancers differ in which network layer they can read. ALB reads up to layer 7 (HTTP): it sees URLs, headers and cookies, so it can route by content. NLB reads only up to layer 4 (TCP/UDP): it sees IPs and ports and…
Storage classes are S3's storage tiers: every object lives in a bucket, but each tier has a different price per GB, retrieval fee and access speed. The less often data is read, the cheaper its tier should be. A lifecycle policy is a bucket rule…
DynamoDB is a serverless NoSQL key-value/document database: there is no server to manage, each item is looked up by its partition key (plus a sort key if present), and latency stays at the millisecond level as load grows. RDS runs relational databases (PostgreSQL, MySQL, MariaDB,…
Amazon ElastiCache is AWS's managed in-memory cache: you pick an engine and node size, and AWS provisions nodes, patches them and handles failover. The app puts it between itself and the database so hot data is read in hundreds of microseconds instead of hitting the…
These three differ in where the data lives and how many machines can share it: - EBS (Elastic Block Store): a virtual disk attached over the network to one EC2 instance, like a removable hard drive. Data lives independently of the machine, so it survives…
Amazon Aurora is AWS's relational database, compatible with MySQL and PostgreSQL but with a storage layer AWS rewrote. The key difference: compute and storage are separated. The architecture, bottom up: - Shared storage (cluster volume): data is written as 6 copies across 3 Availability Zones.…
Amazon Redshift is AWS's data warehouse. It stores data by column and spreads it across nodes that run in parallel to serve analytical (OLAP) queries on very large tables. RDS is a row-oriented database for OLTP: small reads and writes per record, many concurrent transactions.…
All three let parts of a system talk asynchronously, but they differ in who receives a message and how long it is kept. SQS is a queue: each message is processed by one consumer. SNS is pub/sub: each message is pushed to every subscriber. EventBridge…
Amazon Kinesis is a family of services for streaming data: continuous flows of events such as clicks, logs and sensor readings. Unlike a queue, a stream is an append-only log: records stay after being read, several consumers read the same data, and each tracks its…
AWS Step Functions is a serverless workflow orchestration service: you describe the steps as a state machine in Amazon States Language (JSON), and Step Functions calls each step, keeps state between steps, and retries or branches on errors. Your Lambdas keep only business logic. This…
AWS CloudFormation is AWS's Infrastructure as Code service: you describe resources (buckets, Lambdas, VPCs...) in a YAML/JSON template, and CloudFormation creates and manages them as a stack. AWS CDK lets you write infrastructure in TypeScript, Python, Java, Go or C; cdk synth turns the code…
AWS IAM decides two things inside an AWS account: who is calling (authentication) and what they may do to which resources (authorization). Everything is denied by default; access exists only when a policy allows it. - User: a fixed identity with long-term credentials (console password,…
Amazon CloudWatch is AWS's default monitoring service: it collects measurements and logs from resources and apps, alerts when something is off, and shows it on dashboards. The four concepts form a chain: metrics measure, logs record details, alarms watch metrics to alert, dashboards are for…
The standard answer is defense in depth: split the system into layers, each with its own protection, so if one layer is breached the attacker is still stopped at the next. Follow a request from the outside in: 1. Edge: CloudFront sits in front of…
The Shared Responsibility Model is the line that splits security duties between AWS and the customer. The short rule: AWS handles security of the cloud, the customer handles security in the cloud. - AWS is responsible for the foundational infrastructure: physical data centers, hardware, the…
These are two tiers of the AWS physical infrastructure. - A Region is a separate geographic area (e.g. ap-southeast-1 Singapore, us-east-1 N. Virginia). Each Region is fully isolated from the others physically and, by default, data does not leave the Region unless you deliberately move…
Stop is a pause, Terminate is a permanent delete. Stop (only for EBS-backed instances): - The instance shuts down like powering off a computer; the root EBS volume is preserved, so its data is intact when you start it again. - No compute charges while…
An AMI (Amazon Machine Image) is a read-only template with everything needed to launch an EC2 instance. An AMI contains: - One or more EBS snapshots (or an instance-store template) — i.e. the disk state: OS, libraries, installed applications, and configuration. - Launch permissions (who…
An instance in a private subnet has no direct route to the internet. To let it reach out (download updates, call APIs) while accepting no inbound connections, traffic must pass through a NAT placed in a public subnet. Two options: NAT Gateway — an AWS…
Both connect VPCs together; they differ in the connectivity model. VPC Peering is a one-to-one link between two VPCs: - Traffic goes directly, low latency, no hourly charge (you pay only data transfer). - Non-transitive: if A peers B and B peers C, A does…
Both are public IPv4 addresses for reaching an instance from the internet; they differ in stability and ownership. Auto-assigned public IP: - AWS assigns it from a shared pool when the instance launches (if the subnet has auto-assign on). - Not fixed: the IP is…
Because an IAM user access key is a long-lived credential: it never expires on its own, and once it leaks (committed to Git, printed to logs, baked into a Docker image) an attacker can use it until someone notices and revokes it manually. The right…
A presigned URL is an S3 URL pre-signed with the backend's credentials and carrying an expiry. Whoever holds it can perform exactly the signed operation (GET to download, PUT to write) on exactly one object, without holding any AWS credentials. Typical upload flow: 1. Client…
By default a log group's retention is Never expire — logs are kept forever and you pay storage forever. This is the most commonly forgotten CloudWatch cost. The first thing to do on a new log group is set retention (e.g. 14 or 30 days…
They solve two different problems: Multi-AZ is about availability, read replicas are about read scaling. Multi-AZ (single-standby deployment): - A standby sits in another AZ, replicated synchronously. - The standby serves no queries — you cannot connect to it. So the answer to the second…
That policy grants full S3 access to every bucket in the account, violating least privilege. Concretely: a service that only needs to read one bucket can also DeleteBucket, read another system's log/backup bucket, or overwrite data — so if the service is compromised, the blast…
Use OIDC federation: GitHub Actions issues a short-lived OIDC token per job run, AWS trusts that issuer, and the token is exchanged for temporary credentials via sts:AssumeRoleWithWebIdentity. No access key ever lives in repo secrets. Steps: 1. Create an IAM OIDC identity provider pointing at…
The ALB health check is a real HTTP request sent by the load balancer to the target, so "the app runs on the box" is not enough. Check in this order: 1. The target's security group must allow traffic from the ALB's security group on…
An ALB terminates the TCP connection and opens a new one to the target, so the remoteAddr your app sees is the ALB node's IP inside the subnet. The real client IP arrives in the X-Forwarded-For header, alongside X-Forwarded-Proto (original scheme) and X-Forwarded-Port. The security…
Blocking direct access: keep the bucket fully private (Block Public Access on) and use Origin Access Control (OAC). CloudFront signs requests to S3 with SigV4; the bucket policy allows only the cloudfront.amazonaws.com principal with a Condition pinning the distribution ARN. Hitting the S3 URL directly…
Decide by traffic shape, request duration, and how much operations the team can carry — not by which option sounds most modern. Lambda — pick it when traffic is sparse or bursty, requests are short (seconds), and you want zero server management. You pay per…
Both encrypt with KMS, authorize with IAM, and audit through CloudTrail. They differ on automatic rotation and price. Secrets Manager - Built-in rotation: attach a rotation Lambda, and AWS supplies ready-made rotation functions for RDS/Redshift/DocumentDB. - Supports cross-account access and replicating a secret to other…
AWS has more than 200 services, but a backend developer building web apps usually touches only 7–8 of them. The easiest way to remember them is to follow the path of a request: user → CDN → network → compute → data, with IAM wrapping…
There are three main options: API Gateway, Lambda Function URLs and ALB. A Function URL is the simplest and cheapest; API Gateway has the most API-management features; ALB fits when you already run a load balancer for other services. 1. Lambda Function URL — enabled…
