The short answer: AWS interviews check that you can choose the right service and explain the trade-off, beyond naming services. Expect questions on fundamentals (Regions, Availability Zones, shared responsibility), IAM, EC2 and load balancers, storage (S3, EBS, EFS), VPC networking, Lambda, databases (RDS, Aurora, DynamoDB), messaging, monitoring, disaster recovery and cost, plus scenarios such as “this instance can’t reach the internet” or “the bill doubled”. The answers below are checked against AWS’s documentation, with sources at the end. AWS changes quickly, so the limits and dates are as of November 7, 2026.
Interviewing at Amazon itself rather than for an AWS skill? See our Amazon behavioral interview questions.
What changed recently
Most online question lists are out of date on these points, so mentioning them stands out:
- Lambda now has three compute types. Classic functions are now called Event Functions, joined by Web Functions (October 2026, Node.js HTTP servers) and MicroVMs (June 2026, isolated environments that live up to 8 hours). Durable functions run multi-step workflows for up to a year, and Managed Instances run functions on EC2 in your account.
- S3’s maximum object size is 50 TB, up from 5 TB, since December 2025.
- SQS and SNS messages can be 1 MiB, and asynchronous Lambda payloads 1 MB, up from 256 KB.
- The X-Ray SDKs and Daemon entered maintenance mode on February 25, 2026. AWS recommends OpenTelemetry for instrumentation.
- The Free Tier is now credit-based for accounts created since July 15, 2025: up to $200 in credits, and a Free plan that ends after 6 months or when the credits run out.
- Amazon SageMaker was renamed: the machine learning service is now SageMaker AI, and “SageMaker” is the wider data and AI platform.
Fundamentals
“Region, Availability Zone or edge location?”
A Region is a physical location with at least three isolated Availability Zones (AZs). An AZ is one or more data centers with redundant power, networking and connectivity. Edge locations are the CloudFront points of presence that serve content close to users. AWS’s site lists 124 AZs in 39 Regions as of November 2026. Design for failure by spreading workloads across at least two AZs.
“Explain the shared responsibility model.”
AWS is responsible for security of the cloud: the hardware, software, networking and facilities behind its services. You’re responsible for security in the cloud, and your share depends on the service. On EC2 you manage the guest operating system, applications and security configuration. With a managed service such as S3, you mainly manage your data and access.
“What is the Well-Architected Framework?”
AWS’s guidance for reviewing a design against six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. Name the pillars, then show the trade-off: for example, multi-Region reliability costs more.
IAM
“User, group, role or policy?”
- A user has a name and long-term credentials. AWS prefers federation with temporary credentials for people, and keeps IAM users for cases federation can’t cover.
- A group is a set of users that share permissions. Groups can’t be nested.
- A role has permissions but no long-term credentials. Assuming one gives temporary credentials, which is how EC2 instances and Lambda functions should get access.
- A policy defines permissions, usually as a JSON document.
Use IAM Identity Center for centralized human access, and keep the root user for the few tasks that need it, with MFA and no access keys.
“How does AWS evaluate a request?”
Every request starts implicitly denied. It needs an explicit allow, and any explicit deny overrides any allow. Within one account, identity-based and resource-based policies combine, so either can grant access. A service control policy (SCP) sets the maximum permissions for accounts in an organization: it never grants anything, and it doesn’t affect the management account.
Least privilege in practice, allowing one action on one bucket’s objects:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource":
"arn:aws:s3:::reports/*"
}
]
}“Identity-based or resource-based policy?”
An identity-based policy attaches to a user, group or role and says what that identity can do. A resource-based policy attaches to a resource, such as an S3 bucket, and says who can access it, which makes it useful for cross-account access.
Compute
“How do you pay for EC2?”
| Option | How it works | Use it for |
|---|---|---|
| On-Demand | Pay by the second, no commitment | Short or unpredictable workloads |
| Savings Plans | Commit to a $/hour spend for 1 or 3 years | Steady use, with flexibility |
| Reserved Instances | Commit to an instance configuration for 1 or 3 years | Steady use; zonal ones also reserve capacity |
| Spot | Spare capacity at up to 90% off | Fault-tolerant, interruptible work |
| Dedicated Hosts and Instances | Hardware not shared with other customers | Licensing or compliance needs |
Spot Instances get a two-minute interruption notice, so design for them to stop at any time.
“Stop or terminate an instance?”
Stopping keeps attached EBS volumes, so you can start the instance again. You lose RAM contents, data on instance store volumes and the automatically assigned public IPv4 address; an Elastic IP keeps the address. Terminating deletes the instance permanently, along with any EBS volumes set to delete on termination.
“Which load balancer would you use?”
- Application Load Balancer (ALB): layer 7, routes HTTP and HTTPS by path or host.
- Network Load Balancer (NLB): layer 4, millions of requests per second, static IPs.
- Gateway Load Balancer (GWLB): layer 3, for virtual appliances such as firewalls.
The Classic Load Balancer is previous generation. Pair a load balancer with EC2 Auto Scaling, which keeps a group between its minimum and maximum size at a desired capacity.
“ECS, EKS or Fargate?”
ECS is AWS’s own container orchestrator, with no control plane to manage. EKS is managed Kubernetes. Fargate isn’t a rival to either: it’s a compute option that runs containers without servers to manage, under ECS or EKS. Choose EKS if you want Kubernetes and its ecosystem, and ECS if you want the simplest AWS-native route. Our Kubernetes interview questions go deeper.
Storage
“S3, EBS, EFS or instance store?”
| Service | Type | Key facts |
|---|---|---|
| S3 | Object | Regional, accessed through an API; designed for 11 nines of durability |
| EBS | Block | Persists independently of the instance; lives in one AZ |
| EFS | Shared file (NFS) | Elastic; many instances at once, across AZs |
| Instance store | Temporary block | On the host’s disks; lost on stop, hibernate or terminate |
“How do you choose an S3 storage class?”
S3 Standard is the default. Intelligent-Tiering suits unknown or changing access patterns. Standard-IA and One Zone-IA are for infrequent access. Glacier Instant Retrieval, Flexible Retrieval and Deep Archive are for archives, from milliseconds to hours. Express One Zone is for the lowest latency. Automate the moves with lifecycle rules, which transition objects to cheaper classes or expire them. All classes except the One Zone options store data across at least three AZs.
“Is S3 strongly consistent?”
Yes. S3 delivers strong read-after-write consistency for object PUTs and DELETEs, and for list operations, in all Regions, at no extra cost. Older answers that say “eventually consistent” are out of date.
“How do you secure and protect an S3 bucket?”
New buckets block public access and disable ACLs by default, and AWS recommends keeping ACLs off: use bucket policies. All new uploads are encrypted by default with SSE-S3. Since April 2026, SSE-C is disabled by default on new buckets. Turn on versioning to protect against accidental deletes: a delete only adds a delete marker, though every stored version is billed.
“How do you upload a very large file?”
A single PUT tops out at 5 GB, so use multipart upload for anything larger. The maximum object size is now 50 TB.
Networking
“What makes a subnet public or private?”
Routing. A public subnet has a direct route to an internet gateway. A private subnet doesn’t, and uses a NAT gateway to reach out while blocking unsolicited inbound traffic. A subnet sits in one AZ and can’t span AZs.
“Security group or network ACL?”
| Security group | Network ACL | |
|---|---|---|
| Level | Instance | Subnet |
| Rules | Allow only | Allow and deny |
| Evaluation | All rules | In order, until a match |
| Return traffic | Allowed automatically (stateful) | Must be allowed (stateless) |
AWS treats security groups as the primary control, and network ACLs as a coarse secondary one, such as denying a subset of traffic.
“How do you reach S3 without going over the internet?”
Use a VPC endpoint. Gateway endpoints cover S3 and DynamoDB only, work through route tables and have no additional charge. Interface endpoints use PrivateLink, placing private IPs in your subnets; they work with many services, and for S3 they also allow access from on premises.
“VPC peering or Transit Gateway?”
Peering is a private one-to-one link. It isn’t transitive, CIDRs can’t overlap, and routes are manual. It suits a small number of VPCs and has the lowest overall cost, but a full mesh of 100 VPCs would need 4,950 connections. Transit Gateway is a Regional hub for thousands of VPCs, plus VPN and Direct Connect.
Lambda and serverless
“What are Lambda’s limits?”
Timeout: 3 seconds by default, up to 15 minutes. Memory: 128 MB to 10,240 MB, and CPU scales with memory. Default concurrency: 1,000 per Region, which can be raised; new accounts start lower. Payloads: 6 MB synchronous, 1 MB asynchronous.
“What is a cold start? How do you reduce it?”
A cold start is the code download and environment setup before a first run, which adds latency. Reused environments are warm starts. To reduce it: keep packages small, initialize clients outside the handler, use provisioned concurrency to keep environments ready (at extra charge), or SnapStart, which restores a snapshot, for Java, Python and .NET.
“Reserved or provisioned concurrency?”
Reserved concurrency sets aside capacity for a function and caps it, at no charge. Provisioned concurrency keeps environments pre-initialized for fast responses, for an additional charge.
“How do you process an SQS batch without retrying everything?”
Lambda reads queues through an event source mapping. If a function fails, the whole batch returns to the queue. Turn on ReportBatchItemFailures and return only the failed IDs, so successful messages aren’t processed again:
def handler(event, context):
failures = []
for record in event["Records"]:
try:
process(record["body"])
except Exception:
failures.append({
"itemIdentifier":
record["messageId"],
})
return {
"batchItemFailures": failures,
}Databases
“RDS, Aurora or DynamoDB?”
RDS is managed relational databases: Db2, MariaDB, SQL Server, MySQL, Oracle and PostgreSQL. Aurora, part of RDS, is MySQL- and PostgreSQL-compatible, keeps storage across three AZs and supports up to 15 replicas. DynamoDB is serverless NoSQL with single-digit millisecond performance. Choose relational for joins and transactions across varied queries, and DynamoDB when you know your access patterns and need to scale.
“Multi-AZ or read replicas?”
Multi-AZ is for availability: a synchronous standby in another AZ takes over on failure, and a classic standby can’t serve reads. Read replicas are for scale: read-only copies updated asynchronously, up to 15 on most engines, which can be promoted.
“How does DynamoDB work?”
A table has a partition key, hashed to choose physical storage, and optionally a sort key. Reads are eventually consistent by default; tables and local indexes also offer strongly consistent reads. A global secondary index can use a different partition key and can be added later, but reads are eventually consistent. A local secondary index keeps the partition key, must be created with the table, and limits each key value to 10 GB. On-demand is the default and recommended capacity mode; provisioned suits steady, predictable traffic.
“How do you take load off a database?”
Add read replicas, cache hot data in ElastiCache (Valkey, Memcached or Redis OSS), and fix slow queries first. Our SQL interview questions cover indexing.
Messaging
“SQS, SNS, EventBridge or Kinesis?”
| Service | Pattern | Use it for |
|---|---|---|
| SQS | Queue | Decoupling and buffering work |
| SNS | Pub/sub topic | Fanning out to many subscribers |
| EventBridge | Event bus and pipes | Routing events between services and SaaS apps |
| Kinesis Data Streams | Stream | Real-time data, replayable by several consumers |
“Standard or FIFO queue? What is a visibility timeout?”
Standard queues have nearly unlimited throughput, at-least-once delivery and best-effort ordering, so consumers must be idempotent. FIFO queues add strict ordering and exactly-once processing, with lower throughput. The visibility timeout (30 seconds by default, up to 12 hours) hides a message from other consumers while one works on it; set it longer than your processing time. Messages that keep failing go to a dead-letter queue after maxReceiveCount attempts. Retention is 4 days by default, up to 14.
Monitoring and security
“CloudWatch, CloudTrail or AWS Config?”
CloudWatch shows performance: metrics, logs, alarms and dashboards. CloudTrail shows who did what: actions recorded as events, with 90 days of management events available at no charge. AWS Config shows what a resource looks like, its history and whether it’s compliant.
“Secrets Manager or Parameter Store?”
Secrets Manager stores secrets with automatic rotation, and AWS recommends it for credentials and API keys. Parameter Store is a central store for configuration values and has no automatic rotation.
“Name the main security services.”
KMS manages encryption keys. WAF filters HTTP and HTTPS requests. Shield protects against DDoS attacks: Standard is automatic and free, and Advanced is a subscription. GuardDuty detects threats from CloudTrail, VPC flow logs and DNS logs.
“CloudFormation, CDK or Terraform?”
CloudFormation provisions resources from a template as a stack. The CDK defines infrastructure in a programming language and deploys through CloudFormation. Terraform is HashiCorp’s multi-cloud tool, which AWS documents and compares with its own options. Whichever you use, keep infrastructure in source control and review changes.
Disaster recovery
“What are RTO and RPO?”
RTO (recovery time objective) is the longest acceptable gap between an outage and restored service. RPO (recovery point objective) is the longest acceptable time since the last recovery point, so it measures data loss.
“What are the disaster recovery strategies?”
| Strategy | How it works | AWS’s RPO and RTO |
|---|---|---|
| Backup and restore | Restore from backups when needed | Hours; 24 hours or less |
| Pilot light | Data and core infrastructure on, app servers off | Minutes; tens of minutes |
| Warm standby | A smaller working copy, ready to scale | Seconds; minutes |
| Multi-site active/active | Several Regions serve traffic | Near zero; potentially zero |
Cost and complexity rise as you go down the table, so tie the choice to what the business can tolerate.
Cost
“Savings Plans or Reserved Instances?”
Both trade a 1- or 3-year commitment for a discount. Compute Savings Plans (up to 66% off) apply across instance families, Regions and Fargate or Lambda; EC2 Instance Savings Plans (up to 72%) are tied to a family in a Region. Savings Plans don’t reserve capacity, while zonal Reserved Instances do. Database Savings Plans are newer, with up to 35% off on a 1-year term.
“How do you find and reduce AWS costs?”
Use Cost Explorer to analyze spending and Budgets to alert on actual or forecast spend. Then look for the usual suspects: idle instances and volumes, oversized instances, NAT gateway data processing, cross-AZ traffic (charged in both directions), internet egress beyond the free 100 GB a month, and Elastic IPs, which are charged whether idle or in use. Move data to cheaper S3 classes with lifecycle rules, and use gateway endpoints so S3 traffic skips the NAT gateway.
Scenario questions
- “An EC2 instance in a public subnet can’t reach the internet.” Check the route table for an internet gateway route, a public IP or Elastic IP on the instance, security group and network ACL rules (ACLs need return traffic allowed), then use VPC flow logs.
- “The bill doubled this month.” Open Cost Explorer and group by service, then by usage type. Look for runaway Auto Scaling, data transfer, NAT processing or a forgotten resource, then set up Budgets alerts.
- “Design a highly available web app.” ALB across at least two AZs, an Auto Scaling group in private subnets, a Multi-AZ database, S3 and CloudFront for static content, and secrets in Secrets Manager. Say what you’d add for a second Region and what it costs.
- “A Lambda function is timing out.” Check logs and duration metrics, then look for slow downstream calls, cold starts, too little memory (CPU scales with it) or a VPC configuration problem.
- “Someone deleted production data from S3.” Recover from versioning by removing the delete marker. Find out who did it in CloudTrail, then prevent a repeat with least privilege, and MFA delete or S3 Object Lock if needed.
- “A queue keeps growing.” Consumers are too slow or failing. Check the dead-letter queue and consumer errors, scale consumers on queue depth, and check that the visibility timeout is longer than processing time.
Questions by role
- Cloud engineer or SysOps: VPC, IAM, monitoring, patching, backups, cost. See our DevOps engineer interview questions.
- Solutions architect: Well-Architected, high availability, disaster recovery, service trade-offs. See our solutions architect interview questions.
- Developer: Lambda, API Gateway, DynamoDB, SQS, IAM roles. See our backend developer interview questions.
- Data engineer: S3, Glue, Kinesis, Redshift, Athena. See our data engineer interview questions.
- AI roles: Amazon Bedrock gives managed access to foundation models; SageMaker AI builds, trains and deploys machine learning models.
AWS certifications
Certifications last three years. The current list includes Cloud Practitioner and AI Practitioner (foundational); Solutions Architect, Developer, CloudOps Engineer (formerly SysOps Administrator), Data Engineer and Machine Learning Engineer (associate); Solutions Architect, DevOps Engineer and Generative AI Developer (professional); and Security (specialty).
Recent and upcoming changes: Machine Learning Specialty retired on March 31, 2026, and Advanced Networking Specialty retires on December 31, 2026. The Solutions Architect Professional exam moves to SAP-C03 on November 17, 2026, and the Developer Associate exam to DVA-C03 on December 1, 2026.
Behavioral questions for cloud roles
Use the STAR method with a real example:
- “Tell me about an outage you handled. What was the cause, and what changed afterward?”
- “Describe a time you reduced cloud costs. How much did you save?”
- “Tell me about a migration to AWS. What went wrong?”
- “How did you convince a team to adopt a security or reliability practice?”
More: our system design interview guide, microservices interview questions, Kubernetes interview questions and software engineer interview questions.
Frequently asked questions
What AWS questions are asked in interviews?
What is the difference between a security group and a network ACL?
Is S3 strongly consistent?
What is the maximum Lambda timeout?
What is the difference between RTO and RPO?
What are the six pillars of the AWS Well-Architected Framework?
Can Huru help me practice AWS interview questions?
Sources
- AWS fundamentals: Global infrastructure, Regions and Availability Zones, Shared responsibility model and The pillars of the Well-Architected Framework. Read on 7 November 2026.
- IAM: Policies and permissions, Policy evaluation logic, Security best practices, Root user best practices and Service control policies. Read on 7 November 2026.
- Compute: EC2 purchasing options, Spot interruption notices, How stop and start works, Terminate instances, Elastic Load Balancing and Choosing a container service. Read on 7 November 2026.
- Storage: S3 storage classes, S3 data durability, What is S3?, S3 maximum object size, Block Public Access, SSE-C default setting and EC2 storage options. Read on 7 November 2026.
- Networking: Subnets, NAT gateways, Infrastructure security in Amazon VPC, Gateway endpoints, VPC peering basics and Multi-VPC network infrastructure. Read on 7 November 2026.
- Lambda: What is Lambda?, Quotas, Timeout, Provisioned concurrency, SnapStart, Durable functions, SQS error handling, Web Functions and MicroVMs. Read on 7 November 2026.
- Databases: What is Amazon RDS?, Aurora overview, Multi-AZ deployments, Read replicas, DynamoDB core components, Secondary indexes and On-demand capacity mode. Read on 7 November 2026.
- Messaging: SQS queue types, Visibility timeout, Message quotas, SNS, SQS or EventBridge? and Serverless payloads up to 1 MB. Read on 7 November 2026.
- Operations: CloudWatch, CloudTrail, AWS Config, X-Ray SDK and Daemon timeline, Secrets Manager, Parameter Store, Choosing an IaC tool and Disaster recovery options. Read on 7 November 2026.
- Cost and certifications: Savings Plans FAQ, Cost Explorer, Data transfer charges, AWS Free Tier, AWS Certification and September 2026 certification updates. Read on 7 November 2026.
