AWS interview questions: scenarios, freshers to experienced

Most AWS interview questions come from five areas: compute (EC2 and Lambda), storage (S3 and EBS), databases (RDS, Aurora, DynamoDB), networking (VPC) and IAM. Freshers are asked what a service is and when to choose it; experienced engineers get a scenario and are judged on the trade-offs, the failure modes and the cost. This guide covers both levels, then works four scenarios end to end in the order interviewers score them: clarify, design, trade-off, failure, cost.

It also separates AWS skills for any employer from Amazon the employer, lists the facts that changed since 2024 that old answer lists still get wrong, and links to practice questions on this site that rehearse the same scenarios in exam form. For the wider DevOps loop (Linux, Git, CI/CD, Terraform), see DevOps interview questions.

What AWS interview questions test, fresher to experienced

Preparing for AWS questions is not the same as preparing for a job at Amazon, and many question lists mix the two. This guide is about the platform, for any company that runs on AWS; Amazon's own hiring loop adds behavioural rounds it doesn't cover.

At fresher level, interviewers check foundations: can you name the core services, explain the shared responsibility model, describe Regions and Availability Zones, and tell an EC2 instance from a Lambda function. A good fresher answer defines the service, gives one concrete use case and admits what it does not do.

At experienced level, the bar is scenarios. You are asked to design for a traffic spike, an AZ loss, a cost overrun or a leaked credential, and to justify each choice with numbers and failure modes. The interviewer scores how you think, not whether you memorised a list.

Core AWS interview questions for freshers

• What is a Region and an Availability Zone? A Region is a geographic area containing multiple Availability Zones; an AZ is one or more discrete data centres with redundant power and networking. Spread across AZs for high availability, not across Regions by default; latency and data residency drive Region choice. See the shared responsibility model.

• What is the shared responsibility model? AWS secures the cloud (hardware, software, networking, facilities); you secure in the cloud (guest OS patches on EC2, application code, data, IAM). For abstracted services such as S3 and DynamoDB, AWS operates the infrastructure, OS and platform while you manage data, classification and IAM permissions. See the shared responsibility model.

• EC2 or Lambda? Amazon EC2 provides resizable virtual servers that you manage; AWS Lambda runs code without servers and bills per request and duration. Choose EC2 for long-running or stateful workloads and Lambda for short, event-driven tasks; the next section has the limits that decide it. See what AWS Lambda is.

• What are the S3 basics? Amazon S3 is object storage with 11 nines (99.999999999%) durability, accessed over an HTTP API, and every bucket encrypts new uploads by default.

• IAM users or roles? Users carry long-term credentials for humans; roles deliver temporary credentials for workloads via STS. AWS recommends federation through IAM Identity Center for humans and IAM roles for workloads, avoiding long-term access keys. See IAM roles, users and policies.

EC2, Auto Scaling and Lambda interview questions

• How does an Auto Scaling group work? It launches instances from a launch template and keeps between a minimum and maximum, around a desired capacity, replacing unhealthy instances. Spread it across several Availability Zones so one AZ loss doesn't take the group down.

• What are Lambda's limits and how do you handle cold starts? A function runs for at most 15 minutes with up to 10,240 MB of memory, and an account gets 1,000 concurrent executions per Region by default; above that, Lambda throttles. Provisioned concurrency keeps environments initialised so cold starts disappear, at a cost. A practice question on serverless compute with Lambda sets the fresher version of this.

• ECS or EKS? ECS is AWS's own managed container service; EKS runs Kubernetes. Choose ECS for simpler operations and EKS when you need Kubernetes APIs or portability.

• How would you reduce EC2 cost? Name the purchasing options (On-Demand, Reserved Instances, Savings Plans, Spot), then match each to a workload: steady baseline, flexible commitment, interruptible batch. Quote no rates from memory; they change by Region and type.

S3 and database interview questions

• Which S3 storage class? S3 Standard for frequent access; S3 Standard-IA and One Zone-IA for infrequent access; Glacier for archive; Intelligent-Tiering when access patterns are unknown. See S3 storage classes.

• What does versioning change? Deleting an object in a versioned bucket inserts a delete marker, so a GET returns 404 until you remove the marker. Expect the follow-up on consistency: S3 has given strong read-after-write consistency since December 2020.

• EBS or EFS? EBS is block storage for one instance (a self-managed database, a boot volume); EFS is managed NFS that many instances or containers share.

• Multi-AZ or read replicas? Multi-AZ keeps a synchronous standby for high availability with automatic failover, but the standby cannot serve read traffic. Read replicas use asynchronous replication, are readable and must be created and promoted manually. Multi-AZ failover changes the DB endpoint DNS and clients may see brief errors until DNS propagates; read replica lag means async copies can serve stale data. See what Amazon RDS is.

• When is Aurora the right answer? Aurora is MySQL- and PostgreSQL-compatible, with storage that grows on its own to 256 TiB. Choose it over standard RDS when you need more throughput and high availability on those engines.

• When is DynamoDB the right answer? Amazon DynamoDB is a serverless NoSQL key-value and document database with single-digit millisecond latency at any scale. Use it for known key-based access patterns at scale; avoid it for ad-hoc joins or flexible queries. Items max out at 400 KB. Throttling usually comes from a hot partition key; the fix is better key design or write sharding, not more capacity.

VPC, IAM and security interview questions

• Subnets and route tables. A subnet lives in exactly one Availability Zone. It is public if its route table sends traffic to an internet gateway, private if it reaches out only through a NAT device, and isolated if it has no route out of the VPC.

• Security groups or NACLs? Security groups operate at instance level, are allow-only and stateful, so return traffic is allowed automatically. Network ACLs operate at subnet level, allow and deny, and are stateless, so return traffic must be explicitly allowed. NACLs evaluate rules in ascending order until a match; security groups evaluate all rules before deciding. Security groups are the main control and NACLs a subnet-level backstop. A practice question on security group referencing in a three-tier app shows the follow-up: reference the tier's security group, not its IP addresses.

• NAT gateway per AZ. A NAT gateway lets private-subnet instances reach out while blocking unsolicited inbound traffic. Put one in each Availability Zone, or one AZ's outage cuts the others off. The experienced follow-up is connection exhaustion: a NAT gateway allows 55,000 simultaneous connections to each unique destination, and the fix is more secondary IP addresses or more gateways.

• VPC endpoints. Know the two kinds: gateway endpoints (S3 and DynamoDB only, free, a route-table entry) and interface endpoints (AWS PrivateLink, an ENI with a private IP, billed per hour per AZ and per GB). Scenario 1 below is the version interviewers ask. See VPC endpoints vs NAT gateways.

• Roles and least privilege. Start from no permissions and add only the actions, resources and conditions the workload needs; IAM Access Analyzer can generate a policy from CloudTrail activity. Two rules decide most policy questions: an explicit deny anywhere overrides any allow, and SCPs and RCPs cap what an account can do without granting anything.

• KMS. AWS KMS creates and controls encryption keys in validated HSMs. Know the three key types: customer managed (you control the policy and rotation, monthly fee plus per-use fees), AWS managed (AWS rotates it every year, no monthly fee) and AWS owned (invisible to you, free). The usual question is when to pay for a customer managed key: when you need to audit its use, control who can use it, or share it across accounts.

• CloudTrail. CloudTrail records actions by users, roles and services as events across the console, CLI, SDKs and APIs. Event history gives a viewable, searchable, immutable record of the past 90 days of management events per Region at no charge; for longer, create a trail that delivers to S3. By default only management events are logged, so data events (such as S3 object reads) must be turned on. CloudTrail is not a real-time alerting tool; use CloudWatch alarms or EventBridge for automated response.

• CloudWatch vs CloudTrail. CloudWatch is metrics, logs and alarms: how the system is behaving. CloudTrail is API activity: who did what. CloudWatch is where you answer the "what would you monitor" question at the end of any design.

Scenario-based AWS interview questions for experienced engineers

Private instances need S3 without a NAT bill

Situation: EC2 instances in private subnets read and write S3, and the traffic currently flows through a NAT gateway, so you pay per gigabyte processed plus hourly gateway charges.

Clarifying questions: which S3 buckets, are they in the same Region, is on-premises or cross-Region access needed, and what is the monthly data volume.

Design: add an S3 gateway endpoint and associate it with the private subnets' route tables, so S3 traffic stays on the AWS network and stops passing through the NAT gateway. If on-premises or cross-Region access is needed, an interface endpoint (AWS PrivateLink) is the answer instead.

Trade-off: the gateway endpoint costs nothing but covers only S3 and DynamoDB from inside the VPC; the interface endpoint reaches further and bills for it.

What fails: a gateway endpoint does not work from on-premises, across a VPC peering connection or through a transit gateway; a missing route-table association; or an S3 bucket policy that does not allow the endpoint. A practice question on S3 access via a gateway endpoint instead of a NAT gateway and a practice question on a private-subnet instance reading S3 without an internet or NAT gateway rehearse this.

Cost angle: the gateway endpoint is free; the interface endpoint and the NAT gateway both charge per hour and per GB processed, so at high S3 volume the gateway endpoint is the saving the interviewer is looking for.

Lambda exhausts database connections in a sale

Situation: a Lambda-backed API faces a flash sale, each invocation opens its own database connection, and the database runs out of connections and returns errors.

Clarifying questions: the traffic shape (steady or bursty), the database engine and its connection limit, the tolerated latency, and whether the workload is synchronous or asynchronous.

Design: place Amazon RDS Proxy in front of the database so Lambda reuses pooled connections, keep functions short, and keep the database credentials in AWS Secrets Manager, which the proxy reads, so they never sit in the function's code. Provisioned concurrency keeps execution environments warm if cold starts matter. Lambda's default concurrency is 1,000 per Region, so a spike above that throttles unless you raise the quota or smooth traffic.

Trade-off and failure: RDS Proxy adds a little latency and cost that steady, low traffic doesn't need. Without it, every concurrent function opens its own connection and the database hits its limit first; with it, the next ceiling is Lambda's concurrency quota. Provisioned concurrency removes cold starts but bills while warm. A practice question on RDS Proxy connection pooling for Lambda during flash sales rehearses this.

Cost angle: raising the database's connection limit is cheaper and fails under a real spike; price the proxy against lost orders.

An Availability Zone goes down

Situation: a single-AZ deployment loses an AZ and the service goes offline.

Clarifying questions: the required recovery time and recovery point, which components hold state, and whether cross-Region disaster recovery is needed.

Design: run the Auto Scaling group across multiple Availability Zones with minimum, maximum and desired capacity; put a load balancer across AZs; run RDS Multi-AZ with a synchronous standby and automatic failover; place a NAT gateway in each AZ. Add read replicas for read scaling, and a cross-Region option only if the recovery targets demand it.

Trade-off and failure: Multi-AZ pays for a standby that serves no reads, in return for automatic failover; during failover the endpoint's DNS changes and clients see errors for a short time, so retries matter. Read replicas are cheaper and readable but asynchronous, so they can serve stale data and must be promoted by hand. One NAT gateway is a single point of failure; one per AZ costs more and survives. A practice question on RDS Multi-AZ failover after an AZ outage and a practice question on per-AZ NAT gateways rehearse this.

Cost angle: every redundant piece bills while idle, and the cheap single-AZ design is the one that just failed.

Access keys found in application code

Situation: hardcoded IAM access keys in application code were committed to a repository and leaked.

Clarifying questions: the scope of the keys, which services and resources they can reach, when they were created, and whether rotation is possible without downtime.

Design: replace the keys with an IAM role (an instance profile for EC2, an execution role for Lambda) so AWS delivers and rotates temporary credentials automatically; rotate and revoke the leaked keys, and check CloudTrail for what they were used for; tighten the role with IAM Access Analyzer, and add secret scanning to the pipeline so it can't happen again.

Trade-off and failure: roles need code and trust-policy changes and a deployment, and the application must use the SDK's default credential chain. IAM changes are eventually consistent, so a new role can take a moment to work. A practice question on using an EC2 instance profile instead of hardcoded IAM keys rehearses this.

Cost angle: IAM roles and STS carry no additional charge, so the fix costs engineering time, not money. The cost of not fixing it is whatever the leaked keys can create.

Answers that are out of date in 2026

Old answer lists still repeat these. Quoting the current fact is an easy point.

• Launch configurations: accounts created on or after 1 October 2024 can't create them; use launch templates.
• S3 default encryption: SSE-S3 has applied to every bucket since 5 January 2023, so "enable default encryption" is no longer a step.
• Exam names: SysOps Administrator retired on 29 September 2025 and became CloudOps Engineer – Associate (SOA-C03). The Developer Associate moves from DVA-C02 to DVA-C03 on 1 December 2026.
• App Runner, S3 Object Lambda, CloudTrail Lake, Cloud9 and Incident Manager: all closed to new customers, so none belongs in a new design (AWS points App Runner users to Amazon ECS Express Mode).
• Aurora storage limit: 256 TiB in current docs; older sources cite 128 TiB.
• KMS AWS managed key rotation: every year since May 2022, not every three years.
• Lambda timeout: still 15 minutes for standard functions, but Lambda Managed Instances allow up to 90 minutes for asynchronous or event-source invocations.
• S3 conditional writes: since August 2024 an upload with If-None-Match fails if the object already exists, so "S3 can't prevent an overwrite" is no longer true.

How interviewers judge an AWS answer

A strong AWS answer starts with clarifying questions, then gives numbers, then names trade-offs, then failure modes, then cost, then what you would monitor. Interviewers are not checking whether you can recite a service description; they are checking whether you can hold a constraint and reason through it. Quote limits such as Lambda's 15-minute timeout or DynamoDB's 400 KB item size only when they change the design, and say what you would measure to know the design is working. One habit separates experienced candidates: they say what would make them change the design ("if writes grow ten times, I'd move this table to DynamoDB") before they are asked.

How to prepare in two to four weeks

A fresher plan: week one covers the shared responsibility model, Regions and AZs, EC2, S3 and IAM; week two covers VPC, Lambda and RDS; then practice explaining each service in two sentences and one use case. An experienced plan: week one revises the limits and failure modes above; weeks two and three work the four scenarios aloud until you can state the design, the trade-off, the failure and the cost without notes; week four practises follow-up probes such as "what if traffic doubles" or "what if the budget halves".

Certification syllabuses make good structure even if you don't sit the exam. Freshers can follow Cloud Practitioner (CLF-C02) and experienced engineers Solutions Architect – Associate (SAA-C03); both exam guides are free on AWS's site. The SAA-C03 practice questions and CLF-C02 practice questions here are the same scenarios in exam form, and which AWS certification to get maps the rest.

Frequently asked questions

How do I prepare for an AWS interview as a fresher?

Learn EC2, S3, IAM, VPC, Lambda and RDS first, and practise explaining the shared responsibility model and Regions in two sentences each. Then build something small on the free tier, so your answers describe what you configured rather than what you read.

What are scenario-based AWS interview questions?

They are open-ended prompts such as "a private instance needs S3 without a NAT bill" or "an Availability Zone goes down", where you must clarify requirements, propose a design, name the trade-off, say what fails and estimate cost. They test reasoning under constraints rather than recall of service descriptions.

Do I need an AWS certification to get an AWS job?

No. A certification is not required to be hired, but CLF-C02 and SAA-C03 give a structured syllabus and signal baseline knowledge, especially for freshers. Employers still weight hands-on experience and the ability to reason through trade-offs more heavily than a badge.

How do I explain Regions and Availability Zones clearly?

A Region is a geographic area with multiple isolated Availability Zones; an AZ is one or more discrete data centres with redundant power and networking. You deploy across AZs for high availability and choose a Region for latency and data residency. Keep the answer to two sentences and then stop.

How long does it take to learn AWS for interviews?

Two to four weeks of daily study and labs covers the foundations for a fresher. An engineer coming from another cloud needs about as long to map services and learn AWS's own limits.