AWS basic interview questions

Amazon Web Services (AWS) is a comprehensive cloud computing platform that provides on-demand access to computing power, storage, databases, networking, and security services over the internet.

Instead of investing in physical servers and data centers, organizations can use AWS to provision resources instantly and scale them as needed. AWS follows a pay-as-you-go pricing model, which reduces upfront costs and allows businesses to focus more on application development rather than infrastructure management. In real-world production systems, AWS is commonly used to build scalable, highly available, and globally distributed applications.

Cloud computing is broadly categorized into Infrastructure as a Service, Platform as a Service, and Software as a Service.

In Infrastructure as a Service, the cloud provider manages the physical infrastructure, while the user is responsible for operating systems, middleware, and applications.

Platform as a Service goes a step further by managing the operating system and runtime environment, allowing developers to focus purely on application logic and data.

Software as a Service provides fully managed applications where users only consume the software without worrying about infrastructure or platform management.

As we move from IaaS to SaaS, the level of operational responsibility decreases while ease of use increases.

An AWS Region is a geographically isolated area where AWS has multiple data centers, while an Availability Zone is a physically separate data center within a region. Each region consists of two or more Availability Zones that are connected through high-speed, low-latency networking.

This design allows applications to be deployed across multiple zones so that even if one data center fails, the application continues to function without downtime. In production architectures, deploying resources across multiple Availability Zones is a best practice for achieving high availability and fault tolerance.

An EC2 instance is a virtual server provided by AWS that allows users to run applications in the cloud. It offers full control over the operating system, software, and configuration, making it suitable for a wide range of workloads such as backend services, enterprise applications, and batch processing jobs.

Users can choose instance types based on CPU, memory, and networking requirements and can scale instances up or down depending on traffic. EC2 is commonly used when fine-grained control over the environment is required.

An Amazon Machine Image, or AMI, is a preconfigured template used to launch EC2 instances. It includes the operating system, application software, and required configurations. AMIs help ensure consistency across environments and allow teams to quickly scale applications by launching multiple identical instances.

In modern cloud architectures, AMIs are often used to support immutable infrastructure practices, where servers are replaced instead of being modified directly.

Stopping an EC2 instance means shutting it down temporarily while preserving its configuration and attached storage, allowing it to be restarted later.

Terminating an instance, on the other hand, permanently deletes the instance along with its associated resources, such as the root volume, unless explicitly preserved.

From a cost perspective, a stopped instance does not incur compute charges, while a terminated instance is completely removed and cannot be recovered. In interviews, it is important to remember that stopping is reversible, whereas termination is permanent.

Amazon S3, or Simple Storage Service, is an object storage service designed to store and retrieve any amount of data with high durability and availability. It is commonly used for storing images, videos, backups, logs, and static website content.

S3 automatically scales as data grows and provides eleven nines of durability, making it extremely reliable. Unlike traditional file systems, S3 stores data as objects within buckets, each object having a unique key.

S3 provides multiple storage classes to optimize cost based on data access patterns. The Standard class is used for frequently accessed data and offers low latency and high availability. Intelligent-Tiering automatically moves data between access tiers based on usage, making it ideal when access patterns are unpredictable.

Standard-IA is designed for infrequently accessed data with lower storage cost but retrieval fees.

Glacierand Glacier Deep Archive are used for long-term archival storage where data is rarely accessed and retrieval times range from minutes to hours. Organizations often use lifecycle policies to move data automatically between these classes.

S3 Standard

• Frequently accessed data
• Low latency, high cost

S3 Intelligent-Tiering

• Automatically moves data between tiers
• Best when access pattern is unknown

S3 Standard-IA

• Infrequent access
• Lower cost, retrieval fee

S3 Glacier / Glacier Deep Archive

• Archival storage
• Very cheap, slow retrieval (minutes–hours)

IAMis an AWS service that enables secure control over access to AWS resources. It allows administrators to define who can access specific services and what actions they are allowed to perform. Permissions are managed using policies, which follow the principle of least privilege to minimize security risks.

IAM plays a critical role in securing AWS environments by separating authentication, which identifies users, from authorization, which determines their permissions.

IAM controls who can access what in AWS.

It allows you to:

• Create users & roles
• Define permissions using policies
• Apply least-privilege security

An IAM user represents an individual or service that requires long-term access to AWS and is typically associated with permanent credentials.

IAM groups are collections of users that simplify permission management by allowing policies to be applied to multiple users at once.

IAM roles are different in that they do not have long-term credentials and are assumed temporarily by AWS services or users. In production systems, roles are preferred over users because they provide better security and eliminate the need to store access keys in applications.

IAM User

• Represents a person or service
• Has long-term credentials

IAM Group

• Collection of users
• Permissions applied once to many users

IAM Role

• No credentials
• Assumed temporarily
• Used by EC2, Lambda, cross-account access

A VPC (Virtual Private Cloud) is a logically isolated virtual network inside AWS where you can launch resources such as EC2, RDS, and Load Balancers. It gives you full control over networking, including IP address range, subnets, route tables, and gateways.

In simple terms, a VPC is your own private data center in the AWS cloud, where you decide what is public, what is private, and how traffic flows.

Key components inside a VPC:

• Subnets (public & private)
• Route tables
• Internet Gateway / NAT Gateway
• Security Groups & NACLs

Security Groups and Network ACLs are both used for network security, but they operate at different levels. Security Groups are the first line of defense; NACLs provide coarse-grained subnet-level control.

Security Groups

• Act at instance level
• Are stateful (return traffic is automatically allowed)
• Support only allow rules
• Most commonly used

Network ACLs (NACLs)

• Act at subnet level
• Are stateless (explicit inbound & outbound rules needed)
• Support allow and deny rules
• Used for additional security layer

An Internet Gateway (IGW) is a VPC component that allows resources in a VPC to communicate with the internet. It enables inbound and outbound traffic for resources that have public IP addresses and proper routing rules. Without an Internet Gateway, a VPC is completely isolated from the internet.

For example, an EC2 instance in a public subnet can access the internet only if:

• It has a public IP
• The subnet route table points to an Internet Gateway

Both are used to allow private subnet resources to access the internet without exposing them publicly. NAT Gateway is the recommended and production-grade solution.

NAT Gateway

• Fully managed AWS service
• Highly available & scalable
• No patching or maintenance
• Preferred in production

NAT Instance

• EC2-based solution
• Requires manual setup & scaling
• Less secure, more operational overhead

An Elastic IP (EIP) is a static, public IPv4 address provided by AWS that can be attached to an EC2 instance or NAT Gateway. It remains the same even if the instance is stopped or restarted.

Elastic IPs are useful when:

• You need a fixed IP for whitelisting
• You want to remap IPs during failures

AWS Route 53 is a highly available and scalable DNS (Domain Name System) service provided by AWS. It routes user traffic to applications based on routing policies like latency-based, weighted, geolocation, or failover routing.

AWS Route 53 is a DNS service that helps users reach your website using its name instead of an IP address.

Easy Example

• Your website name: example.com
• Your website lives on a server with an IP address like: 13.234.56.78

When someone types example.com in the browser:

• Route 53 tells the internet:
  “This website is stored at IP address 13.234.56.78”

Then the website opens.

Route 53 is commonly used to:

• Register domains
• Route traffic to EC2, Load Balancers, or CloudFront
• Implement disaster recovery using DNS failover

Why is it called Route 53?

• Route → It routes (directs) users to the correct server
• 53 → DNS uses port number 53

VPC Peering allows two VPCs to communicate using private IP addresses, as if they were in the same network.

Simple Example

Imagine:

• VPC A → Your backend servers
• VPC B → Your database servers

Without VPC Peering

• They cannot talk to each other directly.

With VPC Peering

• Backend servers in VPC A can securely access databases in VPC B using private IPs.

Securing Amazon S3 means making sure only the right users and services can access your data. S3 buckets are secured using Block Public Access, bucket policies, IAM policies, encryption, VPC endpoints, and monitoring tools.

1. Block Public Access (Most Important)

• Enable Block Public Access at: Account level Bucket level

This prevents anyone on the internet from accessing your bucket, even if a policy accidentally allows it.

Best practice: Always keep it ON unless the bucket must be public (like a public website).

2. Use Bucket Policies (Fine-Grained Control)

Bucket policies define who can do what on your bucket.

Example:

• Allow access only from: A specific IAM role A specific AWS account A specific VPC / IP address

Example use case:

Only my EC2 servers can read objects from this bucket.

3. Use IAM Policies (User-Based Access)

• Attach policies to: IAM users IAM roles IAM groups

Follow Least Privilege Principle:

• Give only required permissions (GetObject, not *)

4. Enable Encryption (Protect Data)

At rest

• Enable SSE-S3 or SSE-KMS

In transit

• Enforce HTTPS (SSL/TLS)

This protects data even if someone gains access to storage.

5. Restrict Access Using VPC Endpoints

• Use S3 VPC Endpoint
• Allow bucket access only from your VPC

No internet exposure
Extra layer of security

6. Enable Logging & Monitoring

• S3 Server Access Logs
• CloudTrail for API calls
• CloudWatch alarms for suspicious activity

AWS Key Management Service (KMS) is a service used to create, manage, and protect encryption keys in AWS. AWS KMS helps you encrypt and decrypt data securely by managing encryption keys for you. It integrates seamlessly with services like S3, EBS, RDS, and Lambda to encrypt data at rest.

Easy Example

Imagine a locker:

• Key → Managed by AWS KMS
• Data → Stored in S3, RDS, EBS, etc.

When you store data:

• KMS encrypts it

When you read data:

• KMS decrypts it

You never see the actual key.

Use Cases

• Encrypt S3 buckets
• Encrypt RDS databases
• Encrypt EBS volumes
• Protect secrets and passwords

AWS security is about protecting accounts, data, applications, and networks using multiple layers. AWS security follows the shared responsibility model, where AWS secures the cloud infrastructure and customers secure what they run in the cloud.

Key best practices:

• Follow least privilege using IAM
• Use IAM roles instead of access keys
• Enable MFA for root and privileged users
• Encrypt data in transit and at rest
• Enable logging using CloudTrail & CloudWatch
• Regularly rotate credentials and audit permissions

Amazon EBS (Elastic Block Store) is a block-level storage service designed to be attached to EC2 instances. It works like a virtual hard disk where data persists independently of the EC2 instance lifecycle.

EBS is mainly used when applications need low-latency, consistent performance, such as databases or file systems. Even if an EC2 instance is stopped or terminated, the data on EBS volumes can be retained. EBS is ideal for workloads that need fast, reliable disk storage.

Real-Life Example

Think of:

• EC2 instance → Computer / Laptop
• EBS volume → Hard disk (SSD/HDD)

You:

• Install software
• Store files
• Save databases

All of this data is stored in EBS.

Why is Amazon EBS Useful?

Data stays safe even if EC2 stops
Fast and reliable storage
Can increase or decrease size anytime
Used for OS, apps, and databases

If EC2 crashes, your data is still safe in EBS.

Amazon EFS (Elastic File System) is a managed file storage service that provides a shared file system for multiple EC2 instances. Unlike EBS, EFS can be mounted simultaneously by many instances.

It is commonly used for shared workloads, such as content management systems, shared media storage, or microservices that need access to common files.

Key points about Amazon EFS:

• File storage (NFS-based)
• Can be mounted by multiple EC2 instances
• Automatically scales storage
• Mostly used with Linux workloads

Amazon S3 and Amazon EBS serve different storage needs. S3 is for storing objects, EBS is for running applications.

Feature	S3	EBS
Storage type	Object storage	Block storage
Attachment	Not attached to EC2	Attached to EC2
Use case	Backups, media, logs	Databases, OS disks
Scalability	Unlimited	Limited per volume
Access	API-based	File system-base

Amazon Glacier is a low-cost archival storage service designed for long-term data retention where data is rarely accessed. Glacier is optimized for cost, not speed.

It is commonly used for:

• Compliance archives
• Long-term backups
• Historical data storage

Retrieval times range from minutes to hours, depending on the retrieval option chosen.

AWS provides multiple database services, but the most commonly used are Amazon RDS and Amazon DynamoDB. The choice depends on structure, scale, and consistency requirements.

• RDS is used for relational, SQL-based workloads.
• DynamoDB is used for NoSQL, high-scale, low-latency applications.

Amazon RDS is a fully managed relational database service that simplifies database administration tasks such as backups, patching, scaling, and replication.

With RDS, developers can focus on application logic while AWS handles infrastructure management and availability. RDS removes operational complexity from traditional databases.

Key benefits:

• Automated backups
• Multi-AZ for high availability
• Read replicas for scaling reads
• Managed patching and monitoring

Aurora is AWS-optimized and offers better performance and availability compared to standard MySQL and PostgreSQL.

Amazon RDS supports multiple relational database engines:

• MySQL
• PostgreSQL
• MariaDB
• Oracle
• SQL Server
• Amazon Aurora

Amazon DynamoDB is a fully managed NoSQL key-value and document database designed for applications that require single-digit millisecond latency at massive scale.

It automatically scales throughput and storage and is widely used for real-time applications such as gaming, IoT, and high-traffic web apps.

Core concepts of DynamoDB:

• Tables, items, and attributes
• Primary key (partition key + optional sort key)
• Fully serverless and highly available
• Built-in encryption and backup

AWS Lambda is a serverless compute service that allows you to run code without provisioning or managing servers. You simply upload your code, define the trigger, and AWS automatically handles execution, scaling, and infrastructure management.

Lambda follows an event-driven model, meaning the function runs only when an event occurs. You are billed only for the execution time, making it highly cost-effective for intermittent workloads. Lambda lets you focus purely on code, not infrastructure.

Key highlights:

• No server management
• Auto-scales automatically
• Supports multiple languages (Java, Python, Node.js, etc.)
• Ideal for microservices and event-driven systems

Lambda functions are invoked by events from other AWS services. These events act as triggers that start the function execution. Lambda is reactive by design, it runs in response to events.

Common Lambda triggers:

• API Gateway – REST or HTTP APIs
• S3 – file upload or delete events
• DynamoDB Streams – data changes
• CloudWatch Events / EventBridge – scheduled or rule-based triggers
• SQS / SNS – messaging events

Auto Scaling automatically adjusts the number of EC2 instances based on demand. It ensures that applications have the right amount of compute capacity at all times.

During high traffic, Auto Scaling adds instances, and during low traffic, it removes instances, which helps optimize both performance and cost. Auto Scaling balances performance and cost automatically.

Why it matters in production:

• Improves availability
• Handles traffic spikes
• Reduces manual intervention
• Works with Load Balancers

Elastic Load Balancing (ELB) distributes incoming traffic across multiple targets such as EC2 instances, containers, or Lambda functions. This prevents any single resource from being overwhelmed. ELB improves availability, scalability, and fault tolerance.

AWS provides different types of load balancers:

• Application Load Balancer (Layer 7)
• Network Load Balancer (Layer 4)
• Gateway Load Balancer

AWS Elastic Beanstalk is a Platform as a Service (PaaS) that simplifies application deployment. You upload your application code, and Elastic Beanstalk automatically handles provisioning resources such as EC2, Load Balancers, Auto Scaling, and monitoring.

It is commonly used when developers want fast deployment without managing infrastructure manually.

Key benefits:

• Supports Java, Spring Boot, Node.js, Python, etc.
• Easy scaling and monitoring
• Full control over underlying resources if needed

AWS Batch is a service that efficiently runs batch computing jobs at any scale. It automatically provisions compute resources based on job requirements and schedules jobs accordingly. You submit jobs, AWS Batch handles resource provisioning and execution.

AWS Batch is commonly used for:

• Data processing
• Financial modeling
• Machine learning workloads
• Log processing

Scheduled tasks in AWS are implemented using Amazon CloudWatch Events (now part of EventBridge). These allow you to trigger actions at specific times or intervals, similar to a cron job.

A common pattern is triggering a Lambda function on a schedule to perform tasks like cleanup jobs, report generation, or database backups. CloudWatch Events enable time-based automation in AWS.

Example use cases:

• Daily data cleanup
• Nightly batch jobs
• Periodic health checks

Amazon CloudWatch is a monitoring and observability service used to collect metrics, logs, and events from AWS resources and applications. It helps teams understand how their systems are performing in real time and react quickly to issues. CloudWatch tells you how your AWS resources and applications are behaving.

CloudWatch monitors services like EC2, RDS, Lambda, and Load Balancers by default and also allows custom application metrics. It is widely used for performance monitoring, troubleshooting, and alerting.

Key capabilities:

• Metrics (CPU, memory, latency, request count)
• Log collection and analysis
• Alarms and notifications
• Event-based automation

AWS CloudTrail is a governance, auditing, and compliance service that records all API calls and user activities in an AWS account. It answers the critical question: who did what, when, and from where.

CloudTrail logs events such as creating an EC2 instance, deleting an S3 bucket, or changing IAM permissions. These logs are typically stored in S3 for long-term auditing and security analysis. CloudTrail is for auditing actions, not performance monitoring.

Why CloudTrail is important:

• Security investigations
• Compliance and audits
• Detecting unauthorized changes
• Tracking account activity

AWS Config is used to track, evaluate, and audit configuration changes of AWS resources over time. While CloudTrail tracks actions, AWS Config tracks the state of resources.

AWS Config continuously records resource configurations and allows you to define rules to check whether resources comply with best practices or organizational policies. CloudTrail answers “who changed it,” Config answers “what changed and whether it’s compliant.”

Example use cases:

• Detecting public S3 buckets
• Ensuring encryption is enabled
• Tracking configuration drift
• Compliance reporting

A CloudWatch Alarm is used to monitor a metric and trigger an action when a defined threshold is crossed. It helps teams respond automatically to operational issues. CloudWatch Alarms convert metrics into actions.

For example, if CPU utilization exceeds 80% for a certain duration, a CloudWatch Alarm can:

• Send a notification via SNS
• Trigger Auto Scaling
• Invoke a Lambda function

Common alarm use cases:

• High CPU or memory usage
• Low disk space
• Application error spikes
• Health check failures

AWS Tags are key–value pairs attached to AWS resources such as EC2 instances, S3 buckets, or RDS databases. They help organize, manage, and track resources efficiently.

In real-world environments with hundreds or thousands of resources, tags are essential for cost tracking, automation, and access control.

Why tags matter in production:

• Cost allocation and billing analysis
• Environment identification (dev, test, prod)
• Automation and scripting
• Access control using tag-based IAM policies

AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define and provision AWS resources using templates written in JSON or YAML. Instead of creating resources manually, you describe the desired state, and CloudFormation handles creation, updates, and deletion in a controlled, repeatable way.

CloudFormation turns infrastructure into reusable, auditable code.

Key Points of AWS CloudFormation:

• Consistency across environments (dev/test/prod)
• Version-controlled infrastructure
• Easy rollback using stacks and change sets

AWS OpsWorks is a configuration management service based on Chef and Puppet. It automates server configuration, deployment, and lifecycle management.

OpsWorks is useful when teams want fine-grained control over configuration using Chef/Puppet recipes, especially for legacy or complex environments.

Key points of AWS OpsWorks:

• More control than Elastic Beanstalk
• Less popular today due to modern IaC tools
• Suited for teams already using Chef/Puppet

AWS API Gateway is a fully managed service to create, publish, secure, and monitor APIs at scale. It commonly sits in front of Lambda functions or backend services and handles request routing, authentication, throttling, and caching.

API Gateway is the front door for serverless and microservices APIs.

Why it’s powerful:

• Supports REST and HTTP APIs
• Built-in auth (IAM, Cognito, JWT)
• Rate limiting and request validation

AWS Direct Connect provides a dedicated private network connection from on-premise data centers to AWS. It bypasses the public internet, offering lower latency, higher bandwidth, and more consistent performance.

Use cases:

• Hybrid cloud architectures
• Large data transfers
• Compliance-sensitive workloads

Amazon SNS and Amazon SQS solve different messaging needs. SNS broadcasts messages; SQS queues them for processing.

• SNS (Simple Notification Service) is publish–subscribe. One message can fan out to multiple subscribers (email, Lambda, SQS, HTTP).
• SQS (Simple Queue Service) is point-to-point. Messages are stored in a queue and processed by consumers independently.

AWS ElastiCache is a managed in-memory data store supporting Redis and Memcached. It’s used to improve application performance by caching frequently accessed data. ElastiCache reduces database load and improves latency.

Common use cases:

• Session storage
• Database query caching
• Real-time analytics
• Leaderboards

Amazon Kinesis is a real-time data streaming service used to ingest, process, and analyze streaming data at scale. It’s designed for use cases where data must be processed as it arrives. Kinesis is built for high-throughput, real-time data streams.

Typical scenarios:

• Log and event processing
• Clickstream analytics
• IoT data ingestion
• Real-time dashboards

AWS Global Accelerator improves application availability and performance by routing user traffic to the nearest healthy endpoint using AWS’s global network.

Unlike CloudFront (content caching), Global Accelerator optimizes TCP/UDP traffic for applications like APIs, gaming, and VoIP. Global Accelerator speeds up global applications without caching.

Key advantages:

• Static IPs
• Fast failover
• Improved global latency

Cost optimization in AWS is a continuous process, not a one-time task. It starts with visibility and ends with automation.

Best practices interviewers expect:

• Right-size EC2 and RDS instances
• Use Reserved Instances / Savings Plans
• Leverage Auto Scaling
• Use appropriate S3 storage classes
• Delete unused resources (EIPs, snapshots)
• Tag resources for cost allocation

Migration typically follows a structured approach known as the 6 Rs strategy. Successful migration balances speed, risk, and long-term optimization.

Common migration paths:

• Rehost (lift and shift)
• Replatform (minor optimizations)
• Refactor (cloud-native redesign)
• Retire / Retain / Replace

High-level steps:

1. Assess applications and dependencies
2. Choose the right migration strategy
3. Migrate data and workloads
4. Test for performance and security
5. Optimize after migration