AWS Interview Questions for Software Engineers: 50 Questions & Answers

AWS is the most common cloud at Indian product companies and startups, so backend interviewers increasingly assume you can reason about it. They are not asking you to recite the console; they are asking whether you can put an API behind a load balancer in private subnets, give it least-privilege access to S3, and decouple slow work with a queue. These 50 questions follow that practical slant, with answers, policy JSON, CLI snippets and the numbers worth memorising.

Service limits and features change often. Every number below reflects AWS documentation as of 2026; check the official AWS documentation for anything you plan to rely on in production.

How AWS Shows Up in Software Engineer Interviews

There are three flavours, and preparing for the wrong one wastes time:

EC2, Auto Scaling and Load Balancing Questions (Q1-8)

Q1. What is EC2 and how do you choose an instance type?

EC2 provides virtual machines. Instance families are tuned for workloads: general purpose (M, T), compute optimised (C), memory optimised (R, X), storage optimised (I, D), accelerated (P, G for GPUs). The letter g in names like m7g means AWS Graviton (ARM), which typically gives better price-performance for workloads that run on ARM. Choose by profiling: a Java API with large heaps leans R or M; a CPU-bound encoder leans C.

Q2. Compare EC2 pricing models.

A good cost answer combines them: Savings Plans for the baseline, On-Demand for normal peaks, Spot for interruptible batch.

Q3. EBS vs instance store vs EFS?

EBS is network-attached block storage that persists independently of the instance, lives in one Availability Zone, and supports snapshots to S3. Instance store is physically attached NVMe: very fast, but data is lost when the instance stops or fails. EFS is a managed NFS file system mountable by many instances across AZs. Databases on EC2 use EBS (gp3 or io2); caches and scratch space can use instance store.

Q4. What is an AMI and a launch template?

An AMI is a machine image: root volume snapshot plus metadata. A launch template captures how to launch an instance: AMI, instance type, security groups, IAM instance profile, user data. Auto Scaling groups use launch templates to create identical instances.

Q5. How does an Auto Scaling group keep a service healthy?

It maintains a desired count between min and max, spread across AZs. It replaces instances that fail EC2 or load balancer health checks, and scales on policies: target tracking ("keep average CPU at 50%"), step scaling, scheduled scaling (scale up before 10 a.m. traffic), or predictive scaling.

Q6. ALB vs NLB vs Gateway Load Balancer?

Q7. What is the difference between vertical and horizontal scaling on AWS?

Vertical: change to a bigger instance type, which means a restart and has a ceiling. Horizontal: more instances behind a load balancer via an ASG, which requires stateless servers (sessions in ElastiCache or DynamoDB, files in S3). Interviewers expect you to default to horizontal for web tiers and to know databases are harder to scale horizontally.

Q8. EC2 vs ECS vs EKS vs Fargate vs Lambda?

EC2: full control of VMs. ECS: AWS's own container orchestrator, simpler than Kubernetes. EKS: managed Kubernetes control plane. Fargate: serverless compute for ECS or EKS tasks, no nodes to manage. Lambda: functions triggered by events, billed per invocation and duration. The trade-off is control versus operational burden; many Indian startups run EKS for services plus Lambda for glue and event processing.

Amazon S3 Interview Questions (Q9-15)

Q9. What is S3's consistency and durability model?

S3 is designed for 99.999999999% (11 nines) durability by storing data redundantly across multiple AZs (for most storage classes). Since December 2020 it provides strong read-after-write consistency for new objects, overwrites, deletes and LIST operations. If you hear "S3 is eventually consistent for overwrites", that information predates 2020.

Q10. Explain the S3 storage classes.

Use lifecycle rules to move logs to IA after 30 days and Deep Archive after a year, and to expire them later.

Q11. How do you let a mobile app upload directly to S3 without exposing credentials?

The backend authenticates the user, then generates a presigned URL scoped to one object key, one operation (PUT) and a short expiry. The client uploads straight to S3, so file bytes never pass through your servers. For large files, use presigned multipart uploads.

import boto3, uuid

s3 = boto3.client("s3")

def upload_url(user_id: str) -> dict:
    key = f"uploads/{user_id}/{uuid.uuid4()}.jpg"
    url = s3.generate_presigned_url(
        "put_object",
        Params={"Bucket": "shop-user-media", "Key": key, "ContentType": "image/jpeg"},
        ExpiresIn=300,  # 5 minutes
    )
    return {"key": key, "url": url}

Q12. Bucket policy vs IAM policy vs ACLs?

An IAM policy attaches to a principal and says what it may do. A bucket policy is a resource policy on the bucket and can grant access to other accounts or enforce conditions (deny non-TLS requests, require encryption). ACLs are legacy; AWS now disables them by default on new buckets (Object Ownership: bucket owner enforced). Keep Block Public Access on unless you are deliberately hosting public content, ideally behind CloudFront.

Q13. How does S3 scale for high request rates?

S3 supports at least 3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD requests per second per prefix, and there is no limit on the number of prefixes. Spread hot keys across prefixes for extreme throughput, and put CloudFront in front of read-heavy public content. Use multipart upload for large objects (AWS recommends it from around 100 MB) for parallelism and retry of individual parts.

Q14. How do you encrypt data in S3?

All new objects are encrypted at rest by default with SSE-S3. For control over keys and audit of key usage, use SSE-KMS (customer managed KMS keys, with CloudTrail logs of every decrypt). Enforce TLS in transit with a bucket policy condition on aws:SecureTransport.

Q15. How would you trigger processing when a file lands in S3?

S3 event notifications to Lambda, SQS or SNS, or via EventBridge for richer filtering and multiple targets. For reliability, prefer S3 → SQS → consumer, so bursts are buffered and failures retry with a dead-letter queue, rather than invoking heavy processing directly.

VPC and Networking Interview Questions (Q16-23)

Q16. Explain a VPC and draw a standard layout.

A VPC is your private network in a region, defined by a CIDR block. Subnets live in exactly one AZ. What makes a subnet "public" is only its route table: a route to an Internet Gateway.

Q17. How does an instance in a private subnet reach the internet?

Through a NAT Gateway in a public subnet: outbound connections work, inbound connections from the internet are impossible. Put one NAT Gateway per AZ for resilience. NAT Gateways charge per hour and per GB processed, which surprises teams pulling large container images or sending S3 traffic through them; a gateway VPC endpoint for S3 and DynamoDB routes that traffic privately with no data processing charge.

Q18. Security group vs network ACL?

Referencing security groups by ID instead of CIDR (source = sg-app) is the idiomatic answer; it keeps working as instances scale in and out.

Q19. Why does AWS reserve 5 IPs per subnet?

The network address, the VPC router (.1), the DNS server (.2), one reserved for future use (.3), and the broadcast address (last). A /24 gives 251 usable addresses, not 256. This matters for EKS, where every pod can consume a VPC IP: undersized subnets cause pods stuck in Pending with IP exhaustion.

Q20. VPC peering vs Transit Gateway vs PrivateLink?

Peering connects two VPCs privately; it is non-transitive (A-B and B-C does not give A-C) and CIDRs must not overlap. Transit Gateway is a hub for many VPCs and on-prem connections, transitive by design. PrivateLink (interface endpoints) exposes one service privately to consumers without connecting whole networks, which is how SaaS vendors and AWS services like SQS are reached privately.

Q21. What is Route 53 and its routing policies?

Managed DNS with health checks. Policies: simple, weighted (canary 5% to a new stack), latency-based (nearest region), failover (active-passive DR), geolocation (serve Indian users from Mumbai), geoproximity and multivalue answer.

Q22. What does CloudFront do for an application?

CloudFront is a CDN: it caches static and dynamic content at edge locations, terminates TLS close to users, shields origins (S3 via Origin Access Control so the bucket stays private), and integrates with AWS WAF and Shield for DDoS protection. For a streaming or e-commerce platform serving all of India, this cuts latency and origin load sharply.

Q23. How do you connect an on-premises data centre to AWS?

Site-to-Site VPN over the internet (quick, encrypted, variable latency) or Direct Connect (dedicated private link, consistent latency, takes weeks to provision). Banks and large enterprises typically run Direct Connect with VPN as backup.

IAM and Security Interview Questions (Q24-30)

Q24. Users, groups, roles and policies?

Users are long-term identities (increasingly replaced by SSO via IAM Identity Center). Groups bundle users for permissions. Roles are identities with no long-term credentials, assumed temporarily via STS by services, applications or federated users. Policies are JSON documents of permissions attached to any of these, or to resources.

Q25. How should an application on EC2 or EKS get AWS credentials?

Never with access keys in code, config files or environment variables baked into images. On EC2, attach an IAM role via an instance profile; the SDK fetches short-lived credentials from the instance metadata service (use IMDSv2). On EKS, use IAM Roles for Service Accounts or EKS Pod Identity so each pod gets its own role rather than sharing the node's.

Q26. Write a least-privilege policy for a service that reads one S3 prefix and writes to one queue.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadInvoices",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::shop-invoices/2026/*"
    },
    {
      "Sid": "ListInvoicePrefix",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::shop-invoices",
      "Condition": { "StringLike": { "s3:prefix": ["2026/*"] } }
    },
    {
      "Sid": "SendToQueue",
      "Effect": "Allow",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:ap-south-1:123456789012:invoice-events"
    }
  ]
}

Note the detail that trips people up: ListBucket applies to the bucket ARN, while GetObject applies to object ARNs.

Q27. How is a request evaluated against multiple policies?

Default deny. An explicit Allow grants access, unless any applicable policy has an explicit Deny, which always wins. Across accounts, both sides must allow: the caller's identity policy and the resource policy. Service control policies (in AWS Organizations) and permission boundaries set maximums; they never grant on their own.

Q28. What does STS AssumeRole do, and what is a trust policy?

AssumeRole returns temporary credentials (access key, secret, session token) for a role. The role's trust policy defines who may assume it (a service like ec2.amazonaws.com, another account, or a federated identity such as GitHub Actions via OIDC). Its permissions policy defines what the role may do once assumed. CI pipelines should use OIDC federation, not stored keys.

Q29. How do you manage secrets?

AWS Secrets Manager (rotation built in, for example for RDS credentials) or SSM Parameter Store SecureString (cheaper, no built-in rotation). Encrypt with KMS, grant read access to the specific role, and fetch at startup or via a sidecar/CSI driver on EKS.

Q30. CloudTrail vs CloudWatch vs AWS Config?

CloudTrail records API calls: who did what, when, from where (audit and forensics). CloudWatch holds metrics, logs and alarms (operational health). AWS Config records resource configuration over time and evaluates compliance rules ("no S3 bucket may be public").

AWS Lambda and Serverless Questions (Q31-35)

Q31. What are Lambda's key limits?

Ephemeral /tmp storage is configurable up to 10 GB. These are defaults; confirm current quotas in the Lambda docs.

Q32. What is a cold start and how do you reduce it?

When no warm execution environment is available, Lambda must create one, download your code, start the runtime and run your initialisation code. This adds latency from tens of milliseconds to several seconds (large Java or .NET packages are the worst cases). Mitigations: smaller packages, lazy initialisation, more memory (more CPU), SnapStart for Java (and other supported runtimes), or provisioned concurrency for latency-critical paths. Initialise SDK clients and DB connections outside the handler so warm invocations reuse them.

Q33. How do Lambda invocation types differ in retry behaviour?

Synchronous (API Gateway, direct invoke): the caller gets the error; no automatic retry. Asynchronous (S3, SNS, EventBridge): Lambda retries twice by default, then sends to an on-failure destination or DLQ. Poll-based (SQS, Kinesis, DynamoDB Streams): the event source mapping retries; with SQS, failed messages reappear after the visibility timeout and go to the queue's DLQ after maxReceiveCount. Because retries happen, handlers must be idempotent.

Q34. Lambda in a VPC can't reach the internet. Why?

A VPC-attached function only has private IPs in your subnets, so it needs a route to a NAT Gateway (from a private subnet) or VPC endpoints for AWS services. Putting it in a public subnet does not help, because Lambda ENIs do not get public IPs.

Q35. Lambda connecting to RDS exhausts DB connections. Fix?

Each concurrent execution environment opens its own connection, so a burst of 500 concurrent invocations means 500 connections. Use RDS Proxy to pool and share connections, cap the function's reserved concurrency, and reuse connections across warm invocations.

RDS, Aurora and DynamoDB Questions (Q36-42)

Q36. RDS Multi-AZ vs read replicas?

Multi-AZ is for availability: a synchronous standby in another AZ with automatic failover (typically a minute or two), and the standby does not serve reads in the classic deployment. Read replicas are for read scaling: asynchronous copies that serve read traffic, with replication lag, that can be promoted manually. Production databases usually have both.

Q37. What does Aurora change compared with RDS MySQL/Postgres?

Aurora separates compute from a distributed storage layer that keeps six copies across three AZs and grows automatically. Replicas share the same storage, so replica lag is usually low and failover is fast. Aurora Serverless v2 scales capacity in fine-grained increments. Trade-offs: higher cost per hour and some engine-level differences from community MySQL/Postgres.

Q38. Explain DynamoDB's key and index model.

Every item has a partition key (hashed to choose the physical partition) and optionally a sort key (orders items within a partition, enabling range queries). A Global Secondary Index has a different partition key and/or sort key, can be added at any time, has its own capacity, and is eventually consistent. A Local Secondary Index keeps the same partition key with a different sort key, must be defined at table creation, supports strongly consistent reads, and imposes a 10 GB limit per partition key value.

Q39. Design a DynamoDB table for orders: "get an order", "list a user's orders by date", "list orders by status".

The sharded status key is the point of the question: a raw status partition key creates a hot partition because nearly every new order is PENDING. Start from access patterns, not entities; that is the core of DynamoDB modelling.

Q40. What are RCUs and WCUs?

In provisioned mode, 1 RCU = one strongly consistent read per second of an item up to 4 KB (or two eventually consistent reads). 1 WCU = one write per second of up to 1 KB. Example: 500 writes/s of 2.5 KB items needs 500 × ceil(2.5/1) = 1,500 WCU. Transactional reads and writes cost double. On-demand mode bills per request and suits unpredictable traffic.

Q41. Query vs Scan?

Query reads items of one partition key value (optionally a sort key range): cost proportional to the data returned. Scan reads the whole table and filters afterwards: you pay for every item read, even ones the filter discards. Scans in a request path are a design smell.

Q42. How do you prevent lost updates in DynamoDB?

Conditional writes: UpdateItem with ConditionExpression "version = :v" (optimistic locking), or atomic counters with ADD. For multi-item atomicity, TransactWriteItems (up to 100 actions). A wallet debit is SET balance = balance - :amt with condition balance >= :amt.

SQS, SNS and EventBridge Questions (Q43-46)

Q43. SQS Standard vs FIFO?

Q44. Explain visibility timeout and dead-letter queues.

When a consumer receives a message, it becomes invisible for the visibility timeout (default 30 seconds, max 12 hours). If the consumer deletes it in time, done. If the consumer crashes, the message reappears for another consumer. Set the timeout comfortably above your processing time (for Lambda, AWS suggests at least six times the function timeout). After maxReceiveCount failed receives, the redrive policy moves it to a DLQ for inspection instead of retrying a poison message forever. Retention defaults to 4 days and can be set up to 14 days; use long polling (WaitTimeSeconds up to 20) to cut empty receives and cost.

Q45. SQS vs SNS vs EventBridge vs Kinesis?

SQS: point-to-point queue, consumers pull, one consumer per message. SNS: push pub/sub, fan-out to many subscribers. EventBridge: event bus with content-based routing rules, schema registry and SaaS integrations. Kinesis Data Streams: ordered, replayable shards for high-volume streaming, closer to Kafka. Compare the open-source equivalents in Kafka vs RabbitMQ vs SQS.

Q46. Design order-placed fan-out to inventory, email and analytics.

Each consumer has its own queue, so a slow email provider never delays inventory updates, each can retry independently, and adding a consumer means one new subscription. Use SNS filter policies so, for example, only high-value orders go to a fraud queue. Make every consumer idempotent on orderId, since Standard queues can deliver twice.

AWS Architecture Scenario Questions (Q47-50)

Q47. Design a highly available web application on AWS.

1. Edge. Route 53 → CloudFront (static assets from S3, WAF rules) → ALB.
2. Compute. ALB across at least two AZs; ASG or EKS nodes in private subnets; stateless app servers.
3. State. Sessions and cache in ElastiCache Redis (cluster mode, multi-AZ). Files in S3.
4. Data. Aurora or RDS Multi-AZ, plus read replicas for heavy reads.
5. Async. SQS for emails, invoices, webhooks.
6. Ops. CloudWatch alarms on p99 latency and 5xx rate, centralised logs, automated backups with tested restores.
7. DR. State an RPO/RTO. Cross-region snapshot copies for backup-and-restore, or a warm standby region for tighter targets.

Q48. Design an image upload and thumbnail pipeline.

Client requests a presigned URL (Q11), uploads to raw/. S3 event → SQS → Lambda (or a Fargate worker for heavy processing) generates thumbnails into thumbs/, writes metadata to DynamoDB, and the client polls or receives a WebSocket push. CloudFront serves thumbnails. Failure handling: DLQ for corrupt images, idempotent processing keyed on object key and version, and a lifecycle rule deleting raw uploads that were never confirmed. The storage internals are covered in how S3-like object storage is designed.

Q49. Your AWS bill doubled this month. How do you investigate and reduce it?

• Find it. Cost Explorer grouped by service, then by usage type and tag. Usual suspects: NAT Gateway data processing, cross-AZ data transfer, idle or oversized instances, unattached EBS volumes and old snapshots, CloudWatch Logs ingestion, a Lambda stuck in a retry loop.
• Quick wins. VPC endpoints for S3/DynamoDB traffic, rightsizing via Compute Optimizer, Graviton instances, gp2 → gp3, S3 lifecycle policies, log retention limits.
• Structural. Savings Plans for the baseline, Spot for batch and CI, scale non-production environments to zero at night.
• Prevent. Budgets with alerts, mandatory cost-allocation tags.

Q50. A Mumbai-region outage: how would your design survive it?

Be honest about cost versus resilience. Options in increasing cost: backup and restore (cross-region snapshots; RTO hours), pilot light (data replicated, minimal compute in Hyderabad region ap-south-2), warm standby (scaled-down full stack), multi-site active-active (DynamoDB global tables or Aurora Global Database, Route 53 latency or failover routing). Mention data residency: Indian regulators expect certain data, such as payment data under RBI rules, to be stored in India, which makes ap-south-1 plus ap-south-2 a natural pair for fintechs.

A Focused AWS Preparation Plan for Developers

The free tier and a small budget alert are enough to make most of these answers experiential rather than memorised:

1. Week 1: networking and IAM. Build the VPC in Q16 with Terraform or CDK. Launch an instance in a private subnet, reach it via SSM Session Manager (no SSH keys), give it a role that can read exactly one S3 prefix, and verify a denied action fails.
2. Week 2: serverless and messaging. Build the image pipeline in Q48: presigned upload, SQS, Lambda, DynamoDB, DLQ. Force a failure and watch the message land in the DLQ.
3. Week 3: data and design. Model one app in DynamoDB from access patterns first. Then practise three design problems out loud using AWS components, and estimate costs roughly.

AWS knowledge compounds with system design: once you can map "durable queue" to SQS and "object store" to S3, design rounds get easier. Continue with system design interview preparation, and for container workloads on EKS see Docker and Kubernetes interview questions.

Frequently Asked Questions

Pranjal Jain

Ex-Microsoft SDE · IIT Kanpur · Founder of Prepflix. Helps engineers crack startup and product company interviews across India.