Use these AWS interview questions to screen cloud, DevOps, backend and solutions architect candidates, or to prepare for that round as a candidate. AWS has more than 200 services, so memorizing names proves little. What separates strong engineers is how they handle identity, networking, failure and cost, and that's where this list spends its time. Choose 6 to 8 questions that match your stack and level. Ask "what would that cost?" and "what happens when that fails?" after the technical answers, since the follow-ups are where real experience shows.
What a strong AWS interview checks
- Identity and security: IAM roles, least privilege, encryption and audit logging as everyday habits.
- Networking: VPCs, subnets, routing and the difference between security groups and network ACLs.
- Service selection: choosing between EC2, containers and Lambda, and between relational and NoSQL stores, for real reasons.
- Reliability: designing across Availability Zones, backups that get tested, and alarms that mean something.
- Cost awareness: knowing where the bill comes from and how to shrink it without harming reliability.
- Delivery and teamwork: infrastructure as code, reviewed changes and calm incident handling.
AWS interview questions: identity and networking
1. When do you use an IAM role instead of an IAM user with access keys?
What good looks like: almost always a role. Roles give short-lived credentials through STS, so there are no long-term keys to leak or rotate. EC2 instances use instance profiles, Lambda functions and ECS tasks use execution or task roles, and people sign in through IAM Identity Center (the successor to AWS SSO). Long-lived access keys are a last resort, for example for a system outside AWS that can't use federation.
Red flag: access keys committed to a repository or baked into an AMI.
2. How is an IAM policy evaluated when several policies apply?
What good looks like: everything starts as denied. An explicit Allow grants access, but an explicit Deny anywhere wins. Service control policies in AWS Organizations, permission boundaries and resource policies can all limit what an identity policy allows. A strong candidate uses the IAM policy simulator or access analyzer to check, rather than guessing.
3. Security groups vs network ACLs: what's the difference?
What good looks like: security groups attach to network interfaces, are stateful (return traffic is allowed automatically) and only have allow rules. Network ACLs apply to a whole subnet, are stateless (you must allow return traffic, including ephemeral ports) and support both allow and deny rules, evaluated in number order. Most teams rely on security groups and leave NACLs fairly open.
4. What makes a subnet public or private?
What good looks like: a public subnet has a route to an internet gateway. A private subnet doesn't, so its instances reach the internet for updates through a NAT gateway in a public subnet. Strong candidates mention VPC endpoints (gateway endpoints for S3 and DynamoDB, interface endpoints for many others), which keep traffic to AWS services off the internet and can cut NAT data-processing charges.
Red flag: "private means it has no public IP," with no mention of routing.
5. How would you connect several VPCs and an on-premises network?
What good looks like: VPC peering works for a few VPCs, but it isn't transitive and becomes a mesh. Transit Gateway acts as a hub for many VPCs and on-premises links. Site-to-Site VPN is quick to set up, and Direct Connect gives a dedicated, steadier connection. They also plan non-overlapping CIDR ranges up front.
Compute, storage and data
6. EC2, ECS on Fargate, or Lambda: how do you choose?
What good looks like: Lambda suits event-driven, short tasks, with a 15-minute maximum run time and pay-per-use pricing, but cold starts and per-invocation cost matter at steady high volume. Fargate runs containers without managing servers, which suits long-running services. EC2 gives full control, GPU and special instance types, and the lowest cost at steady load with Savings Plans. Strong candidates choose by workload shape and team skills, not fashion.
7. Which S3 storage class would you use for logs that are rarely read after 30 days?
What good looks like: write to S3 Standard, then use a lifecycle rule to move objects to Standard-IA or Glacier Instant Retrieval after 30 days, and to Glacier Flexible Retrieval or Deep Archive for long-term retention, with an expiration rule at the end. S3 Intelligent-Tiering is a good choice when access patterns are unknown. They mention minimum storage durations and retrieval fees, which can make cold tiers cost more for small or short-lived objects.
8. Is S3 strongly consistent?
What good looks like: yes. Since December 2020, S3 provides strong read-after-write consistency for all PUT and DELETE operations on objects, including list operations, at no extra cost. A candidate who says new objects are "eventually consistent" is working from older material, which is worth a gentle follow-up rather than a fail.
9. RDS, Aurora or DynamoDB for a new service?
What good looks like: RDS and Aurora suit relational data with joins and transactions. Aurora separates storage from compute and offers fast failover, more read replicas and a serverless option. DynamoDB suits key-value access at any scale with single-digit millisecond reads, but you design tables around your access patterns first, because ad hoc queries are hard. Strong candidates ask about the queries before choosing.
10. How do you choose a DynamoDB partition key?
What good looks like: pick a key with many distinct values that spreads reads and writes evenly, such as a user or order ID, not a status or a date. A hot partition throttles even when the table has plenty of total capacity. They'd use a sort key for ranges within a partition, and global secondary indexes for other access patterns.
11. SQS, SNS or EventBridge?
What good looks like: SQS is a queue that one consumer group pulls from, which buffers load and supports retries with a dead-letter queue. SNS pushes each message to many subscribers (fan-out). EventBridge routes events by content rules across services, accounts and SaaS sources, and adds scheduling. A common pattern is SNS or EventBridge feeding several SQS queues. They mention that standard queues deliver at least once, so consumers must be idempotent, and FIFO queues add ordering.
Reliability, operations and cost
12. Multi-AZ vs read replicas in RDS: what does each solve?
What good looks like: a Multi-AZ deployment keeps a synchronous standby in another Availability Zone for automatic failover, which is about availability. Read replicas copy data asynchronously to spread read traffic, which is about scale, and can be promoted in a disaster. Neither one replaces backups, since a bad delete replicates too.
13. What's the difference between CloudWatch and CloudTrail?
What good looks like: CloudWatch collects metrics, logs and alarms about how your systems behave. CloudTrail records API calls: who did what to which resource, and when. In an incident you use CloudWatch to see the symptom and CloudTrail to find the change that caused it. A strong candidate enables an organization-wide trail stored in a locked-down account.
14. How do you protect data at rest and secrets in AWS?
What good looks like: encrypt at rest with KMS keys, using customer-managed keys where you need control over key policies or rotation. Store credentials in Secrets Manager (with rotation) or Parameter Store, never in code or plain environment files. Block public access on S3 at the account level, and use bucket policies that require TLS.
15. Your AWS bill jumped 40% this month. How do you find out why?
What good looks like: Cost Explorer grouped by service, account and tag shows where the money went. Usual suspects are NAT gateway data processing, data transfer between zones or regions, forgotten resources, unattached EBS volumes, oversized instances and log retention that never expires. Then they set budgets and anomaly alerts, enforce tagging, and look at Savings Plans or Spot for steady or interruptible work.
Red flag: no idea how to see cost by service.
16. How do you manage AWS infrastructure across environments?
What good looks like: infrastructure as code (CloudFormation, the AWS CDK or Terraform) in version control, reviewed through pull requests, applied by a pipeline. Separate accounts per environment under AWS Organizations, with guardrails from service control policies. Console changes are for exploring, not production.
Practical scenarios
17. Design a simple, reliable web app on AWS for a company's first product.
What good looks like: a load balancer in public subnets across at least two Availability Zones, the app on Fargate or an Auto Scaling group in private subnets, a managed database with Multi-AZ, static files on S3 behind CloudFront, secrets in Secrets Manager, and alarms on errors and latency. A strong candidate keeps it simple, explains what they'd add later, and gives a rough monthly cost.
Behavioral (STAR)
18. Tell me about an outage or near-miss in a cloud system you worked on.
What good looks like: a specific Situation, their exact role, the Actions they took to restore service and find the cause, and a Result that includes a lasting change such as an alarm, a runbook or a design fix.
Red flag: no mention of what changed afterward.
19. Describe a time you cut cloud costs.
What good looks like: how they found the waste, what they changed, the dollar or percentage savings, and how they made sure reliability didn't suffer. Strong candidates explain how they kept the savings from creeping back.
20. Tell me about convincing a team to adopt a security practice they resisted.
What good looks like: they listened to why the team pushed back, made the safe path the easy path (a template, a module or automation), and showed the risk with evidence instead of fear. The Result is adoption, not just a new policy document.
A simple scoring rubric
Running this interview with AI
Many resumes list AWS, and the first round is where you find out who has built and run systems on it. An adaptive AI interviewer can do that screen at any hour, since candidates take it 24/7 on their own schedule. With NTRVSTA, you customize the interview per role and add your own AWS questions. The interviewer adapts as it goes: a candidate who handles IAM and VPC questions well moves on to cost and failure scenarios, while one who struggles gets easier follow-ups. For design prompts like question 17, system-design interviews come with an interactive whiteboard.
Each report has a score breakdown and video snippets of key moments, so your hiring manager can review the evidence in minutes. Learn how AI interviews are scored and compare options in the best AI interview software. For related roles, see our DevOps, system design and software engineer interview questions, plus the software engineer job description template.
Questions
Are AWS certifications a good substitute for interview questions?
They are a useful signal that someone studied the services, but not a substitute. Certification exams are multiple choice, so they can't show how a candidate debugs a live outage, weighs cost against reliability, or explains a design to a team.
How should AWS questions differ for developers, DevOps engineers and architects?
Developers should handle IAM roles, Lambda, S3, DynamoDB or RDS, and SQS well. DevOps and platform engineers need networking, infrastructure as code, monitoring and incident work. Architects should spend most of the round on multi-account design, reliability, security and cost trade-offs.
What if a candidate's cloud experience is mostly Azure or Google Cloud?
Ask the same scenario questions and let them answer in the terms they know. Identity, networking, managed databases, queues and cost control map closely across providers. Score the reasoning, then judge how much ramp-up time your team can support.
Ready to watch an AI interviewer screen a cloud engineer? Book a 20-minute demo, or run a sample interview to see the candidate side.
