AWS Interview Questions and Answers (2026)

A Region is a geographic area (e.g. eu-west-1). Each Region has multiple Availability Zones — physically separate data centres with independent power and networking, connected by low-latency links. You design for AZ failure by running across at least two.

AWS secures the cloud (hardware, the hypervisor, physical facilities, managed-service internals). You secure what you put in the cloud (IAM, data encryption, OS patching on EC2, security groups, application code). The split shifts toward AWS as you move from EC2 to containers to serverless.

EC2 when you need full control of the instance or long-running stateful processes. ECS/Fargate for containerised services without managing servers. Lambda for short, event-driven, spiky workloads where you want to pay per request and not think about capacity.

On-Demand (pay per second, no commitment), Reserved Instances / Savings Plans (1–3 year commitment for a big discount), and Spot (spare capacity at up to ~90% off but can be reclaimed with two minutes' notice — good for fault-tolerant batch work).

Standard for frequently accessed data. Standard-IA / One Zone-IA for infrequent access. Glacier Instant / Flexible / Deep Archive for archival, cheapest but with retrieval latency and cost. Use lifecycle rules to transition objects automatically.

Keep the bucket private and put CloudFront in front with Origin Access Control, or generate time-limited pre-signed URLs for direct access. Never make the bucket public for this.

RDS is managed relational (Postgres, MySQL, etc.) — use it when you need joins, transactions and flexible queries. DynamoDB is a managed key-value / document store with single-digit-millisecond latency at any scale — use it when your access patterns are known up front and you can model the table around them.

EBS is network-attached block storage that persists independently of the instance and can be snapshotted. Instance store is physically attached, faster, but ephemeral — data is lost when the instance stops or fails.

A VPC with public and private subnets across two AZs. The load balancer sits in the public subnets; application servers and databases sit in the private subnets. A NAT gateway lets private instances reach the internet for updates. Route tables and security groups control the flow.

A security group is stateful (return traffic is automatically allowed), attached to an ENI, and only has allow rules. A NACL is stateless (you must allow both directions), attached to a subnet, and supports allow and deny rules. Security groups are the primary control; NACLs are a coarse subnet-level backstop.

It lets resources in your VPC reach AWS services (S3, DynamoDB, etc.) over the AWS network instead of the public internet — better security and often lower data-transfer cost. Gateway endpoints for S3/DynamoDB, interface endpoints (PrivateLink) for most others.

A user is a long-lived identity with permanent credentials, for a person or legacy system. A role has no long-term credentials — it is assumed temporarily, issuing short-lived tokens. EC2 instances, Lambda functions and cross-account access should all use roles.

Attach an instance profile with an IAM role that has the required S3 permissions. The SDK picks up temporary credentials from the instance metadata service automatically.

Start from deny-all, grant only the specific actions on the specific resources a principal needs, scope with conditions where possible, and review with IAM Access Analyzer. Avoid wildcard "Action": "*" and "Resource": "*" outside of break-glass roles.

When no warm execution environment is available, AWS provisions one — downloading your code, starting the runtime, running init. Reduce it with a smaller package, a lighter runtime, provisioned concurrency for latency-critical paths, and keeping heavy initialisation outside the handler so it is reused.

SQS is a queue — one consumer group pulls messages, good for decoupling and buffering. SNS is pub/sub fan-out — one message to many subscribers. EventBridge is an event bus with content-based routing rules and many AWS/SaaS integrations — good for event-driven architectures.

Run across multiple AZs, put stateless compute behind a load balancer with health checks and auto scaling, use managed multi-AZ databases, make deployments rolling or blue/green, and test failure (kill an instance, an AZ) rather than assuming it works.

Open Cost Explorer, group by service and then by usage type to find what changed. Common causes: NAT gateway data processing, inter-AZ or internet data transfer, forgotten large EC2/RDS instances, unattached EBS volumes and old snapshots, CloudWatch logs with no retention, and S3 request or storage growth.

Defining infrastructure in version-controlled templates (CloudFormation, CDK, Terraform) instead of clicking in the console. It makes environments reproducible, reviewable and recoverable. Interviewers ask because "I set it up in the console once" does not scale to a team.