# AWS Interview Questions (2026) with Answers > 30 AWS interview questions from junior to senior, each with what a strong answer shows. Practise, then prove the skill with evidence. Source: https://getlemma.io/skills/aws/interview-questions AWS interviews test whether you can build secure, reliable and affordable systems from the services, not recite the catalogue. Expect questions on IAM, VPC networking, compute choices, storage, databases, scaling, monitoring and cost. The 30 questions below run from junior to senior, and each one says what a strong answer covers and the usual trap. [How Lemma tests AWS](https://getlemma.io/skills/aws) ## Junior AWS interview questions 1. ### 1.Explain the shared responsibility model. What a strong answer shows AWS secures the cloud itself: data centres, hardware, the network and the virtualisation layer. You secure what you put in it, such as IAM, data, encryption, network rules and, on EC2, the operating system. A strong answer shows the line moves with the service, so managed services like Lambda leave you less to patch. 2. ### 2.What is the difference between an IAM user, group, role and policy? What a strong answer shows A user is a long-lived identity and a group attaches permissions to many users. A policy is the JSON document that grants or denies actions. A role has no long-term credentials and is assumed for temporary ones through STS. A strong answer prefers roles and federated access over users with access keys. 3. ### 3.What are Regions and Availability Zones, and why do they matter for design? What a strong answer shows A Region is a separate geographic area; each contains several isolated Availability Zones with independent power and networking. Spreading resources across zones protects against a single data centre failure. A strong answer adds that Region choice also affects latency, data residency, service availability and price. 4. ### 4.How do security groups differ from network ACLs? What a strong answer shows Security groups attach to network interfaces, only allow traffic and are stateful, so return traffic is permitted automatically. Network ACLs apply to a subnet, support allow and deny rules evaluated in number order, and are stateless. The common trap is forgetting that a NACL needs rules for ephemeral return ports. 5. ### 5.How do you make sure an S3 bucket and its objects stay private? What a strong answer shows Keep Block Public Access on at account and bucket level, and grant access through IAM and bucket policies rather than ACLs. Encrypt at rest, require TLS in the bucket policy and share files with pre-signed URLs. A strong answer mentions logging and access analysis to catch mistakes, not just the console setting. 6. ### 6.How do you choose an S3 storage class? What a strong answer shows Match the class to access frequency: Standard for hot data, Infrequent Access tiers for occasional reads, Glacier tiers for archives. Intelligent-Tiering suits unknown or changing patterns, and lifecycle rules move objects automatically. Weak answers ignore retrieval fees, minimum storage durations and that One Zone classes lose data if that zone is lost. 7. ### 7.When would you use EBS, EFS or S3? What a strong answer shows EBS is block storage attached to an EC2 instance in one Availability Zone, suited to databases and boot volumes. EFS is a shared NFS file system many instances can mount across zones. S3 is object storage over an API for files, backups and static content, and is not a mounted disk. 8. ### 8.What is the difference between an Application Load Balancer and a Network Load Balancer? What a strong answer shows An ALB works at layer 7 and routes HTTP and HTTPS by host, path or header, which suits web apps and microservices. An NLB works at layer 4 for TCP and UDP, with very low latency and static IP addresses. A strong answer picks based on protocol and routing needs, and mentions health checks on target groups. 9. ### 9.What do you use CloudWatch for? What a strong answer shows CloudWatch collects metrics, logs and events, and raises alarms that can notify people or trigger actions such as scaling. A strong answer knows some EC2 metrics, such as memory use, need the CloudWatch agent. It separates CloudWatch from CloudTrail, which records API calls for auditing. 10. ### 10.Write a policy that lets an application read objects from one bucket and nothing else. ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::reports-bucket" }, { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::reports-bucket/*" } ] } ``` What a strong answer shows Grant only the actions needed on only the resources needed. ListBucket applies to the bucket ARN, while GetObject applies to object ARNs with the slash and wildcard. The trap is s3:\* on all resources, or putting both actions on one ARN so one of them silently does not work. ## Mid-level AWS interview questions 1. ### 11.Design a VPC for a web application with public and private subnets. What a strong answer shows Put load balancers in public subnets that route to an internet gateway. Put app servers and databases in private subnets across at least two zones. Private subnets reach the internet through a NAT gateway, ideally one per zone. A strong answer plans CIDR ranges that will not clash with other VPCs or on-premises networks. 2. ### 12.How do you choose between EC2, Lambda and containers for a new service? What a strong answer shows Lambda suits event-driven or spiky work with short runs and no servers to manage. Containers suit long-running services and portable builds, while EC2 gives full control of the host and special hardware. A strong answer weighs cold starts, run-time limits, steady-state cost and the team's operational skills. 3. ### 13.What is the difference between ECS, EKS and Fargate? What a strong answer shows ECS is AWS's own container orchestrator and EKS runs managed Kubernetes. Fargate is a serverless compute option for either, so you do not manage the underlying instances. A strong answer picks EKS for Kubernetes portability or tooling, and ECS for a simpler setup that is tightly integrated with AWS. 4. ### 14.When would you choose RDS over DynamoDB, or the reverse? What a strong answer shows RDS fits relational data, joins, ad hoc queries and multi-row transactions. DynamoDB fits known access patterns at high scale with predictable latency and no servers to manage. The trap is picking DynamoDB and then needing flexible queries its keys were not designed for. 5. ### 15.How do you design partition and sort keys for a DynamoDB table? What a strong answer shows List the access patterns first, then choose keys so each pattern is a single query, using the sort key for ranges. Choose a partition key with many distinct, evenly used values to avoid hot partitions. A strong answer uses global secondary indexes for other patterns and avoids scans in normal request paths. 6. ### 16.What is the difference between RDS Multi-AZ and read replicas? What a strong answer shows Multi-AZ keeps a synchronous standby in another zone for automatic failover, which is about availability. Read replicas use asynchronous replication to scale reads and can be promoted manually. A strong answer adds that a single-standby Multi-AZ instance serves no reads, while a Multi-AZ DB cluster has two readable standbys. 7. ### 17.How would you configure an Auto Scaling group for a web tier? What a strong answer shows Spread the group across zones behind a load balancer and use load balancer health checks to replace bad instances. Target tracking on a metric such as CPU or requests per target is the usual policy, with scheduled scaling for known peaks. A strong answer covers warm-up time, launch templates and scale-in protection for long tasks. 8. ### 18.How should code on EC2 or Lambda get AWS credentials? What a strong answer shows Attach an IAM role through an instance profile or a Lambda execution role, and let the SDK fetch temporary credentials. A strong answer enforces IMDSv2 on EC2 to reduce credential theft through request forgery. The trap is access keys in environment variables, config files or the code repository. 9. ### 19.How do you manage database passwords and API keys on AWS? What a strong answer shows Store them in Secrets Manager or Systems Manager Parameter Store as encrypted values, controlled by IAM and KMS. Secrets Manager adds built-in rotation, which suits database credentials. A strong answer fetches secrets at runtime with caching, and keeps them out of images, logs and infrastructure code. 10. ### 20.How do instances in a private subnet reach S3 without going through the internet? What a strong answer shows Add a gateway VPC endpoint for S3 and route the subnet's traffic through it, which also avoids NAT data charges. Many other services use interface endpoints powered by PrivateLink. A strong answer restricts access with endpoint policies and bucket policies that require the endpoint. 11. ### 21.When would you use SQS, SNS or EventBridge? What a strong answer shows SQS is a queue that one consumer group pulls from, with retries and dead-letter queues. SNS pushes each message to many subscribers, and EventBridge routes events by content rules across services and accounts. A strong answer combines them, such as SNS fanning out to several SQS queues, and handles duplicate delivery. 12. ### 22.How do you manage AWS infrastructure as code, and how do you stop drift? What a strong answer shows Define resources in CloudFormation, CDK or Terraform, review changes in pull requests and preview them with change sets or plans. Deploy through a pipeline with least-privilege roles, and keep Terraform state remote and locked. A strong answer detects drift regularly and treats console changes in production as incidents. ## Senior AWS interview questions 1. ### 23.Design a highly available web application on AWS. What a strong answer shows Use a CDN in front of a load balancer, an Auto Scaling group or container service across several zones, and a Multi-AZ database. Keep state out of instances in managed stores, add caching and back up data with tested restores. A strong answer states the availability target first and names the remaining single points of failure. 2. ### 24.When is Multi-AZ enough, and when do you need a multi-Region design? What a strong answer shows Multi-AZ covers the loss of a data centre and is the baseline for production. Multi-Region covers a Region-wide failure or data residency needs, at a large cost in complexity. A strong answer ties the choice to RTO and RPO, and compares backup and restore, pilot light, warm standby and active-active. 3. ### 25.How would you review an existing workload against the Well-Architected Framework? What a strong answer shows Walk through the six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. A strong answer ranks the risks found by impact and turns them into a plan with owners. The trap is treating it as a checklist exercise with no follow-up. 4. ### 26.The AWS bill has jumped. How do you find out why and bring it down? What a strong answer shows Break costs down in Cost Explorer by service, account and tag, and set budgets and anomaly alerts. Then rightsize, remove idle resources, use Savings Plans for steady load and Spot for interruptible work. A strong answer checks data transfer, NAT gateway traffic and storage lifecycles, which are often missed. 5. ### 27.How would you structure AWS accounts for a growing company? What a strong answer shows Use AWS Organizations with separate accounts per environment and workload, so the blast radius and billing stay contained. Apply guardrails with service control policies, and centralise logging and security tooling in dedicated accounts. People sign in through IAM Identity Center rather than IAM users in each account. 6. ### 28.How does one AWS account get access to resources in another? ``` { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "partner-7f3a" } } }] } ``` What a strong answer shows The target account creates a role whose trust policy names the other account, and the caller needs permission to call sts:AssumeRole. Both sides must allow the action. For third parties, an external ID condition prevents the confused deputy problem. 7. ### 29.A Lambda function behind API Gateway is slow and sometimes throttled. What do you check? What a strong answer shows Separate cold starts from slow code using traces and duration metrics, then look at package size, memory setting and initialisation work. For throttling, check account and reserved concurrency and the limits of downstream systems such as databases. A strong answer considers provisioned concurrency, connection pooling with RDS Proxy and moving work to a queue. 8. ### 30.An access key has been pushed to a public repository. What do you do? What a strong answer shows Deactivate the key at once, then use CloudTrail to see what it did and look for new users, roles or resources. Remove anything the attacker created, rotate related secrets and check the bill for unexpected usage. A strong answer finishes with prevention: roles instead of long-lived keys, secret scanning and GuardDuty alerts. ![Painting of an olive grove in soft sunlight with hills beyond](https://cdn.sanity.io/images/islu4peo/production/613eb3f93566423c9adf45246f2cf1a61437c04c-1680x1120.jpg?w=1080&fm=webp&q=68&fit=max) ## Prove it instead of claiming it. Answers show you can talk about AWS. A dated test result and live sessions on a Skills Passport show you can do it. Lemma is in early access. ## AWS interviews: common questions ### Do AWS interview questions differ for developers and cloud engineers? Yes. Developers are mostly asked about the services their code uses, such as Lambda, S3, DynamoDB, queues and IAM roles for applications. Cloud and platform engineers also get networking, multi-account setup, infrastructure as code and incident response. Check the job description to see which side the role leans towards. ### Which AWS services should I know well before an interview? Focus on IAM, VPC networking, EC2, Lambda, S3, RDS, DynamoDB, load balancers, Auto Scaling and CloudWatch. Know why you would pick each one and how they fail. Depth in these matters more than a passing knowledge of many niche services. ### How can I check my AWS level before applying for cloud roles? Build and tear down a small multi-tier app, then explain each security and cost decision out loud. Lemma's adaptive skills test for AWS asks 15 to 25 questions that adjust to your answers and records a dated level. Use the result to pick the areas to revise. ## More interview questions [Browse the skills directory](https://getlemma.io/skills) - [SQL interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/sql/interview-questions) - [Product management interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/product-management/interview-questions) - [Python interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/python/interview-questions) - [React interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/react/interview-questions) - [System design interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/system-design/interview-questions) - [JavaScript interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/javascript/interview-questions) - [Node.js interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/nodejs/interview-questions) - [TypeScript interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/typescript/interview-questions) - [Docker interview questionsJunior to senior, with what a strong answer shows](https://getlemma.io/skills/docker/interview-questions) Practising answers is half of it; the other half is showing the skill. See [how Lemma tests AWS](https://getlemma.io/skills/aws), how [adaptive skills tests](https://getlemma.io/product/assessments) work, or [how interviewers assess technical skills](https://getlemma.io/blog/assess-technical-skills-in-interview).