Cloud / AWS Interview Questions

EC2 gives you a virtual machine you fully control — OS, runtime, scaling. ECS runs Docker containers on a managed cluster (EC2-backed or Fargate serverless). Lambda is fully serverless — you provide a function, AWS handles everything else, and you pay only for invocation time. Choose EC2 for full control, ECS for containerised apps needing persistent processes, Lambda for event-driven, short-lived tasks.

S3 Standard is for frequently accessed data. Standard-IA (Infrequent Access) is cheaper for data accessed less than once a month, with a retrieval fee. Glacier Instant Retrieval is for archives needing millisecond access. Glacier Flexible / Deep Archive are for long-term cold storage (hours to retrieve). S3 Intelligent-Tiering auto-moves objects between tiers based on access patterns — good when access is unpredictable.

IAM (Identity and Access Management) controls who can do what in your AWS account — users, groups, roles, and policies. Least privilege means granting only the minimum permissions required for a task: no wildcards (*) in actions or resources unless absolutely needed, use roles instead of long-lived access keys, and rotate credentials regularly. Use IAM Access Analyzer to detect overly permissive policies.

A VPC (Virtual Private Cloud) is your isolated network in AWS. You divide it into subnets: public subnets have a route to an Internet Gateway (for things like load balancers and bastion hosts), private subnets don't (for databases and app servers). A NAT Gateway lets private subnets initiate outbound internet connections. Security Groups are stateful instance-level firewalls; NACLs are stateless subnet-level rules.

Auto Scaling Groups (ASG) automatically add or remove EC2 instances based on policies. Scale-out triggers: CPU > 70% for 5 minutes, queue depth, or custom CloudWatch metrics. Scale-in removes instances when load drops. Use Target Tracking policies (simplest — maintain a target metric), Step Scaling (step adjustments), or Scheduled Scaling for predictable patterns. ALBs distribute traffic across healthy instances.

CloudFormation is AWS's declarative IaC service — you describe resources in JSON/YAML templates and AWS provisions them. CDK (Cloud Development Kit) lets you write infrastructure in TypeScript/Python/Java that compiles to CloudFormation. IaC benefits: version-controlled, repeatable, reviewable infrastructure; disaster recovery by re-deploying a stack; no manual console drift. Terraform is a popular cross-cloud alternative.

RDS is managed relational database service (MySQL, Postgres, Aurora) — use it for structured data with complex joins, transactions, and SQL queries. DynamoDB is a managed NoSQL key-value and document store — use it for single-digit millisecond latency at any scale, simple access patterns (get by key, range query on sort key), and when you don't need joins. DynamoDB requires careful schema design upfront around your access patterns.

Block all public access by default (Block Public Access setting). Use bucket policies to restrict access to specific IAM roles or VPC endpoints. Enable server-side encryption (SSE-S3 or SSE-KMS). Enable versioning and MFA Delete for critical buckets. Use S3 Access Logs and CloudTrail for auditing. Never embed AWS credentials in code — use IAM roles for compute services.

CloudFront is AWS's CDN — it caches content at edge locations globally to serve requests from the nearest location, reducing latency and origin load. Use it for static assets, frontend apps (SPA hosting via S3 + CloudFront), API responses that can be cached, and media streaming. It also provides DDoS protection via AWS Shield and can enforce HTTPS.

Right-size EC2 instances (use AWS Compute Optimizer). Use Reserved Instances or Savings Plans for predictable workloads (up to 72% savings). Move to Spot Instances for fault-tolerant batch jobs. Use S3 Intelligent-Tiering and lifecycle rules to move old objects to Glacier. Use Lambda for intermittent workloads — you only pay per request. Set billing alarms in CloudWatch. Use Cost Explorer and Cost Allocation Tags to find waste by team or service.

A cold start is the latency when AWS provisions a new Lambda execution environment (downloads code, starts runtime) for the first function invocation after idle time. Typical cold starts: 100ms–1s for compiled runtimes, lower for Node/Python. Mitigate with Provisioned Concurrency (keeps environments warm — costs more), keeping deployment packages small, using Snap Start (Java), or choosing a lighter runtime. For latency-sensitive APIs, Provisioned Concurrency or moving to always-on compute (ECS/Fargate) may be better.