AWS Interview Questions

What should I study for an AWS interview?

Which AWS questions should I start with?

Start with a clear explanation of AWS. “What is AWS?” was the most asked question, appearing in 6 of 125 interviews. Then check whether you can explain service choices, not just service names. Questions in these interviews included choosing Lambda over EC2 and comparing EC2, ECS, and EKS.

Can you answer these without stopping at a definition?

• What is EC2 used for, and when would you choose Lambda instead?
• How do EC2, ECS, and EKS differ, and when would you choose each?
• What causes Lambda cold starts, and how can you reduce them?
• How would you compare AWS with Azure?

Can I explain how I would build an application?

Go beyond naming services. Architecture and migration appeared in 28 of 125 interviews, while storage and data appeared in 27 of 125 interviews. Use the application design question as a starting point: how would you implement an application using AWS services?

Then check the details covered by related questions:

• How would you let users upload images directly with S3 presigned URLs?
• How would you choose between RDS, Aurora, and DynamoDB?
• How would you plan a database migration or a batch or streaming data pipeline?
• How would you manage Terraform state and modules?
• How would you keep a deployment pipeline secure?

Can I explain security, networking, and recovery?

Security questions covered identity, authentication, encryption, secrets, and incident response. Check whether you can explain how you would manage access, protect data, and handle a security incident.

For networking and operations, answer these questions:

• How do an Application Load Balancer, a Network Load Balancer, and a Classic Load Balancer differ?
• How would you check subnets and routing when troubleshooting a network problem?
• How would you monitor an application and investigate a production problem?
• How would you plan backups, high availability, and disaster recovery?

What code should I be able to write?

Code-writing tasks appeared in 2 of 125 interviews. Use the recorded tasks to check specific Python and Boto3 skills:

• Can you list available EBS volumes and iterate through a response to delete volumes?
• Can you extract all instance IDs from a nested AWS API response in JSON?
• Can you handle failures when using SNS or SQS?
• Can you use Boto3 to create an ECS resource?

Who gets asked AWS

The 20 most asked AWS questions

Counted by interview, not by mention: a question asked twice in one conversation counts once.

1. What is AWS?

   Asked in 6 of 125 interviews · last asked Oct 15 · Concept · Junior

   Show answer

   AWS stands for Amazon Web Services. It is Amazon’s cloud platform, offering services such as computing power, storage, databases, and networking over the internet. Companies use AWS to run applications without buying and maintaining their own physical servers. Most services use pay-as-you-go pricing.

   • Amazon manages the physical infrastructure; customers manage their applications, data, and access permissions.
   • AWS lets customers add or remove resources as demand changes.
   • Common services include EC2 for virtual servers, S3 for object storage, and RDS for managed relational databases.

   What the interviewer checks: The interviewer is checking whether you understand what AWS provides and why companies use it.

   Other ways it was asked

   • “What do you know about AWS?”
   • “Tell me about AWS.”
   • “What does AWS stand for?”

2. What is AWS Lambda, and when would you choose it over EC2?

   Asked in 5 of 125 interviews · last asked Oct 23 · Concept · Mid-level

   Show answer

   AWS Lambda runs code without you managing servers and scales automatically as requests increase. I would choose it over EC2 for short, event-driven tasks or traffic that varies, paying mainly for requests and execution time. I would choose EC2 for long-running work or when I need control over the operating system.

   • Events such as S3 uploads, queue messages, or API requests can trigger Lambda functions.
   • Each Lambda invocation can run for at most 15 minutes.
   • Cold starts can add delay, which matters for time-sensitive requests.
   • EC2 can be more cost-effective for steady workloads, depending on usage.

   What the interviewer checks: The interviewer is checking whether you can match workload needs to Lambda’s limits, costs, and management benefits.

   Other ways it was asked

   • “When would you choose AWS Lambda over an EC2 instance for a compute task?”
   • “Explain AWS Lambda and when you would choose Lambda over EC2.”
   • “What have you used AWS Lambda for, and how does a Lambda function work?”

3. How do EC2, ECS, and EKS differ, and when would you choose each?

   Asked in 4 of 125 interviews · last asked Oct 14 · Concept · Mid-level

   Show answer

   EC2 provides virtual servers you manage; choose it when you need server control. ECS manages containers and suits teams that want simpler operations without Kubernetes. EKS provides managed Kubernetes; choose it when you need Kubernetes tools, APIs, or portability. EKS adds complexity, so those benefits should justify its cost and effort.

   • EC2 supplies compute; ECS and EKS schedule and manage containers.
   • Both ECS and EKS can run containers on EC2 or AWS Fargate, which removes server management.
   • EKS manages the Kubernetes control plane, but you still manage workloads, access, and cluster configuration.
   • Move from ECS to EKS for clear Kubernetes needs, not simply to run more containers.

   What the interviewer checks: The interviewer checks whether you distinguish compute from container management and choose based on workload needs and team skills.

   Other ways it was asked

   • “What is the difference between EC2, ECS, and EKS, and how would you use them?”
   • “What is the difference between ECS and EKS, and in which situations would you choose one over the other?”
   • “Why would you choose Amazon EKS over Amazon ECS?”

4. How would you compare Azure and AWS?

   Asked in 3 of 125 interviews · last asked Oct 6 · Concept · Mid-level

   Show answer

   AWS and Azure are cloud platforms that provide computing, storage, databases, and networking. Both support large production systems, but their services, management tools, and pricing differ. Azure often fits teams already using Microsoft products. I would choose based on workload needs, team skills, regional availability, and total cost.

   • EC2 and Azure Virtual Machines provide virtual servers; S3 and Azure Blob Storage provide object storage.
   • Azure integrates closely with Microsoft Entra ID, Windows Server, and Microsoft enterprise licensing.
   • Both offer managed databases, Kubernetes, serverless computing, and hybrid cloud options.
   • Neither is always cheaper; compare usage, discounts, licensing, support, and data transfer costs.

   What the interviewer checks: The interviewer is checking whether you can compare practical trade-offs and choose a platform for business needs.

   Other ways it was asked

   • “What is the difference between AWS and Azure?”

5. What is EC2 used for?

   Asked in 3 of 125 interviews · last asked Oct 13 · Concept · Junior

   Show answer

   Amazon EC2 is used to run applications on virtual servers in AWS. Each virtual server is called an instance. You choose its operating system, CPU, memory, and storage to match your needs. Common uses include hosting websites, running backend services, and processing data.

   • You manage the operating system, installed software, and security updates.
   • You can choose different instance types for different workloads.
   • Auto Scaling can add or remove instances as demand changes.
   • Pricing depends on instance type, runtime, and purchase option.

   What the interviewer checks: The interviewer wants to know whether you understand EC2 as configurable virtual servers and can name common uses.

   Other ways it was asked

   • “What is an EC2 instance?”
   • “Can you tell me what EC2 is?”

6. What causes cold starts in AWS Lambda, and how can they be mitigated?

   Asked in 3 of 125 interviews · last asked Oct 22 · Concept · Mid-level

   Show answer

   A cold start happens when Lambda prepares a new execution environment before running your handler. Starting the runtime and initializing your code adds delay, often after inactivity or during scaling. Reduce startup work and dependencies, or use Provisioned Concurrency or SnapStart where supported.

   • Provisioned Concurrency keeps environments initialized but costs extra; traffic beyond that capacity can still have cold starts.
   • Reserved Concurrency controls concurrency limits; it does not keep environments warm.
   • SnapStart restores initialized snapshots on supported runtimes to reduce startup delay.
   • Smaller dependencies and less initialization work help; periodic warm-up calls cannot guarantee warm environments.

   What the interviewer checks: The interviewer checks whether you understand initialization delays and can choose practical fixes with cost and support limits.

   Other ways it was asked

   • “What is a cold start in AWS Lambda?”
   • “How do you handle cold starts in Lambda, and what strategies can you use to mitigate them?”

7. How would you use S3 presigned URLs to let users upload images directly?

   Asked in 3 of 125 interviews · last asked Sep 10 · Design · Mid-level

   Show answer

   My backend checks the user and creates a short-lived presigned PUT URL for a unique S3 key. The client uploads the image directly to a private bucket. An S3 event triggers a Lambda function to validate and process it. Processed images use a separate prefix excluded from the trigger.

   • Keep S3 Block Public Access enabled and give the signing role only the required permissions.
   • Configure bucket CORS for browser uploads; treat presigned URLs as temporary secrets.
   • Validate actual image contents; use presigned POST policies when S3 must enforce an upload size range.
   • Make processing safe to repeat because S3 events can be duplicated or arrive out of order.

   What the interviewer checks: The interviewer checks whether you can design secure direct uploads and reliable event-driven processing without routing images through your backend.

   Other ways it was asked

   • “How would you let users upload files directly to Amazon S3 in an image-processing workflow?”
   • “After users upload files to Amazon S3, what steps should an event-driven image-processing workflow take next?”
   • “How would you configure an Amazon S3 bucket for an image-processing workflow?”

8. What is Amazon S3?

   Asked in 3 of 125 interviews · last asked Sep 20 · Concept · Junior

   Show answer

   Amazon S3, or Simple Storage Service, is AWS's object storage service. It stores files as objects in buckets, with each object identified by a key. It is used for backups, images, videos, logs, and data lakes. It scales automatically, and you pay for storage and usage.

   • S3 is object storage, not a block disk or a traditional file system.
   • Objects are private by default; access is controlled through permissions.
   • Storage classes offer different costs, retrieval times, and access charges.

   What the interviewer checks: The interviewer is checking whether you understand S3's storage model and common uses.

   Other ways it was asked

   • “What is Amazon S3, and what is it used for?”

9. What is the difference between an Application Load Balancer, a Network Load Balancer, and a Classic Load Balancer?

   Asked in 3 of 125 interviews · last asked Sep 29 · Concept · Mid-level

   Show answer

   An Application Load Balancer (ALB) works at Layer 7 and routes HTTP and HTTPS requests using rules such as host or path. A Network Load Balancer (NLB) works at Layer 4 for TCP, UDP, and TLS traffic. A Classic Load Balancer (CLB) is the older option, with basic Layer 4 and Layer 7 balancing.

   • Use ALB for web applications that need routing by hostname or URL path.
   • Use NLB for low-latency connections, non-HTTP traffic, or static IP addresses.
   • CLB lacks ALB’s host-based and path-based routing; prefer ALB or NLB for new applications.

   What the interviewer checks: The interviewer checks whether you can choose a load balancer based on protocols and routing needs.

   Other ways it was asked

   • “What is the difference between an Application Load Balancer and a Network Load Balancer?”
   • “What is the difference between a Classic Load Balancer and an Application Load Balancer on AWS?”

10. How would you implement an application using AWS services?

    Asked in 3 of 125 interviews · last asked Oct 22 · Tooling · Mid-level

    Show answer

    For a typical web app, I would serve static files from S3 through CloudFront. API Gateway would route requests to Lambda, with DynamoDB storing application data. Cognito would authenticate users, and IAM roles would control service permissions. I would deploy with infrastructure as code and use CloudWatch for logs, metrics, and alarms.

    • Choose services based on traffic, data access patterns, cost, and reliability needs.
    • Use RDS instead of DynamoDB when the application needs relational queries and joins.
    • Use ECS for long-running backend services that do not fit Lambda.
    • Keep the S3 bucket private and allow CloudFront access through origin access control.

    What the interviewer checks: The interviewer checks whether you can connect AWS services into a working application and explain your choices.

    Other ways it was asked

    • “Can you describe an AWS architecture you implemented and explain which services you used?”
    • “Which AWS services have you used, and how have you implemented them?”
    • “How have you used AWS services in backend projects?”

11. Which AWS services would you use to deploy a microservice?

    Asked in 2 of 125 interviews · last asked Sep 8 · Tooling · Mid-level

    Show answer

    I would deploy a container-based microservice on Amazon ECS with AWS Fargate and store its image in Amazon ECR. An Application Load Balancer would route HTTP requests to it. For an event-driven service, I might use AWS Lambda instead. I would choose EKS only when Kubernetes is a requirement.

    • Give each service its own data ownership, using RDS or DynamoDB as needed.
    • Use SQS for queued work and SNS or EventBridge to share events between services.
    • Use CloudWatch for logs, metrics, and alarms; configure scaling and health checks.
    • Use IAM roles with minimal permissions and Secrets Manager for credentials.

    What the interviewer checks: The interviewer is checking whether you can choose suitable compute, networking, storage, and communication services without unnecessary complexity.

    Other ways it was asked

    • “Which AWS services and microservices patterns would you use when designing a microservices application?”

12. How do you decide whether to use EC2 or Fargate?

    Asked in 2 of 125 interviews · last asked Sep 25 · Concept · Senior

    Show answer

    I choose EC2 when I need control over servers, special hardware, or lower costs for steady workloads. I choose Fargate for containers when I want AWS to manage the servers and reduce maintenance. I compare workload needs, total cost, and how much infrastructure the team can manage.

    • EC2 provides virtual machines; you manage their operating systems, capacity, and patching.
    • Fargate runs containers without server management, but limits host access and hardware choices.
    • ECS manages containers; EKS manages Kubernetes. Both can run workloads on EC2 or Fargate.
    • Compare actual usage and operating costs; neither option is always cheaper.

    What the interviewer checks: The interviewer checks whether you can separate container management from compute choices and explain the trade-offs.

    Other ways it was asked

    • “What is the major difference you have seen between EC2, ECS, EKS, and Fargate?”

13. What steps would you take to debug an issue with an AWS Lambda function?

    Asked in 2 of 125 interviews · last asked Sep 10 · Scenario · Mid-level

    Show answer

    I would start with CloudWatch logs and metrics to find errors, timeouts, or throttling. Then I would check the event payload, code, IAM permissions, memory, timeout, and network access. I would use X-Ray tracing, if enabled, to find slow downstream calls. Finally, I would test the fix and set CloudWatch alarms for recurring failures.

    • Check CloudWatch metrics for errors, duration, throttles, and concurrency.
    • Use request IDs to match failed invocations with logs; check reported memory usage.
    • Check trigger delivery, retry behavior, and failure destinations for the invocation type.
    • Verify execution role permissions, environment variables, and VPC connectivity.

    What the interviewer checks: The interviewer checks whether you can use evidence to isolate failures and monitor the function after fixing them.

    Other ways it was asked

    • “How would you monitor and troubleshoot an AWS Lambda function?”

14. How would you deploy code to AWS Lambda?

    Asked in 2 of 125 interviews · last asked Sep 10 · Tooling · Mid-level

    Show answer

    I would keep the code and an AWS SAM template in Git. The template defines the function, permissions, and settings. A CI/CD pipeline would test the code, run `sam build`, and use `sam deploy` to deploy through CloudFormation. Lambda supports ZIP packages or container images stored in Amazon ECR.

    • Package dependencies for the function’s runtime and CPU architecture.
    • AWS SAM CLI can build deployment packages; AWS CDK and Terraform are other infrastructure-as-code options.
    • Publish immutable function versions and use aliases to manage releases and rollbacks.
    • Keep secrets out of Git; use services such as AWS Secrets Manager.

    What the interviewer checks: The interviewer checks whether you can package Lambda code and deploy it safely through a repeatable, version-controlled process.

    Other ways it was asked

    • “How would you version-control and deploy AWS Lambda function code using infrastructure as code, and which tool would you use?”
    • “What tools can you use to package code for AWS Lambda?”

15. How would you connect a Laravel application to S3 and upload images?

    Asked in 2 of 125 interviews · last asked Jul 31 · Tooling · Mid-level

    Show answer

    I install Laravel’s S3 adapter and configure the bucket, region, and AWS access. I prefer an IAM role over stored access keys. The browser sends the image to Laravel as a multipart upload, and Laravel validates it before storing it on S3. I keep images private and provide temporary URLs when needed.

    • For current Laravel versions, install the league/flysystem-aws-s3-v3 Composer package.
    • Set AWS_BUCKET and AWS_DEFAULT_REGION; Laravel’s s3 disk uses these settings.
    • Give the app only needed S3 permissions, such as PutObject for uploads and GetObject for reads.
    • Validate image type and size; never expose AWS credentials in browser code.

    CodeCopy

    // In routes/web.php, after configuring the s3 disk:
    \Illuminate\Support\Facades\Route::post('/images', function (\Illuminate\Http\Request $request) {
        $request->validate(['image' => 'required|image|max:5120']);
        $path = $request->file('image')->store('images', 's3');
        abort_if($path === false, 500, 'Upload failed');
        $url = \Illuminate\Support\Facades\Storage::disk('s3')
            ->temporaryUrl($path, now()->addMinutes(5));
        return ['path' => $path, 'url' => $url];
    })->middleware('auth');

    What the interviewer checks: The interviewer checks whether you can configure Laravel storage, handle uploads safely, and control S3 access.

    Other ways it was asked

    • “Could you explain step by step how to upload an image from a local desktop to an S3 bucket using Laravel or PHP?”
    • “How do you connect a Laravel application to Amazon S3?”

16. How do simple, weighted, latency-based, failover, and geolocation routing policies differ in Route 53?

    Asked in 2 of 125 interviews · last asked Aug 31 · Concept · Mid-level

    Show answer

    Simple routing returns configured record values. Weighted routing splits DNS responses by relative weights, while latency-based routing selects the AWS Region with the lowest measured latency. Failover routing uses a primary endpoint and switches to a secondary when health checks show failure. Geolocation routing selects records by the user's location, not latency.

    • Simple routing can return multiple values but does not support health checks.
    • Weights control DNS response proportions, not exact percentages of application requests.
    • Latency-based routing does not necessarily choose the geographically closest Region.
    • Geolocation routing needs a default record to cover unmatched or unknown locations.

    What the interviewer checks: The interviewer checks whether you can choose a routing policy based on traffic distribution, performance, availability, or location.

    Other ways it was asked

    • “Explain weighted, latency-based, failover, and geolocation routing.”
    • “What is the difference between simple and weighted routing policies in Route 53?”

17. What is IAM in AWS?

    Asked in 2 of 125 interviews · last asked Aug 31 · Concept · Junior

    Show answer

    IAM stands for Identity and Access Management. It controls who can access AWS resources and what actions they can take. I secure access by granting only needed permissions, using roles with temporary credentials, and requiring multi-factor authentication for human users.

    • IAM policies define permissions for actions on AWS resources.
    • Users have long-term identities; roles provide temporary credentials when assumed.
    • Requests are denied unless allowed; an explicit deny overrides an allow.
    • Protect the root user with MFA and avoid using it for daily work.

    What the interviewer checks: The interviewer checks whether you understand AWS access control and basic ways to secure it.

    Other ways it was asked

    • “What is IAM and how do you secure AWS access?”

18. What are the benefits of using Terraform, and why not just use CloudFormation?

    Asked in 2 of 125 interviews · last asked Aug 31 · Concept · Mid-level

    Show answer

    Terraform can manage AWS, other clouds, and third-party services through one tool. It supports reusable modules and previews changes before applying them. I prefer it when a team needs that flexibility, but CloudFormation is a good AWS-only choice because AWS manages its state and provides built-in stack rollback.

    • Both tools support infrastructure as code and repeatable deployments.
    • Terraform uses providers to manage resources across many platforms.
    • Terraform state needs secure storage, access control, and locking for team use.
    • CloudFormation offers change sets to preview updates; Terraform offers plans.

    What the interviewer checks: The interviewer wants to see whether you can explain practical trade-offs instead of claiming one tool is always better.

    Other ways it was asked

    • “Between Terraform and CloudFormation, which do you prefer for AWS, and why?”

19. How would you organize AWS accounts, VPCs, and environments to isolate production from development and testing?

    Asked in 2 of 125 interviews · last asked Jun 16 · Design · Senior

    Show answer

    I would use separate AWS accounts for production, development, and testing, with separate VPCs in each account. For many workloads, I would use an account per workload and environment. AWS Organizations would group accounts by environment and apply guardrails. Production access and network connections would be restricted, with separate accounts for security and central logs.

    • Use accounts as the main isolation boundary; VPCs provide network isolation within accounts.
    • Use Control Tower to automate account setup and apply consistent controls.
    • Apply service control policies to limit permissions; they do not grant access.
    • Deploy through controlled pipelines, with production approvals and no routine development access to production.

    What the interviewer checks: The interviewer checks whether you can isolate failures and access while managing many workloads consistently.

    Other ways it was asked

    • “How would you structure more than 50 production workloads across AWS accounts, VPCs, and environments?”
    • “How would you design a secure multi-account AWS environment from day one, with strict separation between development, testing, and production?”

20. How would you design a multi-region AWS architecture to provide high availability and security for an application?

    Asked in 2 of 125 interviews · last asked Sep 30 · Design · Senior

    Show answer

    I would run the application across multiple Availability Zones in a primary Region, with a standby in another Region. Route 53 health checks would direct traffic to the healthy Region. I would replicate data across Regions and plan database promotion during failover. I would use private subnets, least-privilege IAM, encryption, and AWS WAF.

    • Active-passive is simpler than active-active, but the standby needs enough capacity to handle traffic.
    • Asynchronous replication can lose recent writes; choose a database strategy based on acceptable data loss.
    • Keep databases private, restrict security groups, and encrypt traffic and stored data.
    • Test failover and recovery against recovery time and data loss targets; DNS changes are not instant.

    What the interviewer checks: The interviewer checks whether you can balance regional failure recovery, data consistency, security, and cost.

    Other ways it was asked

    • “How would you design a simple cross-region application architecture on AWS?”

Related interview questions

• Software Engineer interview questions
• Cloud Engineer interview questions
• DevOps Engineer interview questions
• Data Engineer interview questions
• Cybersecurity interview questions
• Solutions Architect interview questions
• Azure interview questions
• Docker interview questions
• Kubernetes interview questions
• Terraform interview questions
• CI/CD interview questions
• Linux interview questions
• Active Directory and Windows Server interview questions

How this list is made

Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.

Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.

The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every AWS interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.

125 interviews, 83 candidates, Jan 2026 to Oct 2026. Updated every month with new interviews.