Top 50 AWS Interview Questions and Answers (2026)

Most AWS interview prep lists give you definitions. Interviews do not test definitions.

They test whether you understand what problem a service solves and what you would use instead. The candidates who get offers are the ones who answer "why this and not that."

So every answer below includes the reasoning, and where it matters, the alternative you should mention. Use them as a structure for your own answers, not a script to recite.

AWS fundamentals

1. What is the difference between a Region and an Availability Zone?

A Region is a geographic area where AWS runs infrastructure. An Availability Zone is one or more discrete data centres within a Region, isolated from the others for power, cooling and networking. You choose a Region for latency, cost and data-residency reasons. You deploy across multiple AZs so a single data centre failure does not take your application down.

2. What is an Edge Location?

A smaller site used for caching content close to users, primarily by CloudFront. It is not where your application runs — it holds copies of content so requests do not travel back to the origin Region.

3. Explain the shared responsibility model.

AWS is responsible for security of the cloud — hardware, the global infrastructure, the hypervisor, managed service internals. You are responsible for security in the cloud — your data, IAM permissions, security group rules, patching guest operating systems, encryption choices.

The useful framing: AWS secures the building; you decide who gets a key to your floor.

4. What is the difference between scalability and elasticity?

Scalability is the ability to handle more load by adding capacity. Elasticity is doing that automatically, adding and removing capacity as demand moves. A system can be scalable without being elastic if scaling requires a human.

5. Vertical vs horizontal scaling?

Vertical means a bigger instance — more CPU and memory on one machine. Simple, but there is a ceiling and usually downtime to resize. Horizontal means more instances behind a load balancer. Harder to design for, but it has no practical ceiling and improves fault tolerance.

Cloud-native designs favour horizontal.

6. What is high availability, and how is it different from fault tolerance?

High availability means minimising downtime, usually by running across multiple AZs so a failure causes a brief disruption at worst. Fault tolerance means continuing with no interruption, which costs considerably more. Most businesses buy high availability and describe it as fault tolerance.

7. What does the Well-Architected Framework cover?

Six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation, and sustainability. In an interview, the value is using them as a checklist when you design something out loud.

8. What is the difference between IaaS, PaaS and SaaS?

IaaS gives you raw infrastructure and you manage the stack on top — EC2. PaaS gives you a managed platform and you supply the application — Elastic Beanstalk. SaaS is finished software you consume — the AWS console itself.

9. How does AWS pricing generally work?

Pay for what you use, with discounts for commitment. The three levers to name: On-Demand for unpredictable workloads, Reserved Instances or Savings Plans for steady predictable usage, and Spot for interruption-tolerant work at a large discount.

10. What is the difference between a service quota and a hard limit?

Most quotas are soft and can be raised through a support request. A few are hard limits that cannot change. Knowing quotas exist at all signals you have operated in a real account.

Compute

11. What is EC2?

A virtual server in an AWS data centre. You choose the instance type, operating system and storage. You control the environment; you do not own the hardware.

12. EC2 vs Lambda — when do you use each?

EC2 for work that runs continuously and needs a full server environment. Lambda for short, event-driven tasks that fire, do their job and stop.

The deciding factors are how long a single unit of work runs, how predictable traffic is, and whether you need control of the operating system. Lambda has a per-invocation time limit and no OS control; EC2 costs money while idle.

Most real systems use both. Full breakdown here.

13. What are EC2 purchasing options?

On-Demand — pay per second, no commitment, for unpredictable workloads. Reserved Instances and Savings Plans — commit for one or three years for a substantial discount, for steady usage. Spot — spare capacity at a deep discount, but AWS can reclaim it, so only for fault-tolerant or interruptible work. Dedicated Hosts — physical server allocated to you, usually for licensing or compliance reasons.

14. What is an Auto Scaling group?

A group that maintains a defined number of instances, replaces unhealthy ones, and adds or removes capacity based on demand or a schedule.

The point interviewers want: a load balancer distributes traffic across whatever servers exist — it cannot create them. Without Auto Scaling you are stuck with a fixed fleet and hope.

15. What is a Lambda cold start?

When no warm execution environment is available, Lambda initialises one before running your code, adding latency to that invocation. It matters for infrequently invoked, latency-sensitive functions and large deployment packages. It matters much less for asynchronous work where nobody is watching a spinner.

16. Does Lambda run inside your VPC?

By default, no. It runs outside and reaches AWS services through their APIs. You attach it to a VPC only when it needs private resources — an RDS instance in a private subnet, for example — and that adds networking configuration you would otherwise avoid.

17. ECS vs EKS vs Fargate?

ECS is AWS's own container orchestrator, simpler and tightly integrated. EKS is managed Kubernetes, chosen when you want the Kubernetes ecosystem or portability. Fargate is not an orchestrator — it is a launch mode that runs containers without you managing the underlying instances, and works with both.

18. When would you choose containers over EC2 or Lambda?

When you want consistent packaging and deployment across environments, longer-running processes than Lambda allows, and more portability than raw EC2 gives. Containers sit between the two in operational overhead.

Storage

19. What is S3?

Object storage. Effectively unlimited, highly durable, and cheap. Objects live in buckets and are retrieved by key. It is not a file system and it is not block storage.

20. Walk me through S3 storage classes.

Standard for frequently accessed data. Intelligent-Tiering when access patterns are unknown and you want AWS to move objects automatically. Standard-IA and One Zone-IA for infrequent access, with One Zone trading resilience for cost. Glacier classes for archival, where retrieval time increases as cost falls, down to Deep Archive for long-term retention you rarely touch.

The interview signal: match the class to access frequency and retrieval urgency, not just to price.

21. S3 vs EBS vs EFS?

S3 is object storage accessed over an API — good for static assets, backups, data lakes. EBS is block storage attached to a single EC2 instance, like a virtual hard drive. EFS is a managed file system that many instances can mount simultaneously.

Pick by access pattern: API access, single-instance disk, or shared file system.

22. What is S3 versioning and why use it?

It keeps previous versions of an object when it is overwritten or deleted. It protects against accidental deletion and application bugs. Worth pairing with lifecycle rules, because storing every version costs money.

23. What is an S3 lifecycle policy?

A rule that automatically transitions objects between storage classes or expires them after a defined period. This is the standard answer to "how would you reduce S3 costs."

24. How do you secure an S3 bucket?

Block Public Access at the account and bucket level unless public access is genuinely required. Use IAM policies and bucket policies for access, encryption at rest, and enable logging. If content must be public-facing, serve it through CloudFront rather than exposing the bucket directly.

Networking

25. What is a VPC?

Your own isolated network inside AWS. You define the IP range, subnets, routing and what is allowed in or out. The analogy that lands well: AWS is a shared building, and a VPC is your private floor.

26. Public vs private subnet — what actually makes the difference?

The route table. A public subnet has a route to an internet gateway; a private subnet does not. Nothing else about the subnet is inherently different.

Load balancers go in public subnets. Application servers and databases go in private subnets so users cannot reach them directly.

27. If a resource is in a private subnet, how does it reach the internet or AWS services?

For outbound internet access, a NAT gateway in a public subnet. For AWS services, a VPC endpoint, which keeps the traffic on AWS's network entirely.

The principle to state: private does not mean cut off. The internet cannot reach in, but your servers can still reach out.

28. Security groups vs NACLs?

Security groups are stateful, attach to resources, and only support allow rules — return traffic is automatically permitted. NACLs are stateless, apply at the subnet level, support allow and deny, and evaluate rules in order.

Day to day you use security groups. NACLs are for coarse subnet-level controls, such as blocking a specific IP range.

29. What is the difference between an ALB and an NLB?

An Application Load Balancer operates at layer 7 and can route on paths, hostnames and headers — the default for HTTP/HTTPS applications. A Network Load Balancer operates at layer 4, handles extreme throughput with very low latency, and supports static IPs — used for TCP/UDP traffic or when you need those characteristics.

30. Why must an internet-facing ALB span at least two Availability Zones?

AWS requires subnets from two or more AZs, so traffic can still be served if one AZ has a problem. This is a favourite because it separates people who have built one from people who have read about one.

31. What is Route 53?

AWS's DNS service. It translates domain names into addresses and supports routing policies — weighted, latency-based, failover, geolocation — which makes it a traffic-management tool, not just DNS.

32. What is CloudFront and when do you use it?

A content delivery network that caches content at Edge Locations near users. Use it to cut latency for a global audience, reduce load on your origin, and terminate TLS at the edge. It can front dynamic traffic too, forwarding requests to your load balancer while caching the static parts.

Databases

33. RDS vs DynamoDB?

RDS when data is relational and you need joins, transactions across tables, or flexible queries. DynamoDB when you need very high volume, low-latency lookups by a known key.

The strongest version of this answer notes that real systems often use both, and explains which dataset went where. Full breakdown here.

34. What is RDS Multi-AZ and how is it different from a read replica?

Multi-AZ maintains a standby in another AZ for automatic failover — it is an availability feature, and you do not read from the standby. A read replica is an asynchronous copy you can read from — it is a performance feature for read-heavy workloads.

Candidates confuse these constantly. Getting it right is a strong signal.

35. What is Aurora and why choose it?

A MySQL- and PostgreSQL-compatible engine built for AWS, with higher throughput than standard RDS, storage that grows automatically, and fast replica failover. Choose it when you want relational semantics with better performance and availability than stock RDS.

36. What is ElastiCache used for?

An in-memory cache — Redis or Memcached — placed in front of a database to serve repeated reads quickly, reducing latency and database load. The standard answer to "the database is under heavy read pressure, what do you do first."

37. What is a DynamoDB conditional write, and why does it matter?

It performs a check and an update as one atomic action — "update this item, but only if this condition still holds."

Why it matters: without it, you check a value and then update it, and another request can slip into the gap between the two. That gap is where race conditions live. A conditional write eliminates it without traditional locking.

38. How do you approach DynamoDB table design?

Start from access patterns, not from the data model. You decide how items will be read first, then design partition and sort keys to serve those reads. This is the inverse of relational modelling, and saying so out loud shows you understand the difference rather than treating DynamoDB as a schemaless SQL database.

Security and identity

39. What is IAM?

The service controlling authentication and authorisation for AWS resources. Users, groups, roles and policies define who can do what.

40. IAM role vs IAM user — when do you use a role?

A user represents a person with long-lived credentials. A role is assumed temporarily and provides short-lived credentials.

Services should use roles, never embedded access keys. "I'd attach a role to the EC2 instance rather than storing credentials on it" is one of the highest-value sentences you can say in an AWS interview.

41. What is the principle of least privilege?

Every identity gets only the permissions required for its job, and nothing more. The reason is blast radius — if something is compromised, the damage is limited to what that identity could do.

42. How do you manage secrets on AWS?

Secrets Manager or Parameter Store, never hardcoded in code or environment files committed to a repository. Secrets Manager adds automatic rotation.

43. How does encryption work at rest and in transit?

At rest, services integrate with KMS to encrypt stored data — S3, EBS, RDS all support it. In transit, TLS. The point to make is that both are needed; encrypting storage while accepting plaintext connections leaves the obvious gap.

44. What does CloudTrail do, and how is it different from CloudWatch?

CloudTrail records API activity — who did what, when, from where. It answers audit questions. CloudWatch collects metrics and logs about how systems are performing. It answers operational questions.

Audit versus operations. Candidates mix these up regularly.

Scenario questions

These are where most offers are won or lost. There is rarely one right answer — the interviewer is watching whether you ask clarifying questions and name your trade-offs.

45. Design a highly available web application.

Route 53 for DNS. CloudFront in front for static content and global latency. An ALB spanning at least two AZs. EC2 instances in private subnets across those AZs in an Auto Scaling group. RDS Multi-AZ for the database. Security groups restricting each tier to only the tier above it. CloudWatch for metrics and alarms.

Then state your assumptions — expected traffic, budget, whether the workload is read-heavy — because a good interviewer wants to hear that you know the answer depends on them.

46. Traffic spikes hard at unpredictable times. How do you handle it?

Auto Scaling with policies driven by a meaningful metric, an ALB across multiple AZs, CloudFront to absorb static requests, and caching in front of the database. If parts of the work can be asynchronous, put them behind a queue so the spike is buffered rather than passed straight through.

47. Your monthly bill jumped unexpectedly. How do you investigate?

Cost Explorer to identify which service and which dimension moved. Check for untagged or orphaned resources — unattached EBS volumes, idle load balancers, forgotten NAT gateways, data transfer costs. Then act: right-size instances, apply Savings Plans to steady workloads, add S3 lifecycle rules, and set budget alerts so it does not recur.

Naming data transfer specifically scores points, because it is the cost people forget.

48. How would you prevent two people from buying the same item at the same time?

A queue controls the flow, but the queue alone does not solve it. The actual protection is a conditional write — mark the item as reserved only if it is still available. Only the first request that satisfies the condition succeeds; the rest fail immediately.

This question separates people who have thought about concurrency from people who have not.

49. A three-tier application is running slowly. How do you diagnose it?

Narrow it down before changing anything. CloudWatch metrics per tier to find where latency accumulates. Check whether the database is the bottleneck — slow queries, missing indexes, read pressure that a replica or cache would relieve. Check whether the application tier is CPU or memory constrained. Check whether static content is being served by application servers instead of CloudFront.

The signal is the diagnostic order, not the list of possible fixes.

50. Migrate an on-premises application to AWS. Where do you start?

Assess first: what the application is, its dependencies, data volume, compliance constraints and acceptable downtime. Then choose a migration strategy — rehost, replatform or refactor — based on the value of changing versus the risk. Move non-critical workloads first to build confidence, plan the data migration and cutover carefully, and be honest that a lift-and-shift is often the right first step even when refactoring is more elegant.

How to actually use these

Three things matter more than knowing all fifty.

Name the alternative. "I'd use DynamoDB here" is an average answer. "I'd use DynamoDB because the access pattern is a key lookup at very high volume, and I'd have used RDS if we needed joins across this data" is a strong one. The comparison is the answer.

Say when you don't know. "I haven't used that, but here's how I'd find out" is a good answer. Bluffing is the fastest way to lose an interview, because interviewers follow up.

Have one system you can explain end to end. Almost every question above appears naturally inside a single real architecture. If you can talk through one complete system and justify every choice, you can answer most of this list without memorising it — this walkthrough is a good template, and the cloud engineer roadmap covers how the rest of the path fits together.

Certifications get you the interview. This is what gets you the offer.