Interview questions & answers

AWS (Amazon Web Services) interview questions & answers

What are the most common AWS (Amazon Web Services) interview questions?

Amazon Web Services (AWS) is the largest cloud computing platform, offering on-demand compute, storage, databases, networking, and managed services billed by usage. It lets teams run scalable applications without owning physical hardware. Interviews test whether you know the core services (EC2, S3, IAM, VPC), the shared-responsibility model, and how to design secure, highly available, cost-efficient architectures.

Practise in a free AI mock interview Create my free profile

Updated 2026-06-18 · 16 real, commonly-asked questions with answers.

Key takeaways

Amazon Web Services (AWS) is the largest cloud computing platform, offering on-demand compute, storage, databases, networking, and managed services billed by usage.
Core areas to revise for AWS (Amazon Web Services): EC2 & compute, S3 & storage, IAM & security, VPC & networking, Auto Scaling & load balancing.
This guide answers 16 of the most-asked AWS (Amazon Web Services) interview questions — rehearse them in OnJob's free AI mock interview.

EC2 & computeS3 & storageIAM & securityVPC & networkingAuto Scaling & load balancingRDS & DynamoDBLambda & serverlessHigh availability & cost optimization

Top 16 AWS (Amazon Web Services) interview questions

Q1.What is the difference between EC2 and S3?

EC2 (Elastic Compute Cloud) provides resizable virtual servers (instances) where you run applications and control the operating system. S3 (Simple Storage Service) is object storage for files like images, backups, and logs, organized into buckets and accessed over HTTP, not a mounted disk. EC2 is compute; S3 is durable, virtually unlimited storage.

Q2.What is IAM and what are its core components?

IAM (Identity and Access Management) controls who can access AWS resources and what actions they may perform. Its core components are users, groups, roles, and policies. Policies are JSON documents that grant or deny permissions, and roles let services or users assume temporary permissions without long-term credentials, following least privilege.

Q3.Explain the AWS shared-responsibility model.

AWS is responsible for security OF the cloud (the physical hardware, network, and the infrastructure running its services), while the customer is responsible for security IN the cloud (their data, OS patching on EC2, IAM configuration, and access controls). The exact split shifts with the service: managed services like S3 move more responsibility to AWS.

Q4.What is the difference between a security group and a network ACL?

A security group is a stateful virtual firewall attached to an instance: if you allow inbound traffic, the return traffic is automatically allowed, and it supports only allow rules. A network ACL is stateless and operates at the subnet level, evaluating return traffic separately and supporting both allow and deny rules. Security groups are the first line; NACLs add subnet-wide control.

Q5.What is an S3 bucket and how is data durability handled?

An S3 bucket is a container for objects (files plus metadata) identified by a globally unique name. S3 Standard stores data redundantly across multiple devices in at least three Availability Zones, giving 99.999999999% (eleven nines) durability. Storage classes like S3 Standard-IA and Glacier trade retrieval speed for lower cost on infrequently accessed data.

Q6.What is an Availability Zone versus a Region?

A Region is a separate geographic area (such as us-east-1) containing multiple, isolated Availability Zones. An Availability Zone is one or more discrete data centers within a Region with independent power and networking. Spreading resources across multiple AZs gives high availability, because an outage in one AZ does not take down the others.

Q7.What is auto scaling and why is it useful?

Auto Scaling automatically adds or removes EC2 instances based on demand, defined by minimum, desired, and maximum capacity and triggered by metrics like CPU utilization. It maintains performance during traffic spikes and saves cost by shrinking capacity when load drops. It is typically paired with a load balancer that distributes traffic across the instances.

Q8.What is an Elastic Load Balancer?

An Elastic Load Balancer (ELB) distributes incoming traffic across multiple targets such as EC2 instances across Availability Zones, improving fault tolerance. The Application Load Balancer works at layer 7 (HTTP/HTTPS) with content-based routing, while the Network Load Balancer works at layer 4 (TCP/UDP) for extreme performance. It also performs health checks and routes only to healthy targets.

Q9.What is the difference between a NAT Gateway and an Internet Gateway?

An Internet Gateway lets resources in a public subnet send and receive traffic directly to and from the internet. A NAT Gateway lets instances in a private subnet make outbound internet connections (for updates, for example) while preventing the internet from initiating inbound connections to them. One exposes resources; the other gives private resources one-way outbound access.

Q10.What is Amazon RDS and how does it differ from DynamoDB?

Amazon RDS is a managed relational database service supporting engines like MySQL, PostgreSQL, and SQL Server, handling backups, patching, and replication for you. DynamoDB is a fully managed NoSQL key-value and document database offering single-digit-millisecond latency and automatic scaling. Choose RDS for structured, relational data with joins; DynamoDB for high-scale, simple-access patterns.

Q11.What is AWS Lambda and what is serverless?

AWS Lambda runs your code in response to events without you provisioning or managing servers, scaling automatically and billing only for compute time used. Serverless means the cloud provider handles the underlying infrastructure, so you focus on code. Lambda functions are stateless, short-lived (with a maximum timeout), and triggered by events from services like S3, API Gateway, or DynamoDB.

Q12.What is a VPC?

A VPC (Virtual Private Cloud) is a logically isolated section of the AWS network where you launch resources in a defined IP address range. You divide it into public and private subnets across Availability Zones and control traffic with route tables, security groups, and network ACLs. It gives you network-level control similar to an on-premises data center.

Q13.What is the difference between vertical and horizontal scaling on AWS?

Vertical scaling means changing an instance to a larger or smaller type (more CPU and RAM), which requires a restart and has an upper limit. Horizontal scaling means adding or removing instances behind a load balancer, which AWS Auto Scaling automates. Horizontal scaling is preferred on AWS for elasticity and fault tolerance.

Q14.What is Amazon CloudWatch?

CloudWatch is AWS's monitoring and observability service that collects metrics, logs, and events from AWS resources and applications. You set alarms on metrics (such as high CPU) to trigger notifications or Auto Scaling actions, and CloudWatch Logs centralizes log data. It is the primary tool for visibility into the health and performance of your infrastructure.

Q15.How can you reduce costs on AWS?

Use the right pricing model: Reserved Instances or Savings Plans for steady workloads, Spot Instances for fault-tolerant batch jobs, and On-Demand for variable load. Right-size instances, enable Auto Scaling to avoid over-provisioning, move infrequent data to cheaper S3 storage classes, and delete unused resources like idle Elastic IPs and unattached EBS volumes. Cost Explorer and Budgets help track spend.

Q16.What is the principle of least privilege in AWS IAM?

Least privilege means granting users, roles, and services only the minimum permissions required to perform their tasks, and nothing more. In IAM you implement it by writing narrow policies scoped to specific actions and resources rather than broad wildcards, and by using roles for temporary credentials. It limits the blast radius if credentials are compromised.

Free AI mock interview

Practise AWS (Amazon Web Services) out loud

Reading answers is step one. Rehearse them in OnJob's free AI mock interview, get instant feedback, then apply to AI-matched jobs in one click.

Start a free mock interview Create my free profile