Articles

AWS Interview Questions for Software Engineers: Compute, Networking, Storage, IAM, and Reliability

Prepare for AWS interview questions on compute, VPC networking, storage, IAM, queues, observability, and reliable architecture design decisions.

AWS interview questions for software engineers are rarely a test of how many service names you can recite. They test whether you can start from a workload, choose an AWS service for a defensible reason, trace one failure, and prove the design works.

A strong answer therefore sounds like an engineering decision, not an AWS catalog. State the traffic shape, latency needs, data model, trust boundary, and recovery objective. Then explain what you operate, what AWS operates, and what changes when a dependency slows down, an event is delivered twice, or an Availability Zone becomes unavailable.

The AWS examples below help you map those fundamentals to compute, networking, storage, IAM, queues, observability, and reliability without confusing AWS technical judgment with Amazon behavioral preparation.

Quick answer: use Workload, Boundary, Service, Failure, Evidence

For any AWS architecture question, use five passes:

Workload: Define requests, events, data, latency, scale, compliance, and recovery objectives.
Boundary: Draw trust, network, ownership, Availability Zone, and Region boundaries.
Service: Pick the service whose guarantees and operating model fit those constraints.
Failure: Walk through a timeout, duplicate event, permission denial, zonal loss, or restore.
Evidence: Name the metrics, logs, traces, audit events, alarms, and recovery test that validate the claim.

What AWS interviewers are actually testing

Signal	Weak answer	Stronger answer
Service selection	“Lambda scales automatically.”	Defines traffic, duration, concurrency, packaging, latency, and operational constraints before choosing Lambda.
Networking	Draws public and private boxes.	Traces routes, gateways, load balancers, security groups, DNS, and return traffic.
Data judgment	Says S3 is durable and DynamoDB is fast.	States access patterns, consistency, transactions, recovery, hot keys, and data ownership.
Security	Attaches a broad IAM role.	Evaluates the principal, action, resource, conditions, boundaries, and audit evidence.
Reliability	Adds Multi-AZ and backups.	Defines the fault, customer behavior, RTO, RPO, failover trigger, and tested recovery path.

The bar rises with seniority. Senior candidates should also discuss migration, cost drivers, ownership, residual risk, and the next bottleneck.

Compute interview questions: EC2, containers, or Lambda?

How would you choose between EC2, ECS on Fargate, EKS, and Lambda?

Start with the execution contract. Choose Amazon EC2 when you need host-level control, specialized instances, long-running processes, or software that does not fit a managed runtime. That control also means owning more patching, capacity, deployment, and host recovery.

Amazon ECS provides AWS-native container orchestration. AWS Fargate removes server-capacity management while preserving a container process model. Amazon EKS fits teams that need Kubernetes APIs and can justify the added operational complexity.

AWS Lambda fits event-driven, bounded units of work when you want AWS to manage capacity and the runtime fleet. Ask about execution duration, package and runtime constraints, connection behavior, concurrency, startup sensitivity, and retry semantics. “Serverless” reduces server management; it does not remove application operations.

The AWS compute decision guide frames the choice around workload and operating model. A strong candidate can also reject a technically possible choice because the team cannot operate it safely.

Scenario: design a stateless HTTP API

Clarify volume, latency, authentication, payload size, connections, and traffic shape. One answer might put an Application Load Balancer before ECS tasks on Fargate across multiple Availability Zones.

Lambda behind API Gateway is a reasonable alternative for event-shaped traffic and a small operational surface. EC2 may win for specialized networking, sustained compute, or host controls. The important part is the comparison: scaling unit, failure isolation, rollout, connection pressure, idle cost, observability, and team ownership.

Networking interview questions: trace the packet

What makes a subnet public or private?

A subnet is not public because of its name. Route tables and addressing determine reachability. An internet-facing path needs an internet-gateway route and public address; a private workload can initiate outbound traffic through a NAT gateway.

For supported AWS services, a VPC endpoint can avoid sending private service traffic through the NAT or public internet path. In an interview, draw DNS resolution, the load balancer, route table, gateway or endpoint, security group, target, and return path. The first incorrect hop is often more useful than a crowded diagram.

Security groups versus network ACLs

AWS VPC security guidance recommends security groups as the primary network-control mechanism. Security groups are stateful and attach to resource network interfaces. Network ACLs are stateless, apply to subnets, and fit coarse guardrails or explicit deny rules.

Do not say that private subnets or security groups replace IAM. Network controls decide which paths are reachable; IAM decides whether an authenticated AWS request is authorized. Both can be correct while an application still exposes an insecure business operation.

Storage and database questions: choose from access patterns

When should you use S3, EBS, or EFS?

Amazon S3 is API-addressed object storage. Amazon EBS provides block volumes for compute that needs a disk abstraction. Amazon EFS provides a shared filesystem for multiple clients.

The correct question is not “Which is fastest?” Ask whether the application needs object, block, or shared-file semantics; random writes; shared access; snapshots; lifecycle rules; replication; and recovery. AWS's storage decision guide starts from those access patterns.

Amazon S3 provides strong read-after-write consistency for object writes and deletes. That does not make a multi-object workflow transactional or protect an application from overwriting the wrong version. Discuss versioning, conditional writes, lifecycle, replication, and restore according to the scenario.

RDS or Aurora versus DynamoDB

Use Amazon RDS or Amazon Aurora when the workload benefits from a relational model, SQL, joins, constraints, and transactions. Use Amazon DynamoDB when key-value access patterns can be designed explicitly and the application benefits from managed partitioning and scale.

Do not choose DynamoDB merely because the prompt says “large scale.” Define keys, access patterns, hot-key risk, consistency, and indexes. For a relational database, discuss connections, query plans, replicas, failover, backups, and schema evolution. The AWS database decision guide makes both data and operating models part of the choice.

IAM interview questions: calculate effective permission

How does AWS decide whether a request is allowed?

Start with the request: principal, action, resource, and context. AWS begins with implicit deny. Identity-based and resource-based policies can grant permission, and their interaction depends on the principal and account boundary; an explicit deny overrides an allow. Permissions boundaries, session policies, and AWS Organizations controls can further restrict the result.

That is why “the role has S3 access” is incomplete. Name the exact action and resource, examine conditions, check the bucket policy and organization guardrails, and then inspect the denial context. The official IAM policy evaluation logic is the source of truth.

Prefer IAM roles and temporary credentials to long-lived access keys. Grant required actions on required resources, refine permissions from observed activity, and use AWS CloudTrail for an audit trail.

Queues and event processing: assume duplicates

How would you design an asynchronous image-processing pipeline?

Store the uploaded object in S3, record the durable job identity, and send work to an Amazon SQS queue. Consumers can run on Lambda or containers based on runtime and packaging needs. Use an idempotency key so a repeated message does not create a second customer-visible result.

Amazon SQS standard queues use at-least-once delivery. The visibility timeout hides a received message temporarily; if the consumer fails to delete it in time, it becomes visible again. Set the timeout from observed processing behavior, extend it deliberately for long work, bound retries, and send exhausted messages to a dead-letter queue with a replay process.

Lambda retries depend on the invocation path. AWS warns that event source mappings can process records more than once, so idempotency belongs in business logic, not in a hope that the integration is exactly once.

Reliability questions: define the failure before the region count

Multi-AZ and multi-Region solve different fault scopes. A Multi-AZ workload distributes resources across isolated Availability Zones within one Region. Multi-Region can address a regional disruption or geographic requirement, but it duplicates infrastructure and introduces data-replication, dependency, deployment, failover, and testing complexity.

AWS guidance recommends starting with single-Region resilience, then justifying multi-Region from the workload's fault model. Define recovery time objective as the targeted time to restore service and recovery point objective as the acceptable data-loss window. A backup, standby, or active-active label does not prove either objective.

Walk one failure all the way through: who detects it, what signal triggers mitigation, how traffic moves, which data is authoritative, what happens to in-flight writes, how operators stop a bad failover, and how recovery is tested. A reliable design includes the runbook and exercise, not only the architecture diagram.

Observability questions: health, causality, and audit

Amazon CloudWatch covers workload and resource observability through metrics, alarms, dashboards, logs, and application signals. AWS CloudTrail records account activity and API actions. CloudWatch helps answer “Is the service healthy and why is the request slow?” CloudTrail helps answer “Who or what changed this resource?”

For an API, include requests, errors, latency, saturation, dependency timeouts, retries, queue age, and degraded responses. Propagate trace context across calls and messages. Alert on customer symptoms and link each alarm to a diagnostic view and owned response.

A seven-day AWS interview preparation plan

Day	Focus	Deliverable
Day 1	Workload and compute	Compare EC2, containers, Fargate, EKS, and Lambda for one API.
Day 2	Networking	Trace public ingress, private compute, egress, endpoints, DNS, and return traffic.
Day 3	Storage and data	Choose S3, EBS, or EFS, then compare a relational database with DynamoDB.
Day 4	IAM	Evaluate five principal-action-resource requests, including one explicit deny.
Day 5	Async work	Design SQS consumption, visibility timeout, idempotency, DLQ, and replay.
Day 6	Reliability	Define RTO/RPO and walk through an Availability Zone failure and restore.
Day 7	Full mock	Deliver one architecture using all five passes and defend a rejected alternative.

Frequently asked questions

Do I need to memorize every AWS service?

No. Know the major compute, networking, storage, database, identity, messaging, and observability primitives. More importantly, practice the criteria that choose among them. An interviewer learns more from a correct failure and ownership argument than from a long list of products.

Is Lambda always the best serverless compute choice?

No. Lambda fits bounded event-driven functions, while Fargate fits container workloads that need a process and container runtime without server management. Compare duration, packaging, concurrency, startup sensitivity, networking, execution control, and cost shape before deciding.

Does a private subnet make an application secure?

No. It reduces direct network exposure when routes and addressing are configured correctly. The workload still needs security groups, IAM authorization, application authentication, data protection, patching, logging, and controlled egress. Trace both network reachability and request authorization.

Should every reliable AWS architecture use multiple Regions?

No. Start from the business fault model, RTO, RPO, and regulatory needs. A well-designed Multi-AZ workload may meet the requirement with less complexity. Multi-Region is justified when the broader fault boundary or geography is worth duplicated infrastructure, data coordination, and continuous failover testing.

What makes an AWS interview answer senior-level?

A senior answer states assumptions, rejects alternatives, names ownership, and connects service guarantees to customer behavior. It covers rollout, quotas, cost drivers, security, failure recovery, observability, and residual risk, then identifies the evidence that would cause the team to revisit the decision.

Final takeaway

The best AWS interview answers are workload arguments with failure evidence. Use Workload → Boundary → Service → Failure → Evidence to choose compute, trace the VPC, model data, evaluate IAM, handle duplicate events, and prove recovery.

The goal is not to memorize one “correct” AWS diagram; it is to make each boundary and trade-off defendable.

Sources and Further Reading

Research note: This guide was checked on September 1, 2026. AWS service modes, quotas, prices, and Region availability can change; verify them against the current documentation and the interview scenario.