AWS resumes all list the same services, so the interview has to test judgment: security defaults, architecture trade-offs, and cost awareness. These questions are scenario-driven, and each includes what a strong answer covers so you can score candidates without being a cloud architect yourself.
What a strong answer covers
Users hold long-lived credentials, roles are assumed for temporary credentials, policies define permissions attached to either. Strong answers push toward roles everywhere — instance profiles, IRSA, identity-center SSO for humans — and least-privilege policies over broad managed ones.
What a strong answer covers
Public subnets only for load balancers and NAT, application and database tiers in private subnets across at least two availability zones, security groups as the primary firewall, and no public IPs on databases. Mention of VPC endpoints to keep S3 and other traffic off the internet is a senior touch.
What a strong answer covers
Lambda for spiky, event-driven, short-lived work with low operational overhead; containers for long-running services, heavy dependencies, predictable high throughput, or when cold starts and the 15-minute limit hurt. The honest cost comparison at sustained load is what separates practitioners from slide readers.
What a strong answer covers
Immediate: block public access, review access logs and CloudTrail to scope exposure, notify the right people. Prevention: account-level Block Public Access, SCPs or org policies, infrastructure-as-code review, and automated detection with Config rules. Watch for whether incident communication is part of their answer.
What a strong answer covers
Relational needs and complex queries point to RDS or Aurora; Aurora for higher availability and scale within the relational world; DynamoDB for known access patterns at scale with single-digit-millisecond needs. A strong candidate asks about access patterns before answering — that instinct is the real signal.
What a strong answer covers
Cost Explorer grouped by service and tag, checking for the usual suspects: NAT gateway data processing, unattached volumes and snapshots, oversized instances, cross-AZ traffic, forgotten environments. Structural fixes: tagging discipline, budgets and alerts, savings plans or reserved capacity, right-sizing. Cost fluency is rare and valuable.
What a strong answer covers
AWS Organizations with separate accounts for prod, staging, and security/log-archive, SCP guardrails, centralized identity, and consolidated billing. The why: blast-radius isolation, cleaner permissions, and per-team cost visibility.
What a strong answer covers
Multi-AZ from the start: instances or tasks spread across AZs behind an ALB, health checks that actually detect failure, Multi-AZ database deployment, and testing the failover rather than assuming it. Anyone who mentions chaos-testing or game days has operated for real.
What a strong answer covers
Secrets Manager or SSM Parameter Store, IAM-scoped access, rotation where supported, and never in environment files, AMIs, or code. Bonus signal: KMS understanding and how they inject secrets into Lambda or ECS at runtime.
What a strong answer covers
Terraform or CloudFormation/CDK in version control, plan/diff reviewed in pull requests, applied by a pipeline rather than laptops, with state management and drift detection. Listen for how they handle a change that would replace a production database — the pause matters.
What a strong answer covers
Correlate with the deploy timeline, check downstream dependencies, use X-Ray or equivalent tracing to find the slow segment, examine connection pools and cold starts, and be ready to roll back first and investigate second. Rollback-first honesty is a senior trait.
What a strong answer covers
SQS for queued point-to-point work with retries and DLQs, SNS for fan-out pub/sub, EventBridge for event routing with filtering across services and SaaS sources. A classic combination: EventBridge or SNS fanning out to SQS queues per consumer for durable, independently scaled processing.
What a strong answer covers
Service quotas and limits, database connection ceilings, auto-scaling policies and their tested behavior, caching layers, queue depth handling, and a load test against a production-like environment. Enumerating limits before code changes shows operational maturity.
Skip the interviews entirely — get matched with pre-vetted AWS developers in 48 hours, $0 until you hire.
Need a custom question set?
Our free interview question generator builds a tailored list for any role, seniority, and focus area.
Try the interview question generator →They confirm vocabulary and breadth, not judgment. Treat a certification as a reason to go deeper in the scenario questions, never as a substitute for them — the cost and incident questions here expose the difference quickly.
Startups should weight cost control, Lambda-versus-containers, and the ten-x scaling question. Enterprises should weight multi-account architecture, IAM, and networking. The security questions are non-negotiable for both.
Have them review a small Terraform or CloudFormation template with three or four planted issues — a public security group, an over-broad IAM policy, a missing Multi-AZ flag. Reviewing infrastructure reveals more than writing toy infrastructure.
Hire directly
Hire vetted AWS developers in the USA →Other interview guides
Vetted talent ready for US teams. No recruitment fees. Zero risk.
🇺🇸 Trusted by companies across the United States