AWS Interview Questions India 2026: EC2, S3, Lambda, and Cloud Architecture

EC2: 'What is the difference between an instance type and an AMI?' (instance type = hardware specs: CPU cores, memory, network bandwidth, e.g. t3.medium, c6g.large, m6i.xlarge; AMI = software image: OS, pre-installed software, configuration). 'What is the difference between on-demand, reserved, and spot instances?' (on-demand: pay per hour/second, no commitment; reserved: 1 or 3 year commitment for 40-75% savings; spot: bid for unused capacity at up to 90% savings, but can be interrupted with 2-minute notice). 'What is the difference between a security group and a Network ACL?' (security group: stateful, instance-level; inbound rule automatically allows return traffic; NACL: stateless, subnet-level; you must explicitly allow both inbound and outbound for each traffic flow).

S3: 'What are the S3 storage classes?' (Standard: frequently accessed, low latency, 11 9s durability; IA: same durability, cheaper storage, retrieval cost; Glacier Instant Retrieval: milliseconds; Glacier Flexible: minutes to hours; Intelligent-Tiering: auto-moves between tiers). 'What is the difference between an S3 bucket policy and an IAM policy?' (bucket policy: resource-based, attached to the bucket, can grant cross-account access to any principal; IAM policy: identity-based, attached to a user/role/group, controls what that identity can do across services).

Lambda: 'What is a cold start?' (time to initialise a new execution environment when no warm instance exists: runtime init + function code load + init code execution; mitigate with provisioned concurrency, minimal init code, SnapStart for Java). 'What is the Lambda execution model?' (each invocation gets its own execution environment; environments are re-used for subsequent invocations (warm); /tmp (512MB-10GB) persists across warm invocations in the same environment; do not store sensitive state in /tmp).

Highly available web application: multi-AZ EC2 instances (at least 2 AZs, one instance per AZ minimum) behind an Application Load Balancer; Auto Scaling Group to scale on CPU or request metrics; RDS Multi-AZ for automatic database failover (standby in a different AZ); ElastiCache (Redis) for session storage to make instances stateless; CloudFront for static assets (S3 + CloudFront reduces latency for India users); Route 53 with health checks for DNS-level failover.

Serverless architecture decision: Lambda + API Gateway + DynamoDB is the fully serverless option. Advantages: no server management, automatic scaling to zero and up, pay per invocation. Disadvantages: cold starts (latency spike on idle), Lambda 15-minute timeout limit, DynamoDB access patterns must be designed upfront (no ad-hoc queries), higher cost at consistently high throughput (EC2 is cheaper above a certain requests/second threshold).

SQS vs SNS vs EventBridge: SQS (queue: messages processed by ONE consumer, deleted after processing, used for decoupling and retry), SNS (pub-sub: one message delivered to ALL subscribers, used for fan-out notification), EventBridge (event bus: route events by pattern to multiple targets, used for event-driven architectures and cross-account event routing).

Data lake architecture: raw data lands in S3 (landing zone), ETL via AWS Glue or Lambda (transforms and loads to S3 processed zone), AWS Glue Data Catalog for schema discovery, Athena for serverless SQL queries on S3, QuickSight for visualisation. Versus RDS for OLTP (row-level transactional workloads).

Principle of least privilege: every IAM identity (user, role, group) should have the minimum permissions required for its function. In practice: use specific actions (s3:GetObject not s3:), specific resources (arn:aws:s3:::my-bucket/ not *), and conditions (aws:SourceIP, aws:RequestedRegion) where applicable.

IAM roles vs IAM users: IAM user = long-term credentials (access key + secret key), recommended only for human users or CI/CD systems that cannot use role assumption. IAM role = temporary credentials via STS AssumeRole; EC2 instance roles, Lambda execution roles, ECS task roles, cross-account access all use roles. Best practice: no long-term access keys in production; rotate any that exist; use IAM roles for service-to-service authentication.

VPC concepts: public subnet (has an Internet Gateway route), private subnet (no direct internet access; uses NAT Gateway for outbound internet), subnet vs VPC (VPC is the virtual network; subnet is a range within an AZ), security group (stateful, instance-level), NACL (stateless, subnet-level).

AWS Shared Responsibility Model: AWS is responsible for security OF the cloud (physical infrastructure, hardware, global network, hypervisor, managed service software). Customer is responsible for security IN the cloud (IAM policies, data encryption, network configuration, OS and application security for EC2/ECS, compliance).

For IT services cloud roles (TCS Digital, Infosys Cobalt, Wipro Cloud): AWS Solutions Architect Associate certification is commonly required or expected. Focus: EC2, S3, RDS, VPC, IAM, Route 53, CloudFront, SQS, SNS. Stephane Maarek's SAA-C03 course (Udemy) is the standard preparation.

For product company DevOps/cloud roles (Swiggy, Zomato, Razorpay): Expect deeper architecture questions, cost optimisation (right-sizing, Reserved Instances, Savings Plans, Spot for non-critical workloads), EKS or ECS for containers, CloudWatch for observability, IaC with Terraform or CDK.

For AWS India: Professional-level depth, Well-Architected Framework (5 pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimisation), multi-region architectures, disaster recovery patterns (RTO/RPO: pilot light, warm standby, multi-site active-active).

Hands-on preparation: deploy a simple 3-tier application (EC2 in private subnet + ALB + RDS Multi-AZ + S3 for static assets) on a free tier account. Walk through the networking choices (VPC, subnets, security groups, NAT Gateway, Internet Gateway). This hands-on knowledge is what separates certification-level answers from practical depth in interviews.