AWS Interview Questions for Indian Engineers 2026

EC2 (Elastic Compute Cloud): Virtual machines in the cloud. Know: instance types (compute-optimised, memory-optimised, GPU), pricing models (on-demand, reserved instances, spot instances: spot is 70–90% cheaper but interruptible), AMIs (machine images), security groups (stateful firewalls), key pairs, and EC2 Auto Scaling (scale based on CPU/custom metrics).

S3 (Simple Storage Service): Object storage. Know: buckets and objects, storage classes (Standard, Standard-IA, Glacier: tradeoff between access speed and cost), lifecycle policies (auto-transition between classes), versioning, bucket policies vs ACLs, pre-signed URLs (time-limited access to private objects: critical for interview questions about secure file sharing), cross-region replication.

RDS (Relational Database Service): Managed relational databases (PostgreSQL, MySQL, Aurora). Know: Multi-AZ deployment (synchronous replication to standby: high availability, automatic failover), read replicas (asynchronous replication for read scaling), automated backups, parameter groups, Aurora Serverless (auto-scales capacity).

Lambda: Serverless compute. Know: event triggers (API Gateway, S3 events, SQS, CloudWatch Events), cold starts and how to mitigate them (provisioned concurrency), execution limits (15 minutes max), deployment package size limits, Lambda layers for shared dependencies.

VPC (Virtual Private Cloud): Isolated network within AWS. Know: subnets (public: has internet gateway route; private: no direct internet access), NAT gateway (lets private subnet instances access the internet without being accessible from it), security groups vs NACLs (NACLs are stateless, applied at subnet level), VPC peering, bastion hosts.

SQS (Simple Queue Service): Managed message queue. Know: standard queue (at-least-once delivery, no ordering guarantee) vs FIFO queue (exactly-once delivery, ordered). Dead-letter queues for failed message handling. Visibility timeout (time a consumer has to process before the message becomes visible again). Used for decoupling microservices.

SNS (Simple Notification Service): Pub/sub messaging. One message from a publisher fans out to multiple subscribers (SQS queues, Lambda functions, email, HTTP endpoints). SNS + SQS fan-out pattern is very commonly asked in Indian system design interviews.

CloudWatch: AWS monitoring and observability. Know: metrics (EC2 CPU, Lambda invocations, custom application metrics), alarms (trigger actions when metrics cross thresholds: alert, auto-scale, invoke Lambda), logs (log groups, log streams, metric filters to extract metrics from logs), dashboards.

IAM (Identity and Access Management): Know: users, groups, roles, and policies. Principle of least privilege: grant only the permissions needed. EC2 instance roles (instead of embedding credentials in code). Cross-account access with IAM roles. The difference between identity-based policies and resource-based policies (e.g. S3 bucket policies). MFA for root account is a baseline security requirement.

Scenario: 'Your application needs to process uploaded images asynchronously. How do you architect this on AWS?' Standard answer: User uploads image → S3. S3 event triggers Lambda (or puts message in SQS). Lambda/worker processes image (resize, compress) → stores result in S3. Notify user via SNS/SES.

Scenario: 'How would you make this stateless application highly available across multiple availability zones?' EC2 Auto Scaling group across minimum 2 AZs behind an Application Load Balancer. RDS Multi-AZ for the database. S3 for any shared static assets. Avoid storing session state on EC2: use ElastiCache Redis for sessions.

Scenario: 'Your Lambda function is experiencing cold starts affecting p99 latency. What do you do?' Enable provisioned concurrency for the function: keeps a specified number of execution environments warm. Trade-off: adds cost. Alternative: architect the system so cold start path is not user-facing (use async event patterns for cold paths).

Scenario: 'How do you restrict access to an S3 bucket to only allow your application's EC2 instances?' Attach an IAM role to the EC2 instances with an S3 policy allowing only the required bucket/prefix. Remove any public bucket ACLs. The application uses the instance's IAM role credentials (from EC2 metadata endpoint) rather than embedded access keys.