Interview questionsUpdated 12 Oct 2026 · Team InterviewPlan

AWS Cloud Engineer Interview Questions and Answers

AWS cloud engineer interviews test how you design secure, resilient and cost-efficient infrastructure, and how you troubleshoot it. Expect detailed questions on networking, IAM and high availability, plus scenario-based design. These questions reflect what AWS engineers face in 2026 at cloud consultancies, enterprises and startups.

What interviewers test in an AWS cloud engineer interview

AWS interviews typically include service knowledge questions, a design scenario such as hosting a highly available web app, and troubleshooting scenarios like an instance that cannot reach the internet.

Interviewers value security and cost awareness in every answer. A design that works but leaves an S3 bucket public or runs oversized instances scores poorly.

  • Networking: VPC, subnets, routing, NAT, endpoints and connectivity
  • Security: IAM, KMS, security groups, logging and compliance
  • Compute and storage: EC2, containers, Lambda, S3 and EBS
  • Resilience: Multi-AZ, Auto Scaling, backups and disaster recovery
  • Operations: monitoring, infrastructure as code and cost control

Technical topics to revise

Build a small three-tier architecture in your own account with Terraform: a VPC across two Availability Zones, an Application Load Balancer, an Auto Scaling group and an RDS database. Then tear it down to avoid costs.

  • VPC CIDR planning, route tables, internet and NAT gateways, VPC endpoints
  • Transit Gateway and VPC peering
  • IAM policies, roles, permission boundaries and SCPs in AWS Organizations
  • ALB versus NLB, target groups and health checks
  • S3 storage classes, lifecycle rules, versioning and bucket policies
  • RDS, Aurora, DynamoDB and ElastiCache basics
  • Lambda, API Gateway, SQS, SNS and EventBridge
  • CloudWatch, CloudTrail, AWS Config, Cost Explorer and Savings Plans

How to structure your answers

For design questions, clarify requirements first: traffic, availability target, data sensitivity and budget. Then design layer by layer and explicitly mention security, monitoring and cost. Use the Well-Architected pillars as a mental checklist.

For troubleshooting, walk through the path of a request and check each hop in order: DNS, load balancer, security groups, route tables, NACLs and the instance itself.

How InterviewPlan AI helps you prepare

AWS mock interviews ask design and troubleshooting scenarios and give feedback on structure. Resume AI helps quantify cloud work, such as cost savings or improved uptime, and Auto-Apply can find matching cloud roles with every application waiting for your approval.

Interview Copilot gives real-time speaker-labelled transcription and resume-grounded drafts during interviews. Once hired, AWS Job Support gives live expert-plus-AI help in your first 90 days. Both are $5 per hour, and hours and credits never expire.

Questions and model answers

9 questions you are likely to hear.

  1. Design a highly available web application on AWS.

    Why they ask: This is the most common AWS design question and covers many services at once.

    Sample answer: I would create a VPC across at least two Availability Zones, with public subnets for an Application Load Balancer and NAT gateways, and private subnets for the application and database. The app runs in an Auto Scaling group of EC2 instances or ECS Fargate tasks behind the ALB, with health checks. The database is RDS or Aurora in Multi-AZ mode. Static assets go to S3 behind CloudFront. Route 53 handles DNS, ACM provides TLS, and AWS WAF protects the ALB. I would add CloudWatch alarms, automated backups and define everything in Terraform so environments are reproducible.

  2. What is the difference between a security group and a network ACL?

    Why they ask: This is a fundamental networking and security question.

    Sample answer: A security group is a stateful firewall attached to network interfaces like EC2 instances. It supports only allow rules, and return traffic is automatically allowed. A network ACL is a stateless firewall at the subnet level, supports allow and deny rules evaluated in number order, and needs explicit rules for return traffic, including ephemeral ports. I use security groups as the main control, referencing other security groups instead of IP ranges where possible, and NACLs for broad subnet-level blocks. I once fixed a connectivity issue where a NACL blocked ephemeral return ports after a hardening change.

  3. An EC2 instance in a private subnet cannot download updates. How do you troubleshoot?

    Why they ask: This tests networking troubleshooting step by step.

    Sample answer: A private instance needs outbound internet through a NAT gateway, so I first check the private subnet's route table has a 0.0.0.0/0 route to a NAT gateway, and that the NAT gateway sits in a public subnet whose route table points to an internet gateway. Then I check the security group allows outbound traffic, and the NACLs allow outbound traffic and inbound ephemeral return ports. I also check DNS resolution in the VPC settings. If the updates come from S3, like Amazon Linux repositories, a gateway VPC endpoint is a cheaper option and its policy must allow access.

  4. How do you implement least privilege with IAM?

    Why they ask: IAM mistakes are a leading cause of cloud security incidents.

    Sample answer: I give workloads IAM roles instead of access keys, for example instance profiles for EC2 and task roles for ECS, and use IAM Identity Center for people with short-lived credentials. Policies grant only specific actions on specific resources, with conditions where useful. I start from a narrow policy and use IAM Access Analyzer and CloudTrail data to refine it. At the organisation level, SCPs block risky actions like disabling CloudTrail. In one account review, I replaced several policies with wildcard admin access and long-lived keys with scoped roles, which cleared most findings in a security audit.

  5. What is the difference between RDS Multi-AZ and read replicas?

    Why they ask: Interviewers check whether you understand availability versus scaling.

    Sample answer: Multi-AZ is for high availability: RDS keeps a synchronous standby in another Availability Zone and fails over automatically if the primary fails, usually within a minute or two. In the classic setup the standby does not serve reads. Read replicas use asynchronous replication and serve read traffic to scale reads, and they can be in other Regions for disaster recovery, but they can lag and failover to them is a manual or scripted promotion. For a reporting-heavy app, I used Multi-AZ for availability and a read replica for reporting queries, which removed load from the primary.

  6. How would you reduce AWS costs for a team that is overspending?

    Why they ask: Cost optimisation is a key responsibility for cloud engineers.

    Sample answer: I start with Cost Explorer and cost allocation tags to see which services, accounts and teams drive spend. Common wins are rightsizing EC2 and RDS with Compute Optimizer, scheduling non-production environments to stop at night, moving steady workloads to Savings Plans, using Spot for fault-tolerant batch jobs, adding S3 lifecycle rules to cheaper storage classes and deleting unattached EBS volumes and old snapshots. NAT gateway data charges are often overlooked, and VPC endpoints can cut them. In one account these steps reduced the monthly bill by roughly a quarter.

  7. When would you use Lambda instead of containers or EC2?

    Why they ask: This tests architectural judgement about compute options.

    Sample answer: I use Lambda for event-driven, short-running workloads with variable traffic, such as processing S3 uploads, handling API requests with spiky load or running scheduled tasks, because there is no server management and you pay per invocation. I choose containers on ECS or EKS for long-running services, steady high traffic, workloads needing more than 15 minutes or special runtimes. EC2 suits legacy apps or specialised needs. For a document processing pipeline, S3 events triggering Lambda with SQS for buffering handled peaks of thousands of files an hour with no idle cost.

  8. How do you design disaster recovery on AWS?

    Why they ask: DR planning tests understanding of RTO, RPO and trade-offs.

    Sample answer: I start with the business RTO and RPO, because they decide the strategy. Backup and restore is the cheapest, using AWS Backup with cross-Region copies, but recovery takes hours. Pilot light keeps core data replicated in another Region with minimal infrastructure. Warm standby runs a scaled-down copy ready to scale up. Multi-site active-active gives near-zero downtime at the highest cost. Infrastructure as code makes recovery repeatable. For a fintech client with a one-hour RTO, we used warm standby with Aurora Global Database and tested failover every quarter.

  9. Tell me about an AWS migration or project you led.

    Why they ask: This reveals real-world experience and impact.

    Sample answer: I migrated an on-premises Java application and Oracle database for a logistics company to AWS. We rehosted the app servers on EC2 in an Auto Scaling group first, then moved the database to RDS for Oracle using AWS DMS with ongoing replication to minimise downtime. Everything was built with Terraform, and we set up CloudWatch dashboards and alarms before cutover. Cutover took under two hours on a weekend. Afterward, we containerised the app on ECS Fargate. Infrastructure costs dropped, and releases moved from monthly change windows to weekly deployments.

FAQ

Questions people ask about aws cloud engineer.

Which AWS certification helps most for cloud engineer interviews?

Solutions Architect Associate is the most common starting point, followed by SysOps Administrator or DevOps Engineer Professional. Certifications help screening, but interviewers focus on design and troubleshooting scenarios, so pair them with hands-on labs.

Do AWS cloud engineers need to know Terraform?

Most roles expect infrastructure as code, and Terraform is the most widely used. Some teams use CloudFormation or AWS CDK. Know modules, state management and how you review and apply changes safely in a pipeline.

How do I get hands-on AWS experience for interviews?

Use the free tier and build small projects with Terraform: a VPC, a load-balanced app, a serverless API and monitoring. Set budget alerts and destroy resources after use. Be ready to explain every design choice.

Does InterviewPlan AI offer AWS job support?

Yes. AWS Job Support provides live expert-plus-AI help during your first 90 days with infrastructure tickets, troubleshooting and stand-ups. It costs $5 per hour including 200 AI credits, and hours never expire.

P.S.

Reading helps. Practising out loud helps more.

Start free with 5 live minutes and 100 AI credits for Resume AI, Job Search, Auto-Apply, mock interviews and Behavioral Coach.