AWS Interview Questions and Answers

Both are JSON documents that grant permissions, but they attach to different things.

• IAM policies are attached to identities (users, groups, roles) and define what those identities can do.
• S3 bucket policies are resource-based and attached to the bucket; they define who from any account can access it.

{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::111122223333:root"},
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-bucket/*"
}

When both apply, a request must be allowed by the identity policy and not explicitly denied by the bucket policy. Use bucket policies for cross-account access and public-read hosting, and IAM policies to control what your own principals can do. An explicit Deny in either document always wins.

Choose S3 when you need durable, virtually unlimited object storage accessible over HTTP from anywhere. Choose EBS when you need a block device attached to a single EC2 instance, such as a database data directory or a boot volume.

Reasons to pick S3:

• Eleven nines of durability across multiple Availability Zones by default.
• Massive scalability and pay-per-use pricing with no pre-provisioning.
• Features such as versioning, lifecycle policies, replication, and event notifications.
• Concurrent access from many clients and services.

Pick EBS for low-latency random I/O, filesystems, and single-instance workloads. EBS volumes are AZ-scoped and usually attach to one instance at a time, although io2 multi-attach exists. Many designs combine them: EBS for the OS and database, S3 for backups, logs, and static assets. Use EFS or FSx when you need shared POSIX file storage.

Both are Elastic Load Balancers, but they operate at different OSI layers.

• Application Load Balancer (layer 7) understands HTTP and HTTPS, supports host and path-based routing, sticky sessions, and WebSockets, and integrates with WAF. It terminates TLS and adds X-Forwarded-For headers.
• Network Load Balancer (layer 4) handles TCP, UDP, and TLS, offers extremely high throughput and ultra-low latency, and preserves the client source IP. It can have a static IP per Availability Zone.

Choose ALB for web applications and microservices that route by URL. Choose NLB for non-HTTP protocols, gaming, IoT, or when you need static IPs or millions of requests per second.

aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:... \
  --protocol HTTPS --port 443 --certificates CertificateArn=arn:aws:acm:...

Both support health checks and cross-zone load balancing.

A role is an identity with permission policies but no permanent credentials. A trusted principal calls AWS STS AssumeRole and receives temporary credentials.

Flow:

1. The role has a trust policy naming who may assume it, such as an account, user, service, or federated identity.
2. The caller invokes sts:AssumeRole and STS returns an access key, secret key, and session token that expire.
3. Requests signed with those temporary credentials are evaluated against the role's permission policy.

aws sts assume-role --role-arn arn:aws:iam::111122223333:role/Deploy \
  --role-session-name deploy-1

Common uses include EC2 instance profiles, ECS and Lambda execution roles, cross-account access, and web identity federation. Prefer roles over long-lived access keys because credentials rotate automatically and can be scoped further with a session policy.

SQS is a queue; SNS is a publish and subscribe topic. They solve different problems and are often combined.

• SQS is point-to-point. A message is stored until a consumer processes and deletes it. It supports visibility timeouts, dead-letter queues, and FIFO ordering. One message is handled by one consumer.
• SNS is fan-out. A publisher sends a message to a topic and it is pushed to all subscribers, including SQS queues, Lambda, HTTP endpoints, and email. There is no storage or retry beyond the delivery policy.

aws sns publish --topic-arn arn:aws:sns:us-east-1:111122223333:orders \
  --message '{"orderId":"42"}'

A common pattern is an SNS topic that fans out to several SQS queues so independent services each process a copy. Use SQS alone for work queues and SNS alone for notifications.

S3 storage classes trade retrieval cost and latency against storage cost.

• S3 Standard is for frequent access with low latency.
• S3 Intelligent-Tiering automatically moves objects between tiers based on access.
• S3 Standard-IA and One Zone-IA are for infrequent access: cheaper storage with a retrieval fee.
• S3 Glacier Instant Retrieval, Flexible Retrieval, and Deep Archive are archival, with retrieval times from milliseconds to hours.

Lifecycle policies transition or expire objects automatically.

{
  "Rules": [{
    "ID": "archive-logs",
    "Status": "Enabled",
    "Filter": {"Prefix": "logs/"},
    "Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"},
                    {"Days": 90, "StorageClass": "GLACIER"}],
    "Expiration": {"Days": 365}
  }]
}

Match the class to the access pattern. Minimum storage durations of 30 to 180 days can make early transitions costly.