AWS_Practical_Interview_101 200

AWS Practical Interview Questions (101-200)

CloudFront and CDN

Q101: How do you create CloudFront distribution?

What it is: A CloudFront distribution pairs an origin with caching and behaviour rules, then serves that content from edge locations worldwide.

Why it is used: To put a CDN in front of S3 or an ALB, lowering latency and shielding the origin.

# Create distribution
aws cloudfront create-distribution \
  --origin-domain-name mybucket.s3.amazonaws.com \
  --default-root-object index.html \
  --enabled \
  --price-class PriceClass_All

Interview talking point: “create-distribution needs only an origin domain and —enabled; —default-root-object makes the root URL serve index.html. Allow 5 to 15 minutes for a new distribution to deploy, then point your own DNS at the resulting cloudfront.net domain.”

Q102: How do you set up CloudFront with S3?

What it is: An origin access identity is a legacy CloudFront credential that proves requests to S3 are legitimate, letting the bucket stay private.

Why it is used: To serve private S3 content through CloudFront without making the bucket public.

# Create OAI
aws cloudfront create-cloud-front-origin-access-identity \
  --cloud-front-origin-access-identity-config CallerReference="my-oai",Comment="OAI for S3"

# Update S3 bucket policy
aws s3api put-bucket-policy \
  --bucket my-bucket \
  --policy '{
    "Version": "2008-10-17",
    "Statement": [{
      "Sid": "Allow CloudFront OAI",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1234567890ABC"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }]
  }'

Interview talking point: “The OAI plus a bucket policy is the classic pattern, but it is legacy now; the modern answer is an S3 Origin Access Control. Without the GetObject statement naming the OAI or OAC, CloudFront gets AccessDenied on every request even though the distribution is enabled.”

Q103: How do you create signed URL for CloudFront?

What it is: A CloudFront signed URL is an RSA-signed link carrying a policy that grants access to a path until an expiry timestamp.

Why it is used: To hand out expiring links to paid or protected content such as video or reports.

import boto3
import datetime

cloudfront = boto3.client('cloudfront')

# Create signed URL
url = cloudfront.generate_signed_url(
    url='https://d1234567890.cloudfront.net/private/content.mp4',
    policy='{"Statement":[{"Resource":"https://d1234567890.cloudfront.net/private/*","Condition":{"DateLessThan":{"AWS:EpochTime":' + str(int((datetime.datetime.now() + datetime.timedelta(hours=1)).timestamp())) + '}}}]}',
    key_pair_id='K1234567890ABC',
    private_key_file='private_key.pem'
)
print(url)

Interview talking point: “CloudFront signed URLs use your own key pair, unlike S3 presigned URLs which use IAM-signed SigV4. The policy embeds DateLessThan as an epoch plus a wildcard Resource, and signing failures are almost always an unuploaded key pair or a mismatched key_pair_id.”

Q104: How do you invalidate CloudFront cache?

What it is: An invalidation purges named paths from CloudFront edge caches before their TTL naturally expires.

Why it is used: To refresh a changed asset immediately after a deploy instead of waiting for cache expiry.

# Invalidate all files
aws cloudfront create-invalidation \
  --distribution-id E1234567890ABC \
  --paths "/*"

# Invalidate specific files
aws cloudfront create-invalidation \
  --distribution-id E1234567890ABC \
  --paths "/index.html" "/images/*.jpg"

Interview talking point: “create-invalidation takes —distribution-id and —paths, and a slash-star path flushes everything; the first free invalidation each month covers you, extra ones cost. So for deploys, version asset filenames and let the new URL be a cache miss instead.”

EFS and File Storage

Q105: How do you create EFS file system?

What it is: An EFS file system is a regional, automatically scaling NFS filesystem; a mount target is the per-subnet endpoint that makes it reachable.

Why it is used: For shared POSIX storage across many EC2 instances, unlike EBS which attaches to one at a time.

# Create EFS
aws efs create-file-system \
  --throughput-mode bursting \
  --encrypted \
  --performance-mode generalPurpose

# Create mount target
aws efs create-mount-target \
  --file-system-id fs-1234567890abcdef0 \
  --subnet-id subnet-12345 \
  --security-groups sg-12345

Interview talking point: “You need one mount target per AZ for the filesystem to be reachable there, which is what people miss. EFS also defaults to bursting throughput, so sustained heavy use wants provisioned mode instead.”

Q106: How do you mount EFS on EC2?

What it is: The amazon-efs-utils helper mounts EFS over NFS with TLS, resolving the regional endpoint and handling the encrypted handshake.

Why it is used: To attach the shared filesystem at a mount point so every instance sees the same files.

# Install EFS utils
sudo yum install -y amazon-efs-utils

# Mount EFS
sudo mount -t efs fs-1234567890abcdef0:/ /mnt/efs

# Mount with TLS
sudo mount -t efs -o tls fs-1234567890abcdef0:/ /mnt/efs

Interview talking point: “Mount with the efs filesystem helper and the -o tls option to encrypt traffic in transit. For containers that need different permissions, use EFS access points, which enforce per-directory POSIX identities.”

Q107: How do you create FSx file system?

What it is: FSx is a managed filesystem family: Windows File Server over SMB, Lustre for HPC, and OpenZFS, each with its own performance model.

Why it is used: For SMB shares Windows applications need, or Lustre parallel throughput, cases where EFS does not fit.

# Create FSx for Windows
aws fsx create-file-system \
  --file-system-type WINDOWS \
  --storage-capacity 300 \
  --subnet-ids subnet-12345 \
  --windows-configuration '{
    "ReplicationSpecification": {"SecondaryBackupRegion": "us-west-2"},
    "ThroughputCapacity": 8,
    "PreferredSubnetId": "subnet-12345"
  }'

Interview talking point: “Pick the engine with —file-system-type and pass engine-specific configuration. FSx for Windows is Multi-AZ and Active Directory integrated, which is why you choose it over EFS for a Windows fleet, while Lustre and OpenZFS are single-AZ.”

Database Deep Dive

Q108: How do you connect to RDS using SSL?

What it is: Connecting over SSL means trusting the RDS certificate authority bundle so the client verifies the server and encrypts the session.

Why it is used: To encrypt credentials and queries in transit to the database, which compliance regimes commonly require.

# Download SSL certificate
wget https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem

# Connect with SSL
mysql -h mydb.xxxx.rds.amazonaws.com \
  -u admin -p \
  --ssl-ca=rds-combined-ca-bundle.pem \
  --ssl-mode=REQUIRED

Interview talking point: “Download the RDS combined CA bundle and pass —ssl-ca with —ssl-mode. Use VERIFY-FULL so the hostname is checked too, since REQUIRED only encrypts; remember this protects only the client-to-RDS hop, separate from at-rest encryption.”

Q109: How do you change RDS instance class?

What it is: modify-db-instance —db-instance-class resizes the underlying instance, applied immediately or deferred to the maintenance window.

Why it is used: To scale the database vertically when load changes, without altering the engine or endpoint.

# Modify RDS instance
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --db-instance-class db.t3.medium \
  --apply-immediately

# Or for planned maintenance window
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --db-instance-class db.t3.medium \
  --apply-during-maintenance-window

Interview talking point: “—apply-immediately resizes at once, otherwise the change waits for the maintenance window. Downsizing can require a lower max_connections first, and storage size is adjusted as a separate operation, so plan both steps.”

Q110: How do you enable RDS performance insights?

What it is: Performance Insights is engine-level instrumentation showing wait events, top SQL and load over time, retained for up to seven years.

Why it is used: To pinpoint the actual bottleneck in a slow database instead of reading slow query logs by hand.

# Enable Performance Insights on the instance
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --enable-performance-insights \
  --performance-insights-kms-key-id key-id \
  --performance-insights-retention-period 731

# There is no `aws rds create-performance-insights-encryption-default` API.
# An attempt to run it fails with:
#   An error occurred (InvalidAction): Could not find operation
#   createPerformanceInsightsEncryptionDefault for version 2014-10-31

Interview talking point: “Enable it with modify-db-instance —enable-performance-insights, optionally with a KMS key for longer retention. The documented create-performance-insights-encryption-default call does not exist: it fails with InvalidAction, because the encryption default is a regional account setting, not a per-instance operation.”

Q111: How do you restore RDS from S3?

What it is: restore-db-instance-from-s3 builds a MySQL or Postgres instance from a dump file in S3 using an IAM role RDS assumes.

Why it is used: To migrate a self-managed database backup into RDS without going through native snapshots.

# Restore MySQL from S3
aws rds restore-db-instance-from-s3 \
  --db-instance-identifier mydb \
  --s3-bucket-name my-backup-bucket \
  --s3-prefix backups/ \
  --s3-ingestion-role-arn arn:aws:iam::123456789012:role/rds-s3-role \
  --engine mysql \
  --master-username admin \
  --master-user-password mypassword123 \
  --allocated-storage 100

Interview talking point: “The role in —s3-ingestion-role-arn is the trust boundary: its trust policy must name rds.amazonaws.com or the restore fails. The backup format is engine-specific, so a random S3 file will not restore.”

Q112: How do you configure RDS parameter group?

What it is: A DB parameter group is a named, reusable set of engine parameters that instances inherit instead of the defaults.

Why it is used: To tune settings like max connections or buffer sizes as a versioned, reviewable change.

# Create parameter group
aws rds create-db-parameter-group \
  --db-parameter-group-name my-param-group \
  --db-parameter-group-family mysql8.0 \
  --description "Custom parameter group"

# Modify parameter
aws rds modify-db-parameter-group \
  --db-parameter-group-name my-param-group \
  --parameters '[
    {"ParameterName":"max_connections","Value":"200","ApplyMethod":"immediate"}
  ]'

Interview talking point: “The —db-parameter-group-family must match the engine version exactly or the group will not attach. ApplyMethod immediate works for dynamic parameters, but static ones need pending-reboot, so budget a reboot into the change.”

Q113: How do you create DynamoDB table with TTL?

What it is: create-table with PAY_PER_REQUEST gives on-demand capacity, while a separate update-time-to-live call enables expiry on a numeric attribute.

Why it is used: For unpredictable or spiky traffic where per-request pricing beats tuning provisioned capacity.

aws dynamodb create-table \
  --table-name Orders \
  --attribute-definitions AttributeName=OrderID,AttributeType=S \
  --key-schema AttributeName=OrderID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

# Enable TTL
aws dynamodb update-time-to-live \
  --table-name Orders \
  --time-to-live-specification Enabled=true,AttributeName=TTL

Interview talking point: “On-demand mode means you never throttle, you just pay per request, and attribute-definitions only lists attributes used in the key schema. TTL needs an epoch-seconds number and deletes lazily, so expiry can lag up to about 48 hours.”

VPC and Networking Deep Dive

Q114: How do you create VPC endpoint for S3?

What it is: An S3 gateway endpoint is a route-table entry that keeps S3 traffic inside the AWS network.

Why it is used: To reach S3 from private subnets without paying NAT gateway charges or whitelisting IPs.

# Create endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-12345

# Use VPC endpoint in S3 access
# No additional config needed - private access to S3

Interview talking point: “create-vpc-endpoint with —route-table-ids creates a gateway endpoint: no ENIs, no security groups. Pair it with a bucket policy condition on aws:sourceVpce, which gives a stronger restriction than IP allowlisting.”

Q115: How do you create VPC endpoint for DynamoDB?

What it is: A DynamoDB endpoint is an interface endpoint that places ENIs in your subnets with a private DNS name for DynamoDB.

Why it is used: For private-subnet DynamoDB access, or to lock the table down to traffic from your VPC.

# Create endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.dynamodb \
  --route-table-ids rtb-12345

Interview talking point: “DynamoDB has no gateway endpoint type, so this one needs —vpc-endpoint-type Interface with subnets. Attach an endpoint policy on it, which closes the reachability path that IAM permissions alone cannot.”

Q116: How do you set up PrivateLink (interface endpoint)?

What it is: An interface endpoint or PrivateLink creates ENIs in your subnets that terminate service traffic privately, and can expose your own service.

Why it is used: To reach AWS services or your own service privately across VPCs without public IPs.

# Create interface endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.ec2 \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-12345 subnet-67890

Interview talking point: “Interface endpoints cost hourly plus per-GB, unlike the free gateway type, and need one ENI per AZ subnet. For a custom service, PrivateLink is how you share a resource across accounts privately.”

Q117: How do you configure VPC DNS options?

What it is: VPC DNS attributes decide whether instances get public DNS hostnames and whether the Amazon-provided resolver answers at all.

Why it is used: Required wherever internal DNS matters: service discovery, private zones, and load balancer or RDS endpoint names.

# Enable DNS hostname
aws ec2 modify-vpc-attribute \
  --vpc-id vpc-1234567890abcdef0 \
  --enable-dns-hostnames "{\"Value\":true}"

# Enable DNS support
aws ec2 modify-vpc-attribute \
  --vpc-id vpc-1234567890abcdef0 \
  --enable-dns-support "{\"Value\":true}"

Interview talking point: “Both enable-dns-hostnames and enable-dns-support must be on, or instances get no hostname and cannot resolve Amazon-provided names. This is the usual answer to why a Lambda in a VPC cannot resolve an RDS endpoint.”

Q118: How do you create custom VPC with public and private subnets?

What it is: A custom VPC is built in order: VPC, subnets per AZ, internet gateway, route tables, then route associations.

Why it is used: To lay out a production network that separates internet-facing tiers from backend tiers.

# Create VPC
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query 'Vpc.VpcId' --output text)

# Create public subnet
PUBLIC_SUBNET=$(aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.1.0/24 --availability-zone us-east-1a --query 'Subnet.SubnetId' --output text)

# Create private subnet
PRIVATE_SUBNET=$(aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.2.0/24 --availability-zone us-east-1a --query 'Subnet.SubnetId' --output text)

# Create and attach IGW
IGW_ID=$(aws ec2 create-internet-gateway --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID

# Create public route table
ROUTE_TABLE=$(aws ec2 create-route-table --vpc-id $VPC_ID --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $ROUTE_TABLE --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID
aws ec2 associate-route-table --route-table-id $ROUTE_TABLE --subnet-id $PUBLIC_SUBNET

Interview talking point: “A public subnet route table sends 0.0.0.0/0 to the internet gateway, a private one has no such route or points at NAT. Public subnets also need map-public-ip-on-launch, or instances still have no address to reach out from.”

Lambda Advanced

Q119: How do you set up Lambda destination?

What it is: An event invoke config routes a function’s own asynchronous results, OnSuccess or OnFailure, to another AWS service.

Why it is used: To send results downstream for further processing without the function publishing them itself.

# Configure destination for success
aws lambda put-function-event-invoke-config \
  --function-name my-function \
  --destination-config '{
    "OnSuccess": {"Destination": "arn:aws:sqs:us-east-1:123456789012:success-queue"},
    "OnFailure": {"Destination": "arn:aws:sqs:us-east-1:123456789012:failed-queue"}
  }'

Interview talking point: “put-function-event-invoke-config takes a destination-config pointing at SQS, SNS, Lambda or EventBridge, and the destination needs its own resource policy allowing Lambda to write. The distinction matters: a dead-letter queue holds the triggering event, destinations carry the function’s return value or error.”

Q120: How do you use Lambda SnapStart?

What it is: SnapStart snapshots an initialised Java execution environment and restores it for later invocations instead of cold starting.

Why it is used: To cut JVM cold-start latency where class loading and JIT warmup dominate initialisation.

# Enable SnapStart for Java functions
aws lambda update-function-configuration \
  --function-name my-java-function \
  --snap-start '{"ApplyOn":"PublishedVersions"}'

# Publish version
aws lambda publish-version --function-name my-java-function

Interview talking point: “ApplyOn PublishedVersions means it only works on published versions, never $LATEST, and only for Java 11 or later. You pay some memory overhead, but subsequent cold starts become millisecond restores.”

Q121: How do you configure reserved concurrency?

What it is: Reserved concurrency is a hard cap on simultaneous executions for one function or for the whole account.

Why it is used: To protect downstream resources from bursts and to guarantee capacity for critical functions.

# Set reserved concurrency
aws lambda put-function-concurrency \
  --function-name my-function \
  --reserved-concurrent-executions 10

# Remove reserved concurrency
aws lambda delete-function-concurrency --function-name my-function

Interview talking point: “Exceeding the cap is throttled with an error rather than queued, and a value of zero disables the function entirely. Never set account-level reserved concurrency to zero by accident; it blocks every function in the account.”

Q122: How do you set up provisioned concurrency?

What it is: Provisioned concurrency keeps a fixed number of execution environments pre-initialised so invocations skip the init phase entirely.

Why it is used: For latency-sensitive APIs where cold starts are unacceptable, trading ongoing cost for predictable latency.

# Configure provisioned concurrency
aws lambda put-provisioned-concurrency-config \
  --function-name my-function \
  --qualifier 5 \
  --provisioned-concurrent-executions 5

Interview talking point: “put-provisioned-concurrency-config requires a qualifier, so you provision against a version or alias, never $LATEST, and you are billed for idle warm environments. Scaling up is asynchronous and will not absorb an instant spike: reserved is the ceiling, provisioned the warm floor.”

Q123: How do you use Lambda layers?

What it is: A layer is a versioned zip of shared dependencies attached to functions by ARN instead of being bundled into each.

Why it is used: To share a library across functions and update it without redeploying every function’s code.

# Create layer
aws lambda publish-layer-version \
  --layer-name my-layer \
  --description "Pandas for data processing" \
  --zip-file fileb://layer.zip \
  --compatible-runtimes python3.9

# Add to function
aws lambda update-function-configuration \
  --function-name my-function \
  --layers arn:aws:lambda:us-east-1:123456789012:layer:my-layer:1

Interview talking point: “publish-layer-version creates an immutable numbered version and you pass its versioned ARN to the function. Layers mount under /opt so they can shadow your own code, and every change is a new ARN that functions must be repointed to.”

API Gateway Advanced

Q124: How do you create API Gateway REST API?

What it is: A REST API is a tree of resources, where each resource is one path segment and methods hang off it.

Why it is used: To define an HTTP surface before wiring methods and integrations to backends.

# Create API
API_ID=$(aws apigateway create-rest-api \
  --name my-api \
  --query 'id' \
  --output text)

# Get root resource
ROOT_ID=$(aws apigateway get-resources \
  --rest-api-id $API_ID \
  --query 'items[0].id' \
  --output text)

# Create resource
RESOURCE_ID=$(aws apigateway create-resource \
  --rest-api-id $API_ID \
  --parent-id $ROOT_ID \
  --path-part users \
  --query 'id' \
  --output text)

Interview talking point: “create-rest-api, then get-resources to read the root id from items[0], then create-resource under a parent. Because path-part is a single segment, nested paths mean chained calls, which is why people generate REST APIs with SAM or CDK and prefer HTTP APIs.”

Q125: How do to create API Gateway method?

What it is: A method is an HTTP verb on a resource, and an integration points it at a backend URI.

Why it is used: To route an HTTP call to Lambda or another AWS service and map the response back.

# Create GET method
aws apigateway put-method \
  --rest-api-id $API_ID \
  --resource-id $RESOURCE_ID \
  --http-method GET \
  --authorization-type NONE

# Create POST method with Lambda integration
aws apigateway put-integration \
  --rest-api-id $API_ID \
  --resource-id $RESOURCE_ID \
  --http-method POST \
  --type AWS \
  --integration-http-method POST \
  --uri arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:my-function/invocations

Interview talking point: “put-method then put-integration with type AWS and the lambda:path/2015-03-31/functions/…/invocations URI, whose format is finicky, plus a resource policy on the function allowing apigateway.amazonaws.com. For new work, an HTTP API with AWS_PROXY is one step instead of five.”

Q126: How do you set up API Gateway usage plan?

What it is: A usage plan applies a rate-and-burst throttle and a periodic quota to an API stage.

Why it is used: To meter and throttle third-party consumers so one client cannot exhaust the backend.

# Create usage plan
aws apigateway create-usage-plan \
  --name my-usage-plan \
  --api-stages apiId=abc123,stage=prod \
  --quota '{"Limit":10000,"Period":"MONTH"}' \
  --throttle '{"BurstLimit":100,"RateLimit":50}'

Interview talking point: “create-usage-plan does nothing until a key is attached with create-usage-plan-key. Throttle and quota are different levers: throttle smooths instantaneous bursts, quota caps the cumulative total per period for billing.”

Q127: How do you create API key?

What it is: An API key identifies a client so usage can be attributed, and joining a usage plan applies that plan’s limits.

Why it is used: For per-client metering that links API usage to a contract or billing.

# Create API key
aws apigateway create-api-key \
  --name my-api-key \
  --enabled

# Add to usage plan
aws apigateway create-usage-plan-key \
  --usage-plan-id abc123 \
  --key-id xyz789 \
  --key-type API_KEY

Interview talking point: “create-api-key then create-usage-plan-key with key-type API_KEY. The gotcha worth naming: API keys are identifiers for metering, not authentication, so real access control still needs a Cognito or Lambda authorizer.”

Q128: How do you configure API Gateway caching?

What it is: Stage caching stores integration responses and replays them for identical requests until the TTL expires.

Why it is used: To cut Lambda invocations and latency for repeated identical requests.

# Enable caching on stage
aws apigateway update-stage \
  --rest-api-id $API_ID \
  --stage-name prod \
  --patch-operations '[{"op":"replace","path":"/*/settings/cacheEnabled","value":"true"}]'

# Set cache ttl
aws apigateway update-stage \
  --rest-api-id $API_ID \
  --stage-name prod \
  --patch-operations '[{"op":"replace","path":"/*/settings/cacheTtlInSeconds","value":"300"}]'

Interview talking point: “update-stage patch operations set cacheEnabled and cacheTtlInSeconds, but caching must also be enabled per method, or a method with cachingEnabled false bypasses the cache entirely. The default 500MB cache is billed whether it is used or not.”

CloudWatch Advanced

Q129: How do you create custom CloudWatch metric?

What it is: put_metric_data publishes your own datapoints into CloudWatch under a namespace and dimension set that you define.

Why it is used: To put application metrics and business KPIs alongside AWS metrics so the same alarms and dashboards use them.

import boto3

cloudwatch = boto3.client('cloudwatch')

# Put metric data
cloudwatch.put_metric_data(
    Namespace='MyApplication',
    MetricData=[
        {
            'MetricName': 'RequestCount',
            'Value': 1,
            'Unit': 'Count',
            'Dimensions': [
                {'Name': 'ServiceName', 'Value': 'MyService'},
                {'Name': 'Environment', 'Value': 'Production'}
            ]
        }
    ]
)

Interview talking point: “A metric is uniquely namespace plus name plus the full dimension set, so an extra dimension creates a different metric, and there is a 30-dimension cap. Batch up to 1000 datapoints per call or you will hit API limits.”

Q130: How do you create CloudWatch alarm with SNS?

What it is: An alarm that breaches its threshold publishes to an SNS topic, whose subscribers receive the notification.

Why it is used: To turn a metric breach into an email, Slack message or page with no glue code.

# Create topic
TOPIC_ARN=$(aws sns create-topic --name cpu-alarm --query 'TopicArn' --output text)

# Subscribe email
aws sns subscribe \
  --topic-arn $TOPIC_ARN \
  --protocol email \
  --notification-endpoint admin@example.com

# Create alarm
aws cloudwatch put-metric-alarm \
  --alarm-name cpu-alarm \
  --alarm-description "CPU usage above 80%" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --statistic Average \
  --period 300 \
  --threshold 80 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --alarm-actions $TOPIC_ARN

Interview talking point: “Create the topic, subscribe endpoints (email needs confirmation), then put-metric-alarm with the topic ARN as alarm-actions. The subscriber list lives on the topic, so repointing an alarm to another topic changes who gets paged without touching the alarm itself.”

Q131: How do you create CloudWatch composite alarm?

What it is: A composite alarm evaluates an AND, OR, NOT expression over the states of other alarms rather than a metric.

Why it is used: To page only on compound conditions instead of every individual metric, which is what causes alert fatigue.

aws cloudwatch put-composite-alarm \
  --alarm-name composite-alarm \
  --alarm-rule "(ALARM cpu-alarm OR ALARM memory-alarm) AND (ALARM disk-alarm)" \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:my-topic

Interview talking point: “put-composite-alarm takes an —alarm-rule referencing child alarms by name, and there is no metric involved at all. Components must be in the same region, so wire the composite to SNS as the thing that pages.”

CloudFormation Advanced

Q132: How do you use CloudFormation Condition functions?

What it is: Conditions are named boolean expressions over parameters that resources reference through !If to pick a value.

Why it is used: So one template can behave differently per environment or region without maintaining separate copies.

AWSTemplateFormatVersion: '2010-09-09'
Description: Conditions Example

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - prod

Conditions:
  IsProduction: !Equals [!Ref Environment, prod]
  UseEncryptedStorage: !Equals [!Ref Environment, prod]

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !If [IsProduction, t3.large, t3.micro]
      Encrypted: !Ref UseEncryptedStorage

Interview talking point: “Both !If branches must be valid values for that property, because a condition only selects one, it does not skip type validation. A condition referencing a parameter also needs that parameter passed in, or it is a template-time error.”

Q133: How do you use CloudFormation DependsOn?

What it is: DependsOn forces CloudFormation to finish creating one resource before it creates the dependent resource.

Why it is used: For ordering that cannot be expressed as a value reference through !Ref or !GetAtt.

Resources:
  DbSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupName: my-subnet-group
      DBSubnetDescriptions:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2

  MyDatabase:
    Type: AWS::RDS::DBInstance
    DependsOn: DbSubnetGroup
    Properties:
      DBInstanceClass: db.t3.micro
      Engine: mysql

Interview talking point: “Prefer a real !Ref or !GetAtt where you can, because DependsOn serialises and slows the stack. It is for side-effect ordering, such as a security group being attached before a database launches, which otherwise fails intermittently.”

Q134: How do you use CloudFormation DeletionPolicy?

What it is: DeletionPolicy decides what survives stack deletion: Snapshot, Retain, or the default behaviour of destroying the resource.

Why it is used: To avoid losing data when a stack is torn down, especially for stateful resources.

Resources:
  MyVolume:
    Type: AWS::EC2::Volume
    DeletionPolicy: Snapshot
    Properties:
      Size: 100
      AvailabilityZone: us-east-1a

  MyDatabase:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    Properties:
      DBInstanceClass: db.t3.micro

Interview talking point: “Snapshot on a volume or RDS instance leaves a snapshot behind, Retain leaves the resource itself. The gotcha: it applies on stack delete, not to resources removed by a change, and nested stacks ignore it unless the parent repeats it.”

Q135: How do you use CloudFormation WaitCondition?

What it is: A WaitCondition pauses stack creation until an external callback signals a WaitConditionHandle URL with a matching unique token.

Why it is used: When CloudFormation cannot infer the dependency and must wait on an outside system to finish.

Resources:
  WaitHandle:
    Type: AWS::CloudFormation::WaitConditionHandle
    Properties:
      Timeout: PT15M

  WaitCondition:
    Type: AWS::CloudFormation::WaitCondition
    DependsOn: MyInstance
    Properties:
      Handle: !Ref WaitHandle
      Timeout: PT15M
      Count: 1

Interview talking point: “Timeout belongs on the WaitCondition, not the handle, and omitting it can hang a stack for days. The Lambda must put to the handle URL with UniqueId and Status SUCCESS, and the condition needs DependsOn on what must finish first.”

Q136: How do you use CloudFormation Custom Resource?

What it is: A custom resource delegates create, update and delete to a Lambda referenced by a ServiceToken in the template.

Why it is used: To run provisioning logic CloudFormation has no native resource type for, like third-party API calls.

Resources:
  CustomResource:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt MyFunction.Arn
      Key: Value

  MyFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.9
      Handler: index.handler
      Code:
        ZipFile: |
          import boto3
          import json
          def handler(event, context):
              return {'Status': 'SUCCESS'}

Interview talking point: “The Lambda receives RequestType and PhysicalResourceId, and it must PUT a response to the ResponseURL with Status SUCCESS or the stack hangs until timeout. Miss that response on Delete and the resource leaks.”

ECS Advanced

Q137: How do you update ECS service?

What it is: update-service changes the task definition, desired count or deployment configuration, and force-new-deployment restarts tasks regardless.

Why it is used: To roll out a new revision, scale, or pick up changes made outside the task definition.

# Update service
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --task-definition my-app:2 \
  --desired-count 5 \
  --deployment-configuration minimumHealthyPercent=50,maximumPercent=200

# Force new deployment
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --force-new-deployment

Interview talking point: “force-new-deployment is the escape hatch for a console env var change or a mutable latest tag. minimumHealthyPercent and maximumPercent set blast radius, 100/200 being the safer rolling choice, and watch the deployment rolloutState rather than assuming success.”

Q138: How do you create ECS task placement strategy?

What it is: A placement strategy tells ECS whether to spread tasks across attributes or binpack them onto the fullest instance.

Why it is used: To control distribution deliberately, for AZ resilience or for tighter packing and lower instance count.

{
  "cluster": "my-cluster",
  "service": "my-service",
  "taskDefinition": "my-app:1",
  "launchType": "FARGATE",
  "platformVersion": "LATEST",
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "subnets": ["subnet-12345"],
      "securityGroups": ["sg-12345"]
    }
  },
  "placementStrategy": [
    {
      "type": "spread",
      "field": "attribute:ecs.availability-zone"
    },
    {
      "type": "binpack",
      "field": "cpu"
    }
  ]
}

Interview talking point: “Spread on availability-zone is the resilience setting; binpack on cpu packs tightly but concentrates risk. On Fargate spread still works but binpack does not, since there is no instance to pack onto, and supplying your own strategy replaces the service default.”

Q139: How do you set up ECS service discovery?

What it is: Cloud Map registers ECS tasks as DNS A records in a private namespace, giving each a stable name.

Why it is used: So services find each other by name inside a VPC without hard-coded IPs.

# Create namespace
aws servicediscovery create-private-dns-namespace \
  --name local \
  --vpc vpc-1234567890abcdef0

# Create service with discovery
aws servicediscovery create-service \
  --name my-service \
  --namespace-id ns-12345 \
  --dns-config '{
    "NamespaceId": "ns-12345",
    "DnsRecords": [{"Type": "A", "TTL": 60}]
  }' \
  --health-check-config '{"Type": "HTTP", "ResourcePath": "/health"}'

Interview talking point: “create-private-dns-namespace then create-service with a dns-config A record, and set the health check config, because Cloud Map only keeps healthy tasks registered. A failing check removes the name from DNS, which is the mechanism rather than a bug.”

What it is: An SNS FIFO topic adds ordering and message deduplication so subscribers receive messages in publish order.

Why it is used: When subscribers must process messages sequentially and cannot tolerate reordering.

# Create FIFO topic
aws sns create-topic \
  --name my-fifo-topic.fifo \
  --attributes '{
    "FifoTopic": "true",
    "ContentBasedDeduplication": "true"
  }'

# Subscribe SQS to SNS
aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:my-fifo-topic.fifo \
  --protocol sqs \
  --notification-endpoint arn:aws:sqs:us-east-1:123456789012:my-queue.fifo

Interview talking point: “The topic name must end in .fifo or create-topic fails with InvalidParameter, and every subscriber must be FIFO too, so a FIFO SQS queue. Ordering holds per message group, so parallelism across groups is still possible.”

Q141: How do you configure SQS dead letter queue?

What it is: A dead letter queue captures messages that exceeded maxReceiveCount without being deleted, isolating poison messages from the main queue.

Why it is used: So one repeatedly failing message stops consuming a consumer’s entire throughput budget.

# Create DLQ
aws sqs create-queue \
  --queue-name my-dlq.fifo \
  --attributes '{"FifoQueue":"true","ContentBasedDeduplication":"true"}'

# Create main queue with DLQ
aws sqs create-queue \
  --queue-name my-queue.fifo \
  --attributes '{
    "FifoQueue": "true",
    "ContentBasedDeduplication": "true",
    "RedrivePolicy": "{\"deadLetterTargetArn\":\"arn:aws:sqs:us-east-1:123456789012:my-dlq.fifo\",\"maxReceiveCount\":5}"
  }'

Interview talking point: “Set RedrivePolicy with deadLetterTargetArn and maxReceiveCount when you create the queue, since it cannot be added later through create-queue. The DLQ must be the same type, FIFO to FIFO, and maxReceiveCount trades retries against how fast failures surface.”

Q142: How do you set up SQS message attributes?

What it is: Message attributes are typed key-value metadata sent alongside the body, readable without parsing the body itself.

Why it is used: To carry routing or filtering fields like priority or a trace id separately from the payload.

# Send message with attributes
aws sqs send-message \
  --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue \
  --message-body '{"orderId": "123"}' \
  --message-attributes '{
    "CustomerId": {"DataType": "String", "StringValue": "C123"},
    "OrderValue": {"DataType": Number, "StringValue": "99.99"}
  }'

Interview talking point: “Each attribute needs a DataType and StringValue, up to ten attributes and 256KB per message. Their real value is letting consumers route by priority or send failures to a different DLQ without re-serialising the body.”

Kinesis

Q143: How do you create Kinesis stream?

What it is: A Kinesis stream is an ordered log split into shards, each an independent partition with its own throughput ceiling.

Why it is used: For high-throughput real-time ingestion of logs, clickstream or telemetry that consumers read at their own pace.

# Create stream
aws kinesis create-stream \
  --stream-name my-stream \
  --shard-count 2

# Describe stream
aws kinesis describe-stream-summary \
  --stream-name my-stream

# List streams
aws kinesis list-streams

Interview talking point: “create-stream sets shard count, and shards are the unit of both capacity and billing, charged continuously whether read or not. Resharding by split or merge is manual, so over-provision initially to avoid it during a traffic spike.”

Q144: How do you put record in Kinesis?

What it is: put-record appends a single record and put-records batches them, with a partition key choosing the destination shard.

Why it is used: To stream events into the pipeline for downstream real-time processing.

# Put record
aws kinesis put-record \
  --stream-name my-stream \
  --partition-key user123 \
  --data $(echo '{"event": "click", "page": "home"}' | base64)

# Put records (batch)
aws kinesis put-records \
  --stream-name my-stream \
  --records '[{"PartitionKey":"user1","Data":"ZWNobyB0ZXN0"},{"PartitionKey":"user2","Data":"ZWNobyB0ZXN0Mg=="}]'

Interview talking point: “The —data value must be base64 encoded, which is why examples pipe through base64. Records sharing a partition key land on one shard and stay ordered relative to each other, so key by what must be ordered, and put-records returns per-record failures to retry.”

Q145: How do you read from Kinesis?

What it is: Reading takes a shard iterator from a chosen starting position, then get-records calls advance through that shard.

Why it is used: To consume records in real time, each read returning the iterator for your new position.

# Get iterator
SHARD_ITERATOR=$(aws kinesis get-shard-iterator \
  --stream-name my-stream \
  --shard-id shardId-000000000000 \
  --shard-iterator-type LATEST \
  --query 'ShardIterator' \
  --output text)

# Get records
aws kinesis get-records \
  --shard-iterator $SHARD_ITERATOR

Interview talking point: “Iterator types are TRIM_HORIZON, LATEST, AT_SEQUENCE_NUMBER and AFTER_SEQUENCE_NUMBER, and LATEST skips anything produced before you started. Every shard must be read separately with its own iterator, and shards closed by a reshard need a fresh one.”

Systems Manager

Q146: How do you run command on EC2 using SSM?

What it is: send-command runs an SSM document such as AWS-RunShellScript on managed instances targeted by ID or tag.

Why it is used: For fleet-wide patching and config changes with no SSH, bastion or inbound port involved.

# Send command
aws ssm send-command \
  --document-name AWS-RunShellScript \
  --targets '[{"Key":"InstanceIds","Values":["i-1234567890abcdef0"]}]' \
  --parameters '{
    "commands":["#!/bin/bash","yum update -y","yum install -y httpd"],
    "executionTimeout":["3600"]
  }'

# Check command status
aws ssm list-command-invocations \
  --command-id command-id

Interview talking point: “Targets accept InstanceIds or key-value tag filters, which is what makes it a fleet tool, and it runs as root, so re-running a non-idempotent script is a real risk. Verify with list-command-invocations instead of assuming success, and both the agent and instance profile must be present.”

Q147: How do you create SSM parameter?

What it is: Parameter Store holds hierarchical key-value configuration, with SecureString values encrypted by KMS and decrypted only on request.

Why it is used: For application config, and for credentials too small to justify Secrets Manager’s rotation features.

# Create parameter
aws ssm put-parameter \
  --name /myapp/database/host \
  --value mydb.xxx.rds.amazonaws.com \
  --type String

# Create secure string
aws ssm put-parameter \
  --name /myapp/database/password \
  --value mypassword123 \
  --type SecureString

# Get parameter
aws ssm get-parameter --name /myapp/database/host

# Get with decryption
aws ssm get-parameter --name /myapp/database/password --with-decryption

Interview talking point: “get-parameter needs —with-decryption for SecureString, and that access is itself CloudTrail logged, which is the point. Parameters are versioned so get-parameter-history is an audit trail, but there is no built-in rotation, so you add a Lambda for that.”

Q148: How do you use SSM Session Manager?

What it is: Session Manager opens a shell or port-forward session to an instance through the SSM agent over the AWS API.

Why it is used: For accessing private instances with no inbound port, with every session auditable in CloudTrail.

# Start session
aws ssm start-session --target i-1234567890abcdef0

# Terminate session
aws ssm terminate-session --session-id session-id

Interview talking point: “start-session needs no inbound security group rule because the agent makes an outbound connection, and AWS-StartPortForwardingSession replaces SSH tunnels. Sessions appear in CloudTrail as StartSession events, which is why this passes security review where bastion SSH often does not.”

AWS CLI Tips

Q149: How do you use JMESPath with AWS CLI?

What it is: JMESPath is the query language behind the CLI’s —query, evaluated against the JSON response before output formatting.

Why it is used: To trim a verbose API response to just the fields needed, without piping through jq.

# Query instance IDs
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].InstanceId'

# Query with filter
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Instances[*].{ID:InstanceId,Type:InstanceType,Name:Tags[?Key==`Name`].Value|[0]}'

# Query with table output
aws ec2 describe-instances \
  --query 'sort_by(Instances,&InstanceType)[*].{ID:InstanceId,Type:InstanceType,AZ:Placement.AvailabilityZone}'

Interview talking point: “Use [*] for lists, {Key:Expr} for projections and the pipe character to chain; filters compare literals in backticks like [?Key==Name], and sort_by takes an & reference. JMESPath cannot do arithmetic or regex functions, so hand those to jq.”

Q150: How do you use AWS CLI with JSON input?

What it is: —cli-input-json supplies the entire request body from a JSON file instead of individual flags.

Why it is used: For deeply nested requests like policies or tag specs that would be unreadable as flags.

# From file
aws ec2 run-instances --cli-input-json file://instance.json

# instance.json
{
  "ImageId": "ami-0c55b159cbfafe1f0",
  "InstanceType": "t2.micro",
  "KeyName": "my-key",
  "SecurityGroupIds": ["sg-12345"],
  "SubnetId": "subnet-12345"
}

Interview talking point: “The file must match the API request shape exactly, because input is still validated and an invalid field fails just like a bad flag. —generate-cli-skeleton emits that correct shape with placeholders, which is how you start.”

AWS SDK Examples

Q151: How do you use boto3 to create EC2?

What it is: boto3’s resource interface gives an object-oriented view of EC2, returning Instance objects with attributes and waiter methods.

Why it is used: To write Python that talks to AWS with less plumbing than raw client calls.

import boto3

ec2 = boto3.resource('ec2')

# Create instance
instance = ec2.create_instances(
    ImageId='ami-0c55b159cbfafe1f0',
    InstanceType='t2.micro',
    KeyName='my-key',
    SecurityGroupIds=['sg-12345'],
    SubnetId='subnet-12345',
    MaxCount=1,
    MinCount=1,
    TagSpecifications=[{
        'ResourceType': 'instance',
        'Tags': [{'Key': 'Name', 'Value': 'MyInstance'}]
    }]
)[0]

print(f"Instance ID: {instance.id}")
instance.wait_until_running()
print("Instance is running")

Interview talking point: “Resource versus client: boto3.resource adds waiters and attributes while boto3.client returns plain JSON. MaxCount and MinCount are required, and resource-style models are deprecated in favour of the v2 client model, so client-style calls are the safer choice for new code.”

Q152: How do you use boto3 with S3?

What it is: The S3 client handles upload, download, listing and presigned URL generation, with upload and download helpers doing multipart and retries.

Why it is used: For programmatic file transfer from application code instead of shelling out to the CLI.

import boto3

s3 = boto3.client('s3')

# Upload file
s3.upload_file('local.txt', 'my-bucket', 'remote.txt')

# Download file
s3.download_file('my-bucket', 'remote.txt', 'local.txt')

# List buckets
response = s3.list_buckets()
for bucket in response['Buckets']:
    print(bucket['Name'])

# Generate presigned URL
url = s3.generate_presigned_url(
    'get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'file.txt'},
    ExpiresIn=3600
)

Interview talking point: “upload_file handles multipart and retries where raw put_object does not. Presigned URLs embed the caller’s credentials, so the link dies when those credentials rotate. Also pass explicit server-side encryption arguments if the bucket policy is not enforcing it.”

Q153: How do you use boto3 with DynamoDB?

What it is: The DynamoDB resource exposes a Table object with Pythonic methods, and condition objects build key and filter expressions.

Why it is used: To read and write items without hand-writing the expression attribute JSON the client layer needs.

import boto3
from boto3.dynamodb.conditions import Key, Attr

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('Users')

# Put item
table.put_item(Item={'UserID': '1', 'Name': 'John', 'Age': 30})

# Get item
response = table.get_item(Key={'UserID': '1'})
item = response.get('Item')

# Query
response = table.query(
    KeyConditionExpression=Key('UserID').eq('1')
)

# Scan with filter
response = table.scan(
    FilterExpression=Attr('Age').gt(25)
)

Interview talking point: “Use query with a key condition expression for known key access and scan with a filter expression otherwise. A filter still reads every item and discards afterwards, so it costs the same as a full scan; the resource layer also handles type marshalling for you.”

Q154: How do you use boto3 with Lambda?

What it is: invoke calls a function synchronously and returns its result in the payload, or asynchronously and returns just a status code.

Why it is used: To call a Lambda from application code, either reading its result or firing and forgetting.

import boto3
import json

lambda_client = boto3.client('lambda')

# Invoke function
response = lambda_client.invoke(
    FunctionName='my-function',
    InvocationType='RequestResponse',
    Payload=json.dumps({'key': 'value'})
)

result = json.loads(response['Payload'].read())
print(result)

Interview talking point: “The payload must be a JSON-serialised string or bytes, not a dict, or the CLI raises ParamValidationError. Results come back as a byte stream you parse, and a synchronous invoke is billed at the function’s full timeout, so tight loops overspend fast.”

Troubleshooting

Q155: How do you troubleshoot EC2 connection issues?

What it is: Diagnosing SSH failures means working down the network path: status checks, public IP, security group, route table, gateway, then NACLs.

Why it is used: As a repeatable checklist, since unreachable instances are almost always one of a few misconfigurations.

Check security group allows SSH (port 22)
Check route table has route to internet gateway
Check internet gateway is attached
Check instance has public IP
Check NACL allows outbound traffic
Verify key permissions: chmod 400 key.pem
Check instance status checks

# Check instance status
aws ec2 describe-instance-status --instance-id i-12345

# Check security groups
aws ec2 describe-security-groups --group-ids sg-12345

# Check route table
aws ec2 describe-route-tables --route-table-id rtb-12345

Interview talking point: “The fast discriminator is the error: a timeout means a network path problem in the security group, NACL, route or gateway, while an immediate connection refused means nothing is listening. Also check key file permissions, and if you are in a private subnet use SSM Session Manager instead.”

Q156: How do you troubleshoot RDS connection?

What it is: RDS connection failures usually come down to network placement, meaning subnet group and security group, rather than credentials.

Why it is used: When an app that worked stops connecting, or a new instance cannot reach the database at all.

Check security group allows database port (3306, 5432, etc.)
Check subnet group has correct subnets
Verify credentials
Check if public access is enabled (if needed)
Check VPC has correct route

# Get endpoint
aws rds describe-db-instances \
  --db-instance-identifier mydb \
  --query 'DBInstances[0].Endpoint'

# Check security group
aws rds describe-db-instances --db-instance-identifier mydb \
  --query 'DBInstances[0].VpcSecurityGroups'

Interview talking point: “Check VpcSecurityGroups and DBSubnetGroup: a subnet group spanning a different VPC from your compute is the classic mistake, and RDS needs at least two AZs. Timeout means network path, Access denied means credentials or auth plugin mismatch.”

Q157: How do you troubleshoot Lambda?

What it is: Lambda troubleshooting means reading the function’s own logs first, then checking configuration and permissions, since the service offers little else.

Why it is used: When a function fails, times out, or silently does nothing.

Check CloudWatch Logs
Check function configuration (timeout, memory, VPC)
Check IAM role permissions
Check VPC configuration (if configured)
Check for cold start issues

# Get logs
aws logs filter-log-events \
  --log-group-name /aws/lambda/my-function \
  --filter-pattern "ERROR"

# Check function config
aws lambda get-function-configuration --function-name my-function

Interview talking point: “Filter the function’s log group for errors first, then read timeout, memory and VPC settings. No logs at all means it never fired or died before writing, so bumping the timeout is a diagnostic, not a fix. A VPC function with no NAT route is the other classic.”

Q158: How do you troubleshoot S3 access denied?

What it is: S3 AccessDenied comes from the intersection of the caller’s identity policy, the bucket resource policy, ACLs and Block Public Access.

Why it is used: When access works for one principal or path but not another, which is usually a policy intersection problem.

Check bucket policy
Check IAM policy on principal
Check ACL on bucket/object
Check VPC endpoint policy
Check public access settings

# Get bucket policy
aws s3api get-bucket-policy --bucket my-bucket

# Check public access
aws s3api get-public-access-block --bucket my-bucket

Interview talking point: “An explicit Deny in either policy wins, and Block Public Access overrides an Allow from an ACL. Also check the VPC endpoint policy, which can deny a correctly permissioned principal, and check the key name, since a grant on bucket objects never matches the bucket ARN itself.”

Q159: How do you troubleshoot API Gateway 5xx errors?

What it is: API Gateway 5xx errors come from the integration failing: the Lambda erroring, hitting the 29-second timeout, or returning the wrong shape.

Why it is used: To separate an API Gateway problem from a backend problem, which is the first split in diagnosis.

Check CloudWatch logs for API Gateway
Check Lambda logs for errors
Verify integration timeout
Check Lambda returns correct format
Verify CORS settings

# Get execution logs
aws logs filter-log-events \
  --log-group-name /aws/apigateway/my-api \
  --filter-pattern "5xx"

Interview talking point: “Enable execution logging to see integration latency and status, then read the Lambda’s own logs. A Lambda error surfaces as 502 and a malformed response as 500; the classic cause is a handler exceeding API Gateway’s hard 29-second integration timeout.”

Q160: How do you troubleshoot CloudFront?

What it is: CloudFront problems are traced by separating the request path: DNS, edge, cache behaviour, then origin.

Why it is used: When a distribution errors or serves stale content, so you can find which hop is at fault.

Check origin is accessible
Verify cache behavior settings
Check SSL certificate
Check route 53 DNS
Check error responses

# Get distribution config
aws cloudfront get-distribution-config --id distribution-id

# Check field-level encryption
aws cloudfront list-field-level-encryption-profiles

Interview talking point: “Check the x-cache header: a MISS with an error means the origin is the problem, a HIT with stale content means you need an invalidation. Other culprits are an origin that is not publicly readable because OAC is missing, a certificate mismatch, or a distribution still deploying.”

Cost Optimization

Q161: How do you find unused EBS volumes?

What it is: Unused EBS volumes are those in the available state, attached to nothing yet still billed in full.

Why it is used: A high-yield, low-risk cost win, since orphaned volumes from terminated instances cost money indefinitely.

# Find unattached volumes
aws ec2 describe-volumes \
  --filters "Name=status,Values=available" \
  --query 'Volumes[*].{ID:VolumeId,Size:Size,Type:VolumeType}'

Interview talking point: “Filter on status available to list the orphans, then cross-check against instances, snapshot anything you still want, and delete. The same idea catches unattached EIPs, unused load balancers and stopped-but-not-terminated instances.”

Q162: How do you find unused EIP?

What it is: An EIP with no association is allocated and billed while doing nothing, so finding them is a direct saving.

Why it is used: To reclaim money spent on addresses left over from decommissioned NAT gateways and instances.

# Find unassociated EIPs
aws ec2 describe-addresses \
  --filters "Name=association-state,Values=null" \
  --query 'Addresses[*].{AllocationId:AllocationId,PublicIP:PublicIp}'

Interview talking point: “Filter describe-addresses on association-state null to find them. An EIP is free while attached to an instance or NAT gateway but billed per hour unattached, and public IPv4 charges on other services are the line item people miss on modern bills.”

Q163: How do you enable AWS Cost Anomaly Detection?

What it is: Cost Anomaly Detection watches your actual or forecast bill for statistical outliers, using a monitor defined over a dimension like service or account.

Why it is used: To catch runaway spend within a day rather than discovering it at month end.

# Create anomaly monitor
aws ce create-anomaly-monitor \
  --anomaly-monitor '{
    "MonitorName": "RootAccountUsage",
    "MonitorType": "DIMENSIONAL",
    "MonitorDimension": "LINKED_ACCOUNT"
  }'

# Create subscription
aws ce create-anomaly-subscription \
  --anomaly-subscription '{
    "SubscriptionName": "EmailAlert",
    "Threshold": 100,
    "MonitorArnList": ["arn:aws:ce:us-east-1:123456789012:anomaly/monitor/12345"],
    "Subscribers": [{"Address": "admin@example.com", "Type": "EMAIL"}]
  }'

Interview talking point: “You create a monitor, then a subscription with a dollar threshold and email subscribers; detection itself is statistical at about 2.5 standard deviations, so the threshold is just the minimum worth alerting on. The monitor must exist before there is data, so enable it early and let it learn a baseline.”

Security Hardening

Q164: How do you enable VPC Flow Logs?

What it is: VPC Flow Logs record metadata about IP traffic accepted or rejected in a VPC, delivered to CloudWatch Logs or S3.

Why it is used: As a network audit trail and to investigate who talked to what, on which port, and whether it was allowed.

# Create log group
aws logs create-log-group --log-group-name /aws/vpc/flowlogs

# Create flow logs
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-1234567890abcdef0 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flowlogs \
  --deliver-logs-permission-role-arn arn:aws:iam::123456789012:role/FlowLogsRole

Interview talking point: “Creating flow logs with traffic type ALL requires the log group to already exist plus a delivery role ARN. It captures metadata only, never payload, so you learn a connection was attempted but not what was in it, and the logs themselves bill per gigabyte.”

Q165: How do you enable CloudTrail in all regions?

What it is: A multi-region trail with global service events included records API activity from every region into a single bucket.

Why it is used: For an audit view that cannot be evaded by simply switching region, which is what an attacker would do.

# Create multi-region trail
aws cloudtrail create-trail \
  --name my-trail \
  --s3-bucket-name my-cloudtrail-bucket \
  --is-multi-region-trail \
  --include-global-service-events \
  --enable-log-file-validation

Interview talking point: “Multi-region plus include-global-service-events is the full-coverage pair, and log file validation adds digest files proving objects were not tampered with. Both matter: without global events you miss IAM and CloudFront, which are global and leave holes in the audit trail.”

Q166: How do you enable GuardDuty?

What it is: GuardDuty is managed threat detection that analyses CloudTrail, VPC Flow Logs, DNS queries and runtime telemetry to produce findings without agents.

Why it is used: For continuous detection of misconfigured credentials, malicious IPs and exfiltration, without deploying anything yourself.

# Enable GuardDuty
aws guardduty create-detector \
  --enable

# Create findings filter
aws guardduty create-filter \
  --detector-id detector-id \
  --name high-severity \
  --finding-criteria '{"Criterion": {"severity": {"Eq": [8]}}}'

Interview talking point: “Enabling it is a single create-detector call with the enable flag, nothing to install. Filter findings by severity to cut noise, since only high-severity items are actionable, and note it is enabled per region, so in a multi-account setup you want organisation delegated admin so findings aggregate.”

Disaster Recovery

Q167: How do you create cross-region RDS replica?

What it is: A cross-region read replica is an asynchronously replicated copy of a DB instance in another region, created from the primary’s ARN.

Why it is used: For regional disaster recovery and to move read traffic closer to users in another geography.

# Create read replica in different region
aws rds create-db-instance-read-replica \
  --db-instance-identifier mydb-replica-us-west-2 \
  --source-db-instance-identifier arn:aws:rds:us-east-1:123456789012:db:mydb \
  --region us-west-2 \
  --db-instance-class db.t3.micro

Interview talking point: “The source is passed as a full ARN with a target region flag, and replication is asynchronous, so the replica can lag. Promoting it to accept writes costs in-flight transactions, but unlike a snapshot copy it keeps replicating, which is exactly what makes it the DR pattern.”

Q168: How do you copy RDS snapshot to another region?

What it is: copy-db-snapshot copies a DB snapshot to another region, producing a new snapshot you can restore from there.

Why it is used: To keep a restorable copy of your data outside the primary region, independent of any running instance.

# Copy snapshot
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier arn:aws:rds:us-east-1:123456789012:snapshot:mydb-snap \
  --target-db-snapshot-identifier mydb-snap-us-west-2 \
  --region us-west-2 \
  --copy-tags

Interview talking point: “The source is identified by full ARN because it lives in another region. Source and target must use the same engine with matching encryption status, and you cannot delete the source snapshot while the copy runs. This is a snapshot-shaped backup, where the read replica is a live-replicating one.”

Q169: How do you set up S3 cross-region replication?

What it is: S3 Cross-Region Replication copies new object versions to a bucket in another region, asynchronously, after each write.

Why it is used: For data residency requirements and keeping a copy outside the blast radius of a single region.

# Enable versioning on both buckets
aws s3api put-bucket-versioning \
  --bucket source-bucket \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-versioning \
  --bucket dest-bucket \
  --versioning-configuration Status=Enabled

# Enable replication
aws s3api put-bucket-replication \
  --bucket source-bucket \
  --replication-configuration '{
    "Role": "arn:aws:iam::123456789012:role/replication-role",
    "Rules": [{
      "ID": "replicate-all",
      "Status": "Enabled",
      "Destination": {"Bucket": "arn:aws:s3:::dest-bucket"}
    }]
  }'

Interview talking point: “Versioning must be on in both buckets, plus an IAM role that S3 assumes. Existing objects are not backfilled, and delete markers are not replicated unless you enable that, so a delete in the source region leaves the copy intact.”

Backup and Restore

Q170: How do you create EBS snapshot and restore?

What it is: create-snapshot captures a point-in-time EBS volume image; restoring means creating a new volume from that snapshot and attaching it.

Why it is used: As a backup before a risky change, and as the recovery path for a corrupted or lost volume.

# Create snapshot
aws ec2 create-snapshot \
  --volume-id vol-1234567890abcdef0 \
  --description "Backup of data volume"

# Restore from snapshot
aws ec2 create-volume \
  --snapshot-id snap-1234567890abcdef0 \
  --availability-zone us-east-1a

# Attach
aws ec2 attach-volume \
  --volume-id vol-new \
  --instance-id i-1234567890abcdef0 \
  --device /dev/sdf

Interview talking point: “Restoring always gives you a new volume, never an in-place restore, so recovery is not instant, and it must be created in the target AZ. A snapshot of an attached volume is crash-consistent rather than application-consistent, so a database needs a flush or freeze first.”

Q171: How do you automate backups with Data Lifecycle Manager?

What it is: Data Lifecycle Manager creates and deletes EBS snapshots on a schedule, targeting volumes by tag, so retention is automated.

Why it is used: To get automated backups with a defined retention window instead of hand-written cron jobs calling the EC2 API.

# Create lifecycle policy
aws dlm create-lifecycle-policy \
  --description "Daily EBS snapshots" \
  --state ENABLED \
  --policy-details '{
    "ResourceTypes": ["VOLUME"],
    "TargetTags": [{"Key": "Backup", "Value": "true"}],
    "Schedules": [{
      "Name": "DailyBackup",
      "CreateRule": {"Interval": 24, "IntervalUnit": "HOURS"},
      "RetainRule": {"Count": 7}
    }]
  }'

Interview talking point: “Targeting by tag is the whole design, since DLM has no other way to select volumes. Schedules are relative to policy creation with intervals in hours, snapshots are incremental so you pay for the accumulated chain, and deleting a policy does not delete the snapshots it made.”

Performance

Q172: How do you enable enhanced networking on EC2?

What it is: Enhanced networking puts the hypervisor’s physical NIC in the guest for lower latency and higher throughput; on modern instance types this is ENA.

Why it is used: Historically for 10 Gbps networking, today mainly to confirm the instance supports ENA rather than old SR-IOV.

# Enable enhanced networking (requires correct AMI and instance type)
# For ENA:
aws ec2 modify-instance-attribute \
  --instance-id i-1234567890abcdef0 \
  --ena-support

# For Intel 82599:
aws ec2 modify-instance-attribute \
  --instance-id i-1234567890abcdef0 \
  --sriov-net-support simple

Interview talking point: “The flags are ena-support and sriov-net-support simple, but enhanced networking is now the default on all current Nitro instance types and cannot be disabled there. The useful point is that the driver is ENA, while SR-IOV was the pre-2017 mechanism.”

Q173: How do you optimize S3 performance?

What it is: S3 performance comes down to avoiding a single-threaded path for large or many objects, using multipart, acceleration or a CDN.

Why it is used: To make uploads and downloads fast for large files or high-volume workloads without redesigning the application.

Use S3 Transfer Acceleration
Use multipart upload for large files
Use CloudFront for caching
Use appropriate key prefixes for high throughput
Use S3 Intelligent-Tiering

# Enable Transfer Acceleration
aws s3api put-bucket-accelerate-configuration \
  --bucket my-bucket \
  --accelerate-configuration Status=Enabled

Interview talking point: “Multipart upload is the biggest lever, and the CLI does it automatically over the threshold; CloudFront removes S3 from the read path entirely. Transfer Acceleration only helps uploads into S3 from long-distance clients and costs extra, and key-prefix randomisation matters near the request-rate limit.”

Q174: How do you optimize RDS performance?

What it is: RDS performance work is mostly about removing the database from the request path rather than buying a bigger instance.

Why it is used: When a database is the bottleneck, to raise throughput and lower latency before spending on compute.

Use Provisioned IOPS for SSD
Create read replicas for read-heavy workloads
Use ElastiCache for caching
Optimize queries with proper indexing
Enable Performance Insights
Right-size instance

Interview talking point: “Work in order: find the slow query with Performance Insights, add an ElastiCache layer, then read replicas for read-heavy load, and only then a larger instance class. Provisioned IOPS matters for high-write workloads, and indexing is the highest-leverage item and the one most often skipped.”

High Availability

Q175: How do you set up ALB with multiple AZ?

What it is: An ALB spans multiple subnets and, within a region, multiple AZs, so capacity remains if one AZ fails.

Why it is used: As the availability layer in front of a fleet, so no single AZ failure takes the service down.

# Create target group
aws elbv2 create-target-group \
  --name my-tg \
  --protocol HTTP \
  --port 80 \
  --vpc-id vpc-1234567890abcdef0 \
  --health-check-path /health

# Register instances in multiple AZs
aws elbv2 register-targets \
  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-tg/12345 \
  --targets Id=i-1234567890abcdef0,AvailabilityZone=us-east-1a Id=i-0987654321fedcba0,AvailabilityZone=us-east-1b

# Create ALB with subnets in multiple AZs
aws elbv2 create-load-balancer \
  --name my-alb \
  --subnets subnet-12345 subnet-67890 subnet-abcd \
  --security-groups sg-12345

Interview talking point: “The subnet list must span at least two AZs, and targets stay unhealthy until the health check path works. DNS is the real story: the ALB name resolves to one IP per AZ, so Route 53 alias records with target health evaluation are what handle client-side failover.”

Q176: How do you set up Route 53 failover?

What it is: Failover records are a pair of recordsets marked primary and secondary, each with a set identifier and health check, so routing follows health.

Why it is used: For active-passive multi-region failover driven by actual health rather than DNS TTL expiry.

# Create primary record
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABCDEF \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "example.com",
        "Type": "A",
        "Failover": "PRIMARY",
        "SetIdentifier": "primary",
        "AliasTarget": {
          "HostedZoneId": "Z1234567890ABCDEF",
          "DNSName": "myalb-1234567890.us-east-1.elb.amazonaws.com",
          "EvaluateTargetHealth": true
        },
        "HealthCheckId": "health-check-id-1"
      }
    }]
  }'

Interview talking point: “Both records need a set identifier and a health check ID, and the alias target needs health evaluation enabled. Create the health checks first, then both records in one change batch; without a working health check the primary is assumed healthy forever and failover never triggers.”

Additional Scenarios

Q177: How do you migrate EC2 to another account?

What it is: Cross-account migration works by making an AMI shareable, then copying it in the target account, since a shared AMI cannot be launched directly.

Why it is used: To move a workload to another AWS account without rebuilding the instance or sharing anything live.

Create AMI from source instance
Share AMI with target account
Copy AMI in target account
Launch instance from copied AMI

# In source account:
aws ec2 create-image --instance-id i-123 --name "MyAMI"

# Share AMI
aws ec2 modify-image-attribute \
  --image-id ami-123 \
  --attribute launchPermission \
  --operation-type add \
  --user-ids 123456789012

# In target account:
aws ec2 copy-image \
  --source-image-id ami-123 \
  --source-region us-east-1 \
  --name "MyAMI-Copied"

Interview talking point: “Share with a launch permission grant, then the target must run copy-image, because sharing alone is not enough. If the AMI is encrypted, the KMS key must be shared too or the copy cannot be decrypted; the modern alternative is Application and Infrastructure Migration Service.”

Q178: How do you set up Private API Gateway?

What it is: An execute-api interface endpoint puts API Gateway’s control and data plane in your VPC, so private callers reach it without the internet.

Why it is used: To let resources in private subnets call API Gateway without a NAT gateway or public IP.

# Create VPC endpoint for API Gateway
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.execute-api \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-12345 subnet-67890

Interview talking point: “The endpoint service name is com.amazonaws.region.execute-api, which people rarely guess. This only reaches API Gateway privately from inside your VPC; a genuinely internal API is better built with a resource policy using a source VPC or VPC endpoint condition, or a private REST API behind a VPC link.”

Q179: How do you enable S3 inventory?

What it is: S3 Inventory periodically writes a manifest of a bucket’s objects, with key, size, storage class and last modified, as CSV, ORC or Parquet.

Why it is used: For auditing a bucket, feeding a data lake, or seeing what is actually in there after years of accretion.

# Create bucket for inventory
aws s3 mb s3://inventory-bucket

# Configure inventory
aws s3api put-bucket-inventory-configuration \
  --bucket my-bucket \
  --inventory-configuration '{
    "Id": "inventory-config",
    "Destination": {
      "S3BucketDestination": {
        "Format": "CSV",
        "Bucket": "arn:aws:s3:::inventory-bucket"
      }
    },
    "IncludedObjectVersions": "All",
    "Schedule": {"Frequency": "Daily"}
  }'

Interview talking point: “Set a daily or weekly schedule and include all object versions to see deletes too. The destination bucket must have a bucket policy granting S3 permission or the inventory silently never appears, which is the step everyone misses; use Parquet when querying it with Athena at volume.”

Q180: How do you use AWS Config for compliance?

What it is: AWS Config continuously records resource configuration and evaluates it against rules, giving a time-series of state and compliance.

Why it is used: For compliance-as-code, drift detection, and answering when a security group changed, which CloudTrail alone cannot do.

# Enable AWS Config
aws config put-configuration-recorder \
  --configuration-recorder '{
    "name": "default",
    "roleARN": "arn:aws:iam::123456789012:role/config-role",
    "recordingGroup": {"allSupported": true, "includeGlobalResourceTypes": true}
  }'

# The CLI prefix is `config`, not `configservice`:
#   An error occurred (InvalidAction): Could not find operation
#   putConfigurationRecorder for version 2014-10-31

# Put delivery channel
aws config put-delivery-channel \
  --delivery-channel '{
    "name": "default",
    "s3BucketName": "config-bucket",
    "snsTopicArn": "arn:aws:sns:us-east-1:123456789012:config-topic"
  }'

# Start recorder
aws config start-configuration-recorder --configuration-recorder-name default

Interview talking point: “Enable the recorder, the delivery channel, then start the recorder; without the global resource types flag, IAM and CloudFront are not recorded at all. Cost is per rule evaluation, so scope rules by tag, and note the CLI service prefix is config, not configservice.”

Questions 181-200: Advanced Scenarios

Q181: How do you set up AWS Transfer Family for SFTP?

What it is: Transfer Family provides a managed SFTP, FTPS or FTP server fronting S3, replacing instances you would otherwise run for file drops.

Why it is used: For partner or customer file exchange into S3, with IAM-authenticated users instead of script credentials.

# Create server
aws transfer create-server \
  --identity-provider-type SERVICE_MANAGED \
  --protocols SFTP

# Create user
aws transfer create-user \
  --server-id s-1234567890abcdef0 \
  --user-name myuser \
  --ssh-public-key-body "ssh-rsa AAAAB..." \
  --role arn:aws:iam::123456789012:role/transfer-user-role \
  --home-directory /my-bucket/myuser

Interview talking point: “A service-managed server uses IAM auth, so each user is an identity with its own policy and SSH public key. The role on each user scopes what they can do in S3, and the home directory maps into the bucket as a chroot so users cannot navigate above it.”

Q182: How do you use Systems Manager Parameter Store with SecureString?

What it is: Parameter Store keeps configuration in a versioned hierarchy, and SecureString values are KMS-encrypted, returned in plaintext only when decryption is requested.

Why it is used: For application config including small credentials, without the rotation machinery of Secrets Manager.

import boto3

ssm = boto3.client('ssm')

# Create secure string
ssm.put_parameter(
    Name='/myapp/db/password',
    Value='encrypted_password',
    Type='SecureString',
    KeyId='alias/aws/ssm'  # Uses AWS managed key
)

# Get parameter
response = ssm.get_parameter(
    Name='/myapp/db/password',
    WithDecryption=True
)
password = response['Parameter']['Value']

Interview talking point: “GetParameter must ask for decryption, and that call is itself recorded in CloudTrail, which is the audit point. The distinction to state: Parameter Store is config-first, hierarchical and free up to a size with secrets as a feature, while Secrets Manager is secret-first, rotation-first and cross-account.”

Q183: How do you set up EventBridge schedule?

What it is: An EventBridge scheduled rule fires on a cron or rate expression, independent of any event.

Why it is used: To run recurring jobs like backups, rotation and reports without a scheduler service or cron instance.

# Create rule with schedule
aws events put-rule \
  --name daily-backup \
  --schedule-expression "cron(0 2 * * ? *)" \
  --state ENABLED

# Add target
aws events put-targets \
  --rule daily-backup \
  --targets '[{"Id":"1","Arn":"arn:aws:lambda:us-east-1:123456789012:function:daily-backup"}]'

Interview talking point: “EventBridge cron has six fields with a question mark in the day-of-week slot and is UTC only, so a 2am job runs at 2am UTC and catches people out. If you need a timezone, retries or flexible windows, AWS Scheduler is the newer service, since EventBridge rules lack them.”

Q184: How do you use CloudFormation StackSets?

What it is: A StackSet is a CloudFormation template instantiated across many accounts and regions from one management-account command.

Why it is used: For enforcing a baseline of logging and guardrails across every account without visiting each one.

# Create stack set
aws cloudformation create-stack-set \
  --stack-set-name my-stackset \
  --template-body file://template.yaml

# Add stacks to accounts/regions
aws cloudformation create-stack-instances \
  --stack-set-name my-stackset \
  --accounts '["123456789012"]' \
  --regions '["us-east-1","us-west-2"]' \
  --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1

Interview talking point: “Create the stack set, then stack instances with accounts, regions and operation preferences for concurrency and failure tolerance. Zero failure tolerance is essential or a partial failure leaves accounts half-configured, and for a self-managed stack set you must set up the trust relationship yourself before instances deploy.”

Q185: How do you configure RDS proxy?

What it is: RDS Proxy sits between your application and the database, pooling and reusing connections so the DB sees a small fixed pool.

Why it is used: To handle connection storms from Lambda scaling, without exhausting the database’s max connection limit.

# Create RDS proxy
aws rds create-db-proxy \
  --db-proxy-name my-proxy \
  --engine-family MYSQL \
  --auth '["SecretArn":"arn:aws:secretsmanager:us-east-1:123456789012:secret:db-credentials"]' \
  --role-arn arn:aws:iam::123456789012:role/rds-proxy-role \
  --vpc-subnet-ids subnet-12345 subnet-67890

# Register targets
aws rds register-db-proxy-targets \
  --db-proxy-name my-proxy \
  --target-group-name default \
  --db-instance-identifiers mydb

Interview talking point: “Create the proxy with subnet IDs and an auth secret, then register the DB targets; the proxy endpoint replaces the DB endpoint in the connection string. Secrets Manager is required for auth, and IAM database auth must be off when using password auth, since a mismatch there is a common failure.”

Q186: How do you enable S3 Object Lock?

What it is: Object Lock is write-once-read-many protection where a retention period is set at bucket or object level and early deletion is genuinely blocked.

Why it is used: For regulatory retention such as FINRA or SEC Rule 17a-4, where even an administrator must not delete early.

# Create bucket with object lock
aws s3api create-bucket \
  --bucket my-locked-bucket \
  --object-lock-enabled-for-bucket \
  --region us-east-1

# --object-lock-enabled-for-bucket is only accepted at creation.

# Put object lock retention
aws s3api put-object-retention \
  --bucket my-locked-bucket \
  --key myfile.txt \
  --retention '{"Mode":"GOVERNANCE","RetainUntilDate":"2025-01-01T00:00:00Z"}'

Interview talking point: “object-lock-enabled-for-bucket can only be set at bucket creation, so it cannot be added to an existing bucket. The modes differ fundamentally: governance lets the owner bypass retention with a special header, while compliance cannot be bypassed by anyone, ever.”

Q187: How do you use S3 Access Points?

What it is: An S3 Access Point gives a bucket a distinct endpoint with its own policy, so apps reach different prefixes without one shared policy.

Why it is used: To give each application its own access boundary on a shared data lake instead of a bucket-wide allow.

# Create access point
aws s3control create-access-point \
  --account-id 123456789012 \
  --name my-access-point \
  --bucket my-bucket

# Access using access point
s3://my-access-point--accountid.s3-accesspoint.us-east-1.amazonaws.com/myfile.txt

Interview talking point: “Create it with account ID, name and bucket, then address objects through the access point with its special bucket name format. Each access point carries its own IAM policy and block public access settings, so a component never needs ListBucket on the whole bucket.”

Q188: How do you configure EFS access points?

What it is: An EFS access point applies a POSIX user and a root directory to a filesystem, so each one looks like a separate mount.

Why it is used: To let multiple containers or teams share one EFS without conflicting UIDs or seeing each other’s directories.

# Create access point
aws efs create-access-point \
  --file-system-id fs-1234567890abcdef0 \
  --access-point-name my-ap \
  --posix-user '{"Uid":1000,"Gid":1000}' \
  --root-directory '{"Path":"/exports/data","CreationInfo":{"OwnerGid":1000,"OwnerUid":1000,"Permissions":"0755"}}'

Interview talking point: “The access point enforces an explicit UID and GID plus a rooted subdirectory regardless of what the container thinks its user is, which solves the ECS multi-container conflict. A task definition then mounts the access point ARN rather than the filesystem ID.”

Q189: How do you set up PrivateLink for ALB?

What it is: A PrivateLink endpoint for Elastic Load Balancing gives consumers a private endpoint to your load balancer inside their own VPC.

Why it is used: For exposing an internal service to partner accounts or VPCs without making it publicly routable.

# Create VPC endpoint for ALB
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.elasticloadbalancing \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-12345 subnet-67890 \
  --security-group-ids sg-12345

Interview talking point: “Create an interface endpoint for the elasticloadbalancing service, and note the target must be an NLB, because NLB supports PrivateLink and ALB does not; an ALB’s equivalent is an API Gateway VPC link. The consumer then resolves the endpoint’s private DNS names instead of the public ones.”

Q190: How do you use AWS Config Rules for security?

What it is: A Config rule evaluates configuration items against a condition, with AWS-managed rules for common posture and custom Lambda rules for anything else.

Why it is used: To detect and continuously re-check non-compliance instead of auditing once and hoping.

# Enable AWS Config rule
aws config put-config-rule \
  --config-rule '{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
    },
    "Scope": {
      "ComplianceResourceTypes": ["AWS::S3::Bucket"]
    }
  }'

Interview talking point: “Set the source owner to AWS for managed rules or CUSTOM_LAMBDA for your own, and scope which resource types are evaluated. Scope is also your cost control since billing is per evaluation, and a NON_COMPLIANT finding can drive an EventBridge rule into an auto-remediation Lambda, which is the closed loop.”

Q191: How do you set up Amazon Inspector?

What it is: Inspector continuously scans workloads for vulnerabilities and misconfigurations, but Inspector Classic was retired on July 25, 2025.

Why it is used: For vulnerability management across compute, containers and images, replacing the old assessment runs and rules packages.

# MODERN: Inspector v2 -- continuous, no assessment runs, no rules packages
aws inspectorv2 enable

# What it is scanning
aws inspectorv2 list-coverage \
  --filter '{"filterCriteria":{}}' \
  --query 'coveredResources[].{Type:resourceType,Count:count}' --output table

# Findings
aws inspectorv2 list-findings \
  --filter '{"filterCriteria":{}}' \
  --query 'findings[].{Sev:severity,CVE:inspectorScore,Fix:remediation}' \
  --output json | head -40

# Scan container images: build an SBOM, then a report
aws inspector create-report \
  --report-template 'arn:aws:inspector:us-east-1::report-template/ContainerImageScan' \
  --resource-arns '["arn:aws:ecr:us-east-1:123456789012:repository/my-repo@sha256:abc123..."]'

aws inspector list-report-findings \
  --report-id report-id \
  --query 'findings[].{Sev:severity,CVE:code,Fix:recommendation}' --output table

# ============================================================
# LEGACY -- Inspector Classic, retired July 25, 2025.
# `aws inspector enable`, `create-assessment-template` and
# `--rules-package-arns` were Classic-only and now fail with:
#   An error occurred (InvalidAction): Could not find operation
#   createAssessmentTemplate for version 2015-08-19
# ==========================================================

Interview talking point: “Correction: create-assessment-template with assessment targets and rules package ARNs is Inspector Classic and now fails, since it reached end of support in July 2025. The modern equivalent is the inspectorv2 enable call, while create-report targeting container images is the API that survived the rename.”

Q192: How do you use AWS Secrets Manager with rotation?

What it is: Secrets Manager stores a credential and rotates it on a schedule using a Lambda that implements the four rotation steps.

Why it is used: So database passwords change automatically and applications pick up the new value without a redeploy or an incident.

# Create secret with rotation
aws secretsmanager create-secret \
  --name prod/db-credentials \
  --secret-string '{"username":"admin","password":"currentpassword"}'

# create-secret takes NO rotation parameters. Configure rotation separately:
aws secretsmanager rotate-secret \
  --secret-id prod/db-credentials \
  --lambda-function-name arn:aws:lambda:us-east-1:123456789012:function:rotation-function \
  --rotation-rules AutomaticallyAfterDays=30

# Passing --rotation-lambda-arn to create-secret is rejected:
#   An error occurred (ValidationException): 1 validation error detected:
#   Value 'arn:...' at 'rotationLambdaArn' failed to satisfy constraint

Interview talking point: “Correction: create-secret takes no rotation parameters; rotation is configured with a separate rotate-secret call, and passing a rotation Lambda ARN to create-secret is rejected with a ValidationException. The rotation Lambda must run the four steps and signal completion or the secret is flagged RotationFailed and rotation halts.”

Q193: How do you set up AWS WAF?

What it is: WAF is a web application firewall inspecting HTTP requests against rules for IP sets, rate limits, injection and XSS signatures, geo-blocking and bots.

Why it is used: As the layer in front of CloudFront or an ALB that filters malicious traffic before it reaches the application.

# Create web ACL
aws wafv2 create-web-acl \
  --name my-web-acl \
  --scope CLOUDFRONT \
  --default-action '{"Allow":{}}'

# Add rule
aws wafv2 put-logging-configuration \
  --log-destination-configurations '[{"ARN":"arn:aws:wafv2:us-east-1:123456789012:loggingconfiguration/abc","RedactedFields":[{"FieldToMatch":{"SingleQueryArgument":{"Name":"password"}}}]}]'

Interview talking point: “Scope decides everything: a CLOUDFRONT web ACL only attaches to CloudFront and must be managed in us-east-1, while a REGIONAL one goes on an ALB, API Gateway or AppSync. Managed rule groups are the real value, and always enable WAF logging, since a block with no logs is an undiagnosable outage.”

Q194: How do you configure AWS Backup?

What it is: AWS Backup is a centralised service for scheduling, monitoring and restoring backups across AWS services, with one vault and a retention lifecycle.

Why it is used: For one place to manage backup policy and prove compliance across EBS, RDS, S3, EFS and DynamoDB.

# Create backup plan
aws backup create-backup-plan \
  --backup-plan '{
    "BackupPlan": {
      "BackupPlanName": "daily-backup",
      "Rules": [{
        "RuleName": "daily-backup-rule",
        "TargetBackupVaultName": "default",
        "ScheduleExpression": "cron(0 5 ? * * *)",
        "Lifecycle": {"MoveToColdStorageAfterDays": 30}
      }]
    }
  }'

Interview talking point: “A backup plan has no schedule of its own; the schedule lives on the rule, and resources are assigned via tags. The real value is the audit surface: one set of recovery points with governed retention, which is what a compliance regime asks for.”

Q195: How do you use AWS Marketplace?

What it is: AWS Marketplace is a curated catalogue of third-party software, including SaaS and containers, sold on your AWS bill.

Why it is used: To procure software through existing AWS billing rather than a separate vendor contract.

# Subscribe to product
aws marketplace subscribe \
  --product-arn arn:aws:aws-marketplace:us-east-1:123456789012:product/abc

# List subscriptions
aws marketplace list-subscriptions

Interview talking point: “Container products install like any other ECR image, so the image URI comes from Marketplace rather than Docker Hub. The interview-relevant point is procurement and billing consolidation, and private offers let you negotiate pricing through AWS, which matters at scale.”

Q196: How do you enable AWS Detective?

What it is: Detective builds a graph of your AWS identity and network activity, queried to answer investigation questions like who used this role.

Why it is used: To investigate a security incident without building your own data lake over CloudTrail, flow logs and GuardDuty.

# Enable Detective
aws detective create-graph \
  --region us-east-1

# Add member
aws detective create-members \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph/abc \
  --accounts '[{"AccountId":"123456789012","EmailAddress":"admin@example.com"}]'

Interview talking point: “Create the graph, then invite member accounts; Detective ingests CloudTrail and GuardDuty findings on your behalf, so you never build the pipeline. The differentiator is the graph and its evidence relationships, putting IP, instance, role and principal one hop away instead of a week of queries.”

Q197: How do you use AWS Systems Manager Quick Setup?

What it is: Quick Setup uses pre-built SSM associations, such as patch baselines, inventory collection and configuration baselines, applied to instances by tag.

Why it is used: To get baseline configuration and patching onto a fleet in one step rather than authoring documents yourself.

# Create Quick Setup
aws ssm create-association \
  --name "AWS-QuickSetup-ConfigWin" \
  --targets '[{"Key":"InstanceIds","Values":["i-123"]}]'

Interview talking point: “The Quick Setup names are specific SSM documents, so an association call with the right document name and instance targets is the whole mechanism. It is a reasonable starting point for an inherited fleet, but real environments move to custom associations scoped by tags and compliance baselines.”

Q198: How do you enable VPC Reachability Analyzer?

What it is: Reachability Analyzer analyses the network configuration between a source and destination and reports whether the path is reachable and why not.

Why it is used: To diagnose connectivity between specific endpoints without manually tracing security groups, NACLs, route tables and endpoints.

# Create path
aws ec2-reachability-analyzer create-path \
  --source '{"InstanceId":"i-1234567890abcdef0"}' \
  --destination '{"InstanceId":"i-0987654321fedcba0"}'

# Get path result
aws ec2-reachability-analyzer get-path \
  --path-id path-id

Interview talking point: “Create a path with source and destination, then get the path result. It models security groups in both directions, NACLs, route tables and gateways or endpoints, and reports the first blocking hop, supporting instance, subnet, network interface, load balancer and NAT gateway endpoints.”

Q199: How do you use AWS Migration Hub?

What it is: Application Discovery Service assesses an on-premises or cloud estate and groups discovered applications for migration planning.

Why it is used: For migration assessment, inventorying what is running and what depends on what, before deciding how to move.

# Register application
aws migrationhub create-application \
  --name my-application

# Discovered resource
aws migrationhub list-discovered-resources \
  --account-id 123456789012 \
  --region us-east-1

Interview talking point: “Important correction: the Migration Hub portfolio model closed on June 30, 2024, so new work uses Application and Infrastructure Migration Service, whose CLI is aws migration. The underlying capability, agentless and agent-based discovery populating a dependency map, is unchanged.”

Q200: How do you use AWS Application Discovery Service?

What it is: ADS runs discovery agents or agentless connectors that observe workloads and report them for migration assessment.

Why it is used: To build an inventory and dependency map of what you are running, as input to a migration plan.

# There is NO `start-agentless-connection` API. Real operations:

# Import an inventory file (agentless path)
aws discovery start-import-task \
  --import-task-config '{
    "ImportTaskId": "it-1234",
    "Source": {"S3BucketName": "discovery-bucket", "S3ObjectKey": "inventory.json"}
  }' \
  --name my-import

# One-off agent-based discovery
aws discovery create-invocation-configuration \
  --configuration-name my-invocation \
  --agent-ids "i-1234567890abcdefg"

aws discovery start-invocation \
  --configuration-id ic-12345 \
  --ids '["i-1234567890abcdefg"]'

# List registered agents
aws discovery list-agents

Interview talking point: “Correction: start-agentless-connection is not a real API and does not exist. The actual operations are start-import-task for inventory files, create-invocation-configuration and start-invocation for agent runs, plus create-continuous-discovery and batch-delete-discovery; getting this wrong suggests memorising CLI shapes rather than knowing the service.”

Continue with Questions 201-300 in next file…