AWS_Practical_Interview_201 400

AWS Practical Interview Questions (201-400)

EKS and Kubernetes

Q201: How do you create EKS cluster?

What it is: create-cluster provisions the EKS control plane: an AWS-managed Kubernetes API server, its IAM role, and VPC subnets for its ENIs.

Why it is used: To get a managed Kubernetes control plane so you run worker nodes and workloads yourself.

# Create cluster
aws eks create-cluster \
  --name my-cluster \
  --role-arn arn:aws:iam::123456789012:role/eks-role \
  --resources-vpc-config subnetIds=subnet-12345,subnet-67890,securityGroupIds=sg-12345 \
  --version 1.28

# Update kubeconfig
aws eks update-kubeconfig --name my-cluster --region us-east-1

Interview talking point: “Pass subnetIds comma-separated in one string, and —version is now mandatory. Subnets also need discovery and load balancer tags, and the private API endpoint requires NAT egress or the control plane loses cluster access.”

Q202: How do you create node group in EKS?

What it is: A node group is a managed set of EC2 worker instances registered with the cluster, with min, max and desired scaling.

Why it is used: So Kubernetes capacity is managed for you; the underlying ASG resizes and replaces nodes automatically.

# Create node group
aws eks create-nodegroup \
  --cluster-name my-cluster \
  --nodegroup-name my-nodes \
  --scaling-config minSize=2,maxSize=5,desiredSize=3 \
  --instance-types t3.medium \
  --subnets subnet-12345 subnet-67890

Interview talking point: “Note the argument style differs from cluster creation: —subnets is a space-separated list, not comma-in-one-string. capacityType defaults to ON_DEMAND unless you choose SPOT, and Spot node groups need a tolerating taint on pods.”

Q203: How do you deploy application to EKS?

What it is: A Deployment is a desired-state object: a replicas count makes a ReplicaSet keep that many Pods running and replace dead ones.

Why it is used: To roll out and manage a replicated workload declaratively rather than starting pods by hand.

# Apply deployment
kubectl apply -f deployment.yaml

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: nginx:latest
        ports:
        - containerPort: 80

Interview talking point: “The selector field is immutable, so a typo in matchLabels means deleting and recreating the Deployment. Also avoid image tags like latest: a rollout with an unchanged tag is a no-op, the classic deploy that does nothing.”

Q204: How do you expose application in EKS?

What it is: A Service gives Pods a stable virtual IP and DNS name; an Ingress is an HTTP routing layer fanning one hostname across Services.

Why it is used: To expose a workload internally, or externally through a load balancer with host-based routing.

# Create service
kubectl expose deployment my-app --type=LoadBalancer --port=80

# Or create ingress
kubectl apply -f ingress.yaml

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-app
            port:
              number: 80

Interview talking point: “An Ingress object does nothing without an ingress controller installed, and on modern clusters an Ingress lacking ingressClassName silently matches nothing. The ALB controller also needs the scheme and target-type annotations to build a working load balancer.”

Q205: How do you set up ALB controller in EKS?

What it is: The AWS Load Balancer Controller watches Ingress and Service objects and provisions matching ALBs, target groups and security groups.

Why it is used: So Kubernetes networking resources become real AWS load balancing resources declaratively, without hand-building an ALB per app.

# Install AWS Load Balancer Controller
helm repo add eks https://aws.github.io/eks-charts
helm install aws-load-balancer-controller \
  -n kube-system \
  --set clusterName=my-cluster \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller

Interview talking point: “Installed via Helm, and setting serviceAccount.create=false means the service account must already exist with an IRSA trust policy, otherwise the controller fails with no AWS credentials. Its IAM policy is broad because it calls ELB, WAF and ACM APIs for you.”

AWS Glue and Data Pipeline

Q206: How do you create Glue crawler?

What it is: A Glue crawler inspects a data store, infers a schema, and creates or updates Glue Data Catalog tables to match.

Why it is used: So analysts can query files in S3 with SQL without anyone hand-writing a schema.

# Create crawler
aws glue create-crawler \
  --name my-crawler \
  --role arn:aws:iam::123456789012:role/glue-role \
  --database-name my-database \
  --targets '{
    "S3Targets": [{"Path": "s3://my-bucket/data/"}]
  }' \
  --schedule "cron(0 12 * * ? *)"

Interview talking point: “The crawler writes only to the Data Catalog, never the source data. Role changes require update-crawler —role first, and the role needs both s3:GetObject on the target prefix and glue:CreateTable, because the crawler reads files to infer schema.”

Q207: How do you create Glue job?

What it is: A Glue job is a Spark, Ray or Python script run on Glue managed compute, orchestrated by a service role.

Why it is used: For ETL and data integration jobs where you do not want to manage a cluster or runner.

# Create job
aws glue create-job \
  --name my-etl-job \
  --role arn:aws:iam::123456789012:role/glue-role \
  --command '{
    "Name": "glueetl",
    "ScriptLocation": "s3://my-bucket/scripts/etl.py"
  }' \
  --default-arguments '{
    "--job-language": "python",
    "--enable-metrics": ""
  }'

Interview talking point: “The command Name selects the runtime: glueetl for Python, gluespark for Spark, glueray for Ray, rather than a separate flag. Put —job-language at the top level of DefaultArguments, not inside —arguments, or Glue ignores it.”

Q208: How do you run Glue job?

What it is: start-job-run starts one execution of a Glue job, optionally overriding default arguments for that run.

Why it is used: To trigger a job on demand or from a schedule, passing per-run parameters like a date partition.

# Start job run
aws glue start-job-run \
  --job-name my-etl-job \
  --arguments '{
    "--extra-py-files": "s3://my-bucket/lib/utils.py"
  }'

Interview talking point: “Run-time arguments override the job’s defaults rather than merging with them, and you poll the returned run id with get-job-run. The job timeout comes from the job’s Timeout field, not from the individual run.”

AWS Step Functions

Q209: How do you create Step Functions state machine?

What it is: A state machine is a JSON workflow of Amazon States Language states like Task, Choice, Map, Parallel and Wait.

Why it is used: To orchestrate a multi-step workflow with retries, error handling and branching, without writing control flow yourself.

# Create state machine
aws stepfunctions create-state-machine \
  --name my-workflow \
  --definition '{
    "Comment": "My workflow",
    "StartAt": "FirstState",
    "States": {
      "FirstState": {
        "Type": "Pass",
        "End": true
      }
    }
  }' \
  --role-arn arn:aws:iam::123456789012:role/stepfunctions-role

Interview talking point: “The role argument is what Step Functions assumes to call your AWS services, and a missing permission fails the execution with AccessDeniedException. A minimal definition needs StartAt plus a terminal End, and long work belongs in a .sync or waitForTaskToken pattern.”

Q210: How do you invoke Step Functions?

What it is: start-execution runs an instance of a state machine with JSON input, returning an execution ARN you can poll.

Why it is used: To kick off a workflow programmatically, whether synchronously in a Lambda or asynchronously from an API.

# Start execution
aws stepfunctions start-execution \
  --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:my-workflow \
  --input '{"key": "value"}'

Interview talking point: “start-execution is asynchronous: it returns immediately with a RUNNING execution, so you poll with describe-execution or filter ListExecutions by status. A truly synchronous call requires the separate StartSyncExecution API, and the input must be valid JSON.”

AWS EventBridge

Q211: How do you create EventBridge rule?

What it is: An EventBridge rule pairs an event pattern with zero or more targets; every matching event invokes each target.

Why it is used: To react to AWS service events, custom events or schedules with no polling and no glue code.

# Create rule
aws events put-rule \
  --name my-rule \
  --event-pattern '{
    "source": ["aws.ec2"],
    "detail-type": ["EC2 Instance State-change Notification"]
  }'

# Add target
aws events put-targets \
  --rule my-rule \
  --targets '[{"Id":"1","Arn":"arn:aws:lambda:us-east-1:123456789012:function:my-function"}]'

Interview talking point: “Creation is two steps, put-rule then put-targets, with pattern keys source, detail-type, detail and resources. For AWS API activity use detail-type AWS API Call via CloudTrail with detail.eventName, and one rule cannot hold both an event pattern and a schedule.”

Q212: How do you create EventBridge schedule?

What it is: A scheduled rule fires on a cron or rate expression rather than on an event.

Why it is used: To run recurring jobs like a nightly snapshot or weekly report without a dedicated scheduler.

# Create schedule
aws events put-rule \
  --name daily-trigger \
  --schedule-expression "rate(1 day)"

Interview talking point: “Use a schedule expression with no event pattern on the same rule. EventBridge cron has six fields with a question mark in the day-of-week slot and is always UTC; for timezones, retries and flexible windows use AWS Scheduler instead.”

AWS CodeBuild

Q213: How do you create CodeBuild project?

What it is: A CodeBuild project defines source, build environment image and compute size, artifact destination, and the buildspec that runs.

Why it is used: To run CI builds as a managed service instead of maintaining your own build agents.

# Create project
aws codebuild create-project \
  --name my-build-project \
  --source '{
    "type": "GITHUB",
    "location": "https://github.com/user/repo"
  }' \
  --artifacts '{
    "type": "S3",
    "location": "my-bucket"
  }' \
  --environment '{
    "type": "LINUX_CONTAINER",
    "computeType": "BUILD_GENERAL1_MEDIUM",
    "image": "aws/codebuild/standard:6.0"
  }'

Interview talking point: “Use aws/codebuild standard:6.0 on AL2023, since the older standard:4.0 images run as root and were deprecated. The artifact location is the bucket name, not an ARN, GitHub sources need an OAuth token, and Docker builds require privilegedMode true.”

Q214: How do you create buildspec.yml?

What it is: A buildspec.yml is the build script CodeBuild reads from the repo root, defining env vars, phases and artifact files.

Why it is used: To define build steps as code in the repository rather than in console configuration.

version: 0.2

env:
  variables:
    NODE_ENV: "production"

phases:
  install:
    runtime-versions:
      nodejs: 18
    commands:
      - npm install
  build:
    commands:
      - npm run build
  post_build:
    commands:
      - npm test

artifacts:
  files:
    - '**/*'
  discard-paths: yes

Interview talking point: “Phase order is fixed: pre_build, install, build, post_build, finalize. Artifacts use glob patterns, and discard-paths yes strips the leading path, without which the artifact lands one directory deeper than the deploy step expects.”

AWS CodeDeploy

Q215: How do you create CodeDeploy application?

What it is: CodeDeploy needs an application, a deployment group selecting target instances by tag, and a service role it assumes.

Why it is used: For scripted, auditable deployments with automatic rollback when validation hooks fail.

# Create application
aws codedeploy create-application \
  --application-name my-application

# Create deployment group
aws codedeploy create-deployment-group \
  --application-name my-application \
  --deployment-group-name my-deployment-group \
  --service-role-arn arn:aws:iam::123456789012:role/codedeploy-role \
  --ec2TagFilters '[{"Key": "Environment", "Value": "Production"}]'

Interview talking point: “ec2TagFilters decides which instances receive the deployment, so an untagged instance is never a target. The service role lets CodeDeploy stop services and run scripts over SSH or SSM, and —deployment-config-name chooses AllAtOnce or OneAtATime.”

Q216: How do you create appspec.yml?

What it is: appspec.yml tells CodeDeploy where artifacts go on the instance and which lifecycle hooks run before and after installing.

Why it is used: To make the deployment stop, install, start and validate the service instead of doing those steps by hand.

version: 0.0
os: linux

files:
  - source: /
    destination: /var/www/html

hooks:
  BeforeInstall:
    - location: scripts/before_install.sh
      timeout: 300
  AfterInstall:
    - location: scripts/after_install.sh
  ApplicationStart:
    - location: scripts/start_server.sh
  ValidateService:
    - location: scripts/test.sh

Interview talking point: “Hooks run in a fixed order, and if ValidateService exits non-zero CodeDeploy rolls back automatically. Each hook has a timeout in seconds, and the whole deployment fails if the script is not executable, so running chmod +x matters.”

AWS CodePipeline

Q217: How do you create CodePipeline?

What it is: A pipeline is an ordered set of stages with actions, plus a shared artifact store passing output between stages.

Why it is used: To chain source, build and deploy into one automated delivery workflow with per-stage status tracking.

# Create pipeline
aws codepipeline create-pipeline \
  --pipeline '{
    "name": "my-pipeline",
    "roleArn": "arn:aws:iam::123456789012:role/codepipeline-role",
    "stages": [
      {
        "name": "Source",
        "actions": [{
          "name": "SourceAction",
          "actionTypeId": {"category": "Source", "owner": "AWS", "provider": "CodeCommit", "version": "1"},
          "configuration": {"RepositoryName": "my-repo", "BranchName": "main"}
        }]
      },
      {
        "name": "Build",
        "actions": [{
          "name": "BuildAction",
          "actionTypeId": {"category": "Build", "owner": "AWS", "provider": "CodeBuild", "version": "1"},
          "configuration": {"ProjectName": "my-build-project"}
        }]
      }
    ],
    "artifactStore": {"type": "S3", "location": "my-artifact-bucket"}
  }'

Interview talking point: “create-pipeline is a full replace, not a merge, so anything omitted from the JSON is deleted; export the existing definition first. The artifactStore is mandatory, nothing runs until start-pipeline-execution, and cross-account actions need sts:AssumeRole with an ExternalId condition.”

AWS CloudTrail

Q218: How do you look up CloudTrail events?

What it is: lookup-events reads CloudTrail Event History: the last 90 days of management events in one region, 50 per page.

Why it is used: As a quick way to answer who did what recently in one region without building a trail.

# Lookup events
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=ec2.amazonaws.com

# Lookup by username
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=john

# Lookup by resource
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=my-bucket

Interview talking point: “Event History is 90 days, single region, 50 events per page, and you cannot filter by resource name, so AttributeKey=ResourceName does not work the way it looks. For real analysis, query the trail’s log group with Logs Insights or Athena over S3.”

AWS Config

Q219: How do you enable AWS Config?

What it is: AWS Config needs a configuration recorder, a delivery channel to S3 and SNS, and the recorder started.

Why it is used: To keep a time series of resource configuration, answering what a resource looked like last Tuesday.

# Create configuration recorder
aws config put-configuration-recorder \
  --configuration-recorder '{
    "name": "default",
    "roleARN": "arn:aws:iam::123456789012:role/config-role",
    "recordingGroup": {
      "allSupported": true,
      "includeGlobalResourceTypes": true
    }
  }'

# Create delivery channel
aws config put-delivery-channel \
  --delivery-channel '{
    "name": "default",
    "s3BucketName": "config-bucket",
    "snsTopicARN": "arn:aws:sns:us-east-1:123456789012:config-topic"
  }'

# Start recorder
aws config start-configuration-recorder --configuration-recorder-name default

# NB: the CLI prefix is `config`. `aws configservice put-configuration-recorder`
# fails with:
#   An error occurred (InvalidAction): Could not find operation
#   putConfigurationRecorder for version 2014-10-31
#
# Without includeGlobalResourceTypes, IAM and CloudFront config changes
# are NOT recorded. Verify with: aws config describe-configuration-recorders

Interview talking point: “The CLI prefix is config, not configservice, which fails with InvalidAction could not find operation. All three steps are required, and without includeGlobalResourceTypes IAM and CloudFront changes are never recorded. Cost is per rule evaluation, so scope rules by tag.”

AWS Systems Manager

Q220: How do you create Maintenance Window?

What it is: A maintenance window is a scheduled SSM slot with registered targets and tasks like runbooks, commands or Lambda functions.

Why it is used: To schedule patching with AWS-RunPatchBaseline in a defined window rather than whenever a job happens to run.

# Create maintenance window
aws ssm create-maintenance-window \
  --name "My-Maintenance-Window" \
  --schedule "cron(0 2 ? * SUN *)" \
  --duration 4 \
  --cutoff 1

# Register target
aws ssm register-target-with-maintenance-window \
  --window-id mw-12345 \
  --target '{"Key":"instanceids","Values":["i-12345"]}'

# Register task
aws ssm register-task-with-maintenance-window \
  --window-id mw-12345 \
  --task-arn arn:aws:iam::123456789012:role/ssm-role \
  --service-role-arn arn:aws:iam::123456789012:role/ssm-role \
  --task-type AUTOMATION \
  --max-concurrency 1 --max-errors 1

Interview talking point: “Registration order matters: create the window, register targets, then register tasks, because a task can only reference already-registered targets. The cutoff argument stops new tasks an hour before the window ends, and max-concurrency and max-errors control blast radius.”

AWS Secrets Manager

Q221: How do you create secret with rotation?

What it is: Secrets Manager stores a credential and rotates it on a schedule, but rotation is configured by a separate rotate-secret call.

Why it is used: So a database password changes automatically and applications pick up the new value without a redeploy.

# Create secret with Lambda rotation
aws secretsmanager create-secret \
  --name prod/db-credentials \
  --secret-string '{"username":"admin","password":"password123"}'

# create-secret takes NO rotation parameters. Rotation is a separate call:
aws secretsmanager rotate-secret \
  --secret-id prod/db-credentials \
  --lambda-function-name arn:aws:lambda:us-east-1:123456789012:function:rotation-function \
  --rotation-rules 'AutomaticallyAfterDays=30'

# Passing --rotation-lambda-arn to create-secret is rejected:
#   An error occurred (ValidationException): 1 validation error detected:
#   Value 'arn:...' at 'rotationLambdaArn' failed to satisfy constraint

Interview talking point: “create-secret takes no rotation parameters at all; passing —rotation-lambda-arn to it fails with a ValidationException on rotationLambdaArn. You create the secret, then call rotate-secret, and the rotation Lambda must complete its steps or the secret stalls in RotationFailed.”

AWS KMS

Q222: How do you create KMS key with policy?

What it is: create-key makes a customer master key, and put-key-policy decides who may use it; KMS requires both key policy and IAM permission.

Why it is used: When you need to control, audit or revoke access to the encryption key itself, not just rely on AWS-managed keys.

# Create key
aws kms create-key \
  --description "My encryption key" \
  --key-usage ENCRYPT_DECRYPT \
  --origin AWS_KMS \
  --multi-region

# You need an alias to reference the key by name, and it must exist
# BEFORE put-key-policy --key-id alias/my-key (otherwise NotFoundException)
aws kms create-alias \
  --alias-name alias/my-key \
  --target-key-id key-1234abcd-12ab-34cd-56ef-1234567890ab

# Put key policy
aws kms put-key-policy \
  --key-id alias/my-key \
  --policy '{
    "Version": "2012-10-17",
    "Id": "key-policy",
    "Statement": [{
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:root"},
      "Action": "kms:*",
      "Resource": "*"
    }]
  }'

Interview talking point: “The alias must exist before put-key-policy can reference alias/my-key, otherwise it fails with NotFoundException, and —multi-region is a bare flag, not a key-value pair. The Enable IAM User Permissions statement delegating to IAM is mandatory, not boilerplate.”

AWS CloudWatch Logs

Q223: How do you create log subscription filter?

What it is: A subscription filter forwards matching log events from a log group to a Lambda, Kinesis stream or another log group.

Why it is used: To build real-time alerting or parsing on logs instead of querying retrospectively, which is slow and costly at volume.

# Create subscription filter to Lambda
aws logs put-subscription-filter \
  --log-group-name /aws/lambda/my-function \
  --filter-name error-filter \
  --filter-pattern "[level=ERROR]" \
  --destination-arn arn:aws:lambda:us-east-1:123456789012:function:error-processor

Interview talking point: “The destination needs a resource policy allowing logs.amazonaws.com or events are silently dropped. The pattern [level=ERROR] only works on structured JSON logs and does nothing on plain text, which is the usual reason a filter appears to be ignored.”

AWS S3 Advanced

Q224: How do you set up S3 batch operations?

What it is: S3 Batch Operations runs a manifest of millions of S3 API operations as one managed asynchronous job.

Why it is used: To copy, delete or change storage class across millions of objects far cheaper than per-request pricing.

# Create job
aws s3control create-job \
  --account-id 123456789012 \
  --operation '{
    "S3PutObjectCopy": {
      "TargetResource": "arn:aws:s3:::dest-bucket/*"
    }
  }' \
  --manifest '{
    "Spec": {
      "Format": "S3BatchOperations_CSV_20180820",
      "Fields": ["Bucket", "Key"]
    },
    "Location": {
      "ObjectArn": "arn:aws:s3:::manifest-bucket/manifest.csv"
    }
  }' \
  --priority 10 \
  --role-arn arn:aws:iam::123456789012:role/batch-role

Interview talking point: “Use s3control create-job with a manifest and a role that has both batch operations permissions and your bucket permissions, and the CSV must be readable by that role. Results land in a report you poll with describe-job, and pricing is per object plus per gigabyte.”

AWS Lambda Advanced Patterns

Q225: How do you handle Lambda errors with dead letter queue?

What it is: A Lambda dead-letter queue is configured on the function, so exhausted retries deliver the original event to SQS or SNS.

Why it is used: So failed events are not silently lost and can be inspected, replayed or routed elsewhere.

import boto3
import json

def lambda_handler(event, context):
    try:
        # Process event
        result = process_data(event)
        return {'statusCode': 200, 'body': json.dumps(result)}
    except Exception as e:
        # Send to DLQ
        sqs = boto3.client('sqs')
        sqs.send_message(
            QueueUrl='https://sqs.us-east-1.amazonaws.com/123456789012/dlq',
            MessageBody=json.dumps(event)
        )
        raise e

Interview talking point: “A manual send-message in the handler is not the native dead-letter config, which captures the triggering event only after Lambda has retried twice with backoff. Prefer the native DLQ, and keep the handler idempotent because a DLQ relocates at-least-once delivery rather than removing it.”

AWS VPC Advanced

Q226: How do you create VPC with NAT Gateway?

What it is: A NAT Gateway is an AWS-managed appliance in a public subnet with an Elastic IP, reached via a 0.0.0.0/0 route.

Why it is used: To give private subnet instances outbound internet access for updates and API calls while keeping them unreachable inbound.

# Create VPC
VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query 'Vpc.VpcId' --output text)

# Create public subnet
PUBLIC_SUBNET=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.1.0/24 --availability-zone us-east-1a --query 'Subnet.SubnetId' --output text)

# Create private subnet
PRIVATE_SUBNET=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.2.0/24 --availability-zone us-east-1a --query 'Subnet.SubnetId' --output text)

# Create IGW
IGW=$(aws ec2 create-internet-gateway --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --vpc-id $VPC --internet-gateway-id $IGW

# Create EIP and NAT Gateway
EIP=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
NAT=$(aws ec2 create-nat-gateway --subnet-id $PUBLIC_SUBNET --allocation-id $EIP --query 'NatGateway.NatGatewayId' --output text)

# Create route tables
PUBLIC_RT=$(aws ec2 create-route-table --vpc-id $VPC --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PUBLIC_RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW
aws ec2 associate-route-table --route-table-id $PUBLIC_RT --subnet-id $PUBLIC_SUBNET

PRIVATE_RT=$(aws ec2 create-route-table --vpc-id $VPC --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PRIVATE_RT --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT
aws ec2 associate-route-table --route-table-id $PRIVATE_RT --subnet-id $PRIVATE_SUBNET

Interview talking point: “The gateway must sit in the public subnet, and you must wait for it to reach available before creating the private route, or route creation fails with NatGatewayNotFound. Run one per AZ for high availability, and remember it is billed per gigabyte.”

AWS RDS Advanced

Q227: How do you create RDS proxy?

What it is: An RDS Proxy sits between clients and the database, pooling connections and multiplexing many client connections onto them.

Why it is used: To survive connection storms from hundreds of concurrent Lambda invocations without exhausting the database max_connections.

# Create secret for database credentials
aws secretsmanager create-secret \
  --name rds-secret \
  --secret-string '{"username":"admin","password":"password"}'

# Create RDS proxy
aws rds create-db-proxy \
  --db-proxy-name my-proxy \
  --engine-family MYSQL \
  --auth '[{"SecretArn":"arn:aws:secretsmanager:us-east-1:123456789012:secret:rds-secret","IAMAuth":"DISABLED"}]' \
  --role-arn arn:aws:iam::123456789012:role/rds-proxy-role \
  --vpc-subnet-ids subnet-12345 subnet-67890 \
  --vpc-security-group-ids sg-12345

Interview talking point: “Applications connect to the proxy endpoint instead of the database endpoint. The auth secret must live in Secrets Manager, not Parameter Store, IAMAuth DISABLED means password auth, and require-tls is what stops plaintext credentials crossing the VPC.”

AWS DynamoDB Advanced

Q228: How do you create DynamoDB global table?

What it is: A global table replicates a DynamoDB table across two or more regions so writes propagate and any region serves reads.

Why it is used: For globally distributed applications needing local read latency and regional write survivability.

# Create table in first region
aws dynamodb create-table \
  --table-name Orders \
  --attribute-definitions AttributeName=OrderID,AttributeType=S \
  --key-schema AttributeName=OrderID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES

# THIS is what makes it a global table -- create-table only made a local one
aws dynamodb update-global-table \
  --table-name Orders \
  --replica-regions '[{"RegionName":"eu-west-1"},{"RegionName":"ap-south-1"}]' \
  --update-stacks-in-since-true

# Replicas show CREATING until built + synchronised
aws dynamodb describe-global-table \
  --table-name Orders \
  --query 'GlobalTable.Replicas[].{Region:RegionName,Status:ReplicaStatus}'

# Point-in-time recovery is a SEPARATE feature
aws dynamodb update-continuous-backups \
  --table-name Orders \
  --point-in-time-recovery-specification 'PointInTimeRecoveryEnabled=true'

Interview talking point: “Enabling a stream and calling create-table only makes a local table; update-global-table with replica-regions is what makes it global, and replicas show CREATING until synchronised. The table name must be identical in every region, and point-in-time recovery is a separate call.”

AWS EFS Advanced

Q229: How do you create EFS with access points?

What it is: An EFS access point enforces a POSIX UID/GID and a root subdirectory, presenting one filesystem as separate views.

Why it is used: To let multiple containers or teams share one EFS without UID conflicts or reading each other’s directories.

# Create EFS
EFS=$(aws efs create-file-system \
  --throughput-mode bursting \
  --encrypted \
  --query 'FileSystemId' \
  --output text)

# Create access point for app
aws efs create-access-point \
  --file-system-id $EFS \
  --access-point-name app-access \
  --posix-user '{"Uid":1000,"Gid":1000}' \
  --root-directory '{"Path":"/app","CreationInfo":{"OwnerGid":1000,"OwnerUid":1000,"Permissions":"0755"}}'

# Create access point for data
aws efs create-access-point \
  --file-system-id $EFS \
  --access-point-name data-access \
  --posix-user '{"Uid":1001,"Gid":1001}' \
  --root-directory '{"Path":"/data","CreationInfo":{"OwnerGid":1001,"OwnerUid":1001,"Permissions":"0755"}}'

Interview talking point: “In an ECS task definition you mount the access point ARN, not the filesystem ID, in the EFSVolumeConfiguration. The enforced POSIX user maps container UIDs onto the access point’s, so you never have to align UIDs between containers.”

AWS ECS Advanced

Q230: How do you update ECS service with blue-green?

What it is: ECS blue/green uses CodeDeploy to run the new task definition as a second target set, verify it, then shift traffic.

Why it is used: For zero-downtime releases needing a real one-step rollback instead of another rolling deployment.

# Create new task definition
aws ecs register-task-definition \
  --family my-app \
  --network-mode awsvpc \
  --container-definitions '[{"name":"web","image":"nginx:v2"}]'

# NOTE: the command above is a ROLLING update, not blue/green.
# Blue/green needs CodeDeploy owning the traffic shift:

aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --deployment-configuration '{
    "deploymentController": {"type": "CODE_DEPLOY"},
    "deploymentCircuitBreaker": {"enable": true, "rollback": true}
  }'

# Two target groups, weighted, behind one listener
aws deploy create-deployment-group \
  --application-name my-app \
  --deployment-group-name my-app-bg \
  --service-role-arn arn:aws:iam::123456789012:role/codedeploy-role \
  --deployment-config-name CodeDeployDefault.BlueGreen \
  --blue-green-deployment-config '{
    "deploymentReadyOption": {"actionOnTimeout": "STOP_DEPLOYMENT", "waitTimeInMinutes": 5},
    "terminateBlueInstancesOnDeploymentSuccess": true
  }'

# The ALB listener must target BOTH target groups with weights 1/0
aws elbv2 modify-listener \
  --listener-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-lb/abc/def \
  --default-actions '[{"Type":"forward","ForwardConfig":{"TargetGroups":[{"TargetGroupArn":"TG_BLUE","Weight":1},{"TargetGroupArn":"TG_GREEN","Weight":0}]}}]'

# Rollback is then: aws deploy stop-deployment --auto-rollback-enabled

Interview talking point: “Registering a task definition is a rolling update, not blue/green. Blue/green requires deploymentController set to CODE_DEPLOY plus a CodeDeploy deployment group, and the ALB listener must forward to both target groups with weights so traffic can shift atomically.”

AWS EKS Advanced

Q231: How do you create Helm release in EKS?

What it is: Helm is a Kubernetes package manager where a chart is a templated collection of manifests that helm install renders and applies.

Why it is used: To install and version third-party cluster components as repeatable releases instead of copying YAML from several projects.

# Add repo
helm repo add nginx-stable https://kubernetes.github.io/ingress-nginx

# Install nginx ingress
helm install nginx-ingress nginx-stable/ingress-nginx \
  --namespace ingress-basic \
  --create-namespace \
  --set controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type="nlb"

# Install Prometheus
helm install prometheus prometheus-community/prometheus \
  --namespace monitoring \
  --create-namespace

Interview talking point: “Annotation keys like service.beta.kubernetes.io/aws-load-balancer-type need their dots escaped with backslashes because Helm splits on dots, and that annotation is how you get an NLB instead of a classic ELB. Use helm upgrade —install as the idempotent form.”

AWS CloudFormation Advanced

Q232: How do you use CloudFormation StackSets for multiple accounts?

What it is: A StackSet instantiates one CloudFormation template across many accounts and regions, service-managed or self-managed.

Why it is used: To enforce a logging, networking or guardrail baseline across every account in an organisation from one place.

# Create stack set
aws cloudformation create-stack-set \
  --stack-set-name org-vpc \
  --template-body file://vpc-template.yaml \
  --permission-model SERVICE_MANAGED \
  --auto-deployment '{
    "Enabled": true,
    "RetainStacksOnAccountRemoval": false
  }'

# Create stacks in accounts
aws cloudformation create-stack-instances \
  --stack-set-name org-vpc \
  --accounts '["111111111111","222222222222"]' \
  --regions '["us-east-1","us-west-2"]' \
  --operation-preferences '{
    "FailureToleranceCount": 1,
    "MaxConcurrentCount": 3
  }'

Interview talking point: “Keep FailureToleranceCount at zero, because a non-zero tolerance leaves some accounts configured and others not, which is worse than a clean failure. Self-managed stack sets need set-configuration before instances deploy, and operation-preferences is where concurrency is controlled.”

AWS CDK

Q233: How do you create VPC with CDK?

What it is: CDK is an infrastructure-as-code framework where you write real programming languages that construct AWS resources and synthesise to CloudFormation.

Why it is used: When raw CloudFormation templates get too verbose for loops, conditionals and reusable components, and you want real code.

# CDK v2 puts every service module at the TOP level.
# `from aws_cdk import core` and the aws_cdk.aws_ec2 path are CDK **v1**
# (deprecated) and raise ModuleNotFoundError on v2.
from aws_cdk import aws_ec2 as ec2
from aws_cdk import Stack as CdkStack

class VpcStack(CdkStack):
    def __init__(self, scope, id, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        vpc = ec2.Vpc(
            self, "MyVPC",
            cidr="10.0.0.0/16",
            max_azs=2,
            nat_gateways=1,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Public",
                    cidr_mask=24,
                    subnet_type=ec2.SubnetType.PUBLIC
                ),
                ec2.SubnetConfiguration(
                    name="Private",
                    cidr_mask=24,
                    subnet_type=ec2.SubnetType.PRIVATE
                )
            ]
        )

Interview talking point: “In CDK v2 you import with from aws_cdk import aws_ec2, because the aws_cdk.aws_ec2 path is v1 style and raises ModuleNotFoundError on v2. The Vpc construct builds subnets, route tables and NAT gateways for you; cdk synth emits the template.”

Q234: How do you create Lambda with CDK?

What it is: A CDK Lambda construct takes code, runtime and handler and synthesises the function, its IAM role, log group and invoke permission.

Why it is used: To define a serverless API where function, API and wiring are one unit of code with inferred IAM policies.

# CDK v2 imports (see Q233 -- `from aws_cdk import core` is v1-only)
from aws_cdk import aws_lambda as _lambda
from aws_cdk import aws_apigateway as apigateway
from aws_cdk import Stack as CdkStack

class LambdaStack(CdkStack):
    def __init__(self, scope, id, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        # Create Lambda
        handler = _lambda.Function(
            self, "MyHandler",
            runtime=_lambda.Runtime.PYTHON_3_9,
            handler="index.handler",
            code=_lambda.Code.from_inline(
                "def handler(event, context): return {'statusCode': 200}"
            )
        )

        # Create API Gateway
        api = apigateway.LambdaRestApi(
            self, "MyApi",
            handler=handler
        )

Interview talking point: “LambdaRestApi with a handler creates the API, the proxy integration and the permission for API Gateway to invoke the function. Code.from_inline is demo-only, real code goes in from_asset, and unlike YAML-based SAM, CDK is a language with loops and types.”

AWS SAM

Q235: How do you create SAM template?

What it is: A SAM template is CloudFormation plus AWS Serverless resource types, expanded by the Transform line at deploy time.

Why it is used: To write serverless applications in YAML with far less boilerplate than raw CloudFormation, declaring routes and permissions.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
Globals:
  Function:
    Runtime: python3.12
    Timeout: 30
    MemorySize: 512

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      # A SAM function needs CodeUri, ImageUri OR InlineCode.
      # Without one the transform fails with:
      #   Resource handler is invalid
      # InlineCode:
      #   def handler(event, context): return {'statusCode': 200}
      CodeUri: lambda/
      Handler: index.handler
      Runtime: python3.12
      Events:
        Api:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: ANY

  MyTable:
    Type: AWS::Serverless::SimpleTable

Interview talking point: “The Transform line AWS::Serverless-2016-10-31 is what makes it SAM, and each Serverless function must have CodeUri, ImageUri or InlineCode, or the transform fails with Resource handler is invalid. Globals sets shared runtime, timeout and memory so you do not repeat them.”

Q236: How do you deploy SAM application?

What it is: The SAM CLI builds each function’s code into a .aws-sam build directory and deploys it through CloudFormation.

Why it is used: To run the exact serverless lifecycle locally and deploy it without separate CloudFormation and build tooling.

# Build
sam build

# Deploy
sam deploy --guided

# Local invoke
sam local invoke MyFunction --event event.json

# Local API
sam local start-api

Interview talking point: “The distinction worth stating is that SAM is a layer over CloudFormation and still deploys through it, whereas CDK is a separate framework that synthesises a template then uses the same deploy path. sam sync gives fast feedback against a real stack.”

AWS Data Pipeline

Q237: How do you create Data Pipeline?

What it is: Data Pipeline was a managed service for defining data movement as a JSON object of data stores and activities.

Why it is used: Historically scheduled ETL between on-premises databases, S3 and DynamoDB, but it reached end of support in November 2024.

# ============================================================================
# DEPRECATED SERVICE. AWS Data Pipeline reached END OF SUPPORT on
# 7 November 2024 and no longer accepts `create-pipeline`.
# Modern equivalents:
#   - AWS Glue            : the ETL jobs themselves
#   - AWS MWAA            : Airflow for orchestration
#   - AWS DMS             : database replication
# ============================================================================

aws glue create-job \
  --name my-etl-job \
  --role arn:aws:iam::123456789012:role/glue-role \
  --command '{"Name":"glueetl","ScriptLocation":"s3://my-bucket/scripts/etl.py"}'

aws glue start-job-run --job-name my-etl-job

Interview talking point: “AWS Data Pipeline reached end of support on 7 November 2024 and no longer accepts create-pipeline. Name Glue for ETL jobs, MWAA for orchestration and DMS for replication as the modern answers instead.”

AWS IoT

Q238: How do you create IoT Thing?

What it is: An IoT thing is the registry entry for a device; a thing type is the blueprint of capabilities and attributes attached to things.

Why it is used: So you can validate incoming messages against a schema and group devices instead of treating each as an anonymous publisher.

# Create thing
aws iot create-thing --thing-name my-device

# Create thing type
aws iot create-thing-type --thing-type-name sensor-type

# Attach thing type
aws iot attach-thing-type --thing-name my-device --thing-type-name sensor-type

Interview talking point: “Creating a thing alone gives a registry entry with no schema, so message validation cannot happen. The thing type, together with the device policy, is what restricts which topics a device may publish and subscribe to, which is the real reason to use types.”

AWS IoT Core Rules

Q239: How do you create IoT rule?

What it is: An IoT rule runs a SQL SELECT over a topic and executes actions whenever a message publishes to a matching topic.

Why it is used: To filter, transform and route device messages inside IoT Core without polling or running a consumer fleet.

# Create rule
aws iot create-topic-rule \
  --rule-name my-rule \
  --topic-rule-payload '{
    "sql": "SELECT * FROM 'devices/+/data'",
    "actions": [{
      "lambda": {
        "functionArn": "arn:aws:lambda:us-east-1:123456789012:function:process-data"
      }
    }]
  }'

Interview talking point: “The topic wildcard plus matches a single level only, so devices/+/data does not match devices/abc/def/data, where you need the hash wildcard. The SQL dialect has no joins or subqueries, and each action target needs a resource policy allowing iot.amazonaws.com.”

AWS SQS Advanced

Q240: How do you use SQS with Lambda?

What it is: An SQS event source mapping polls the queue and invokes your Lambda, making the queue the trigger rather than something the function polls.

Why it is used: To decouple producers from the function and get retries, visibility-timeout handling and backpressure automatically.

# Create queue
QUEUE_URL=$(aws sqs create-queue --queue-name my-queue --query 'QueueUrl' --output text)

# Add permission for Lambda
aws sqs set-queue-attributes \
  --queue-url $QUEUE_URL \
  --attributes '{
    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"},\"Action\":\"sqs:*\",\"Resource\":\"*\"}]}"
  }'

# Create event source mapping
aws lambda create-event-source-mapping \
  --function-name my-function \
  --event-source-arn arn:aws:sqs:us-east-1:123456789012:my-queue \
  --batch-size 10

Interview talking point: “The queue needs a resource policy allowing lambda.amazonaws.com, otherwise the mapping saves but invocations never arrive. Delivery is at-least-once, so keep the function idempotent and use ReportBatchItemFailures to avoid reprocessing succeeded records, with batch sizes up to 10000.”

What it is: SNS invokes a subscribed Lambda on publish, usually wrapping the publish in an SNS envelope event unless configured otherwise.

Why it is used: For fan-out where one event must reach many subscribers, some of which are Lambda functions.

# Create topic
TOPIC_ARN=$(aws sns create-topic --name my-topic --query 'TopicArn' --output text)

# Subscribe Lambda
aws sns subscribe \
  --topic-arn $TOPIC_ARN \
  --protocol lambda \
  --notification-endpoint arn:aws:lambda:us-east-1:123456789012:function:my-function

Interview talking point: “The function must have a resource policy allowing sns.amazonaws.com or the subscription saves and nothing arrives. The payload arrives inside the SNS envelope at event.Message, and setting RawMessageDelivery true gives the raw message but removes the ability to filter on message attributes.”

AWS Kinesis Data Analytics

Q242: How do you create Kinesis Analytics application?

What it is: Kinesis Data Analytics runs SQL or Flink continuously over a stream, writing results to S3, Firehose or another stream.

Why it is used: To compute windowed aggregates, filters and joins on live data without running any infrastructure yourself.

# Create application on the SQL runtime (FLINK_1_11 is retired)
aws kinesisanalyticsv2 create-application \
  --application-name my-analytics \
  --runtime SQL-1_0 \
  --service-execution-role-arn arn:aws:iam::123456789012:role/analytics-role \
  --application-code "
    INSERT INTO DEST_SQL_STREAM_001
    SELECT * FROM SOURCE_SQL_STREAM_001
    WHERE temperature > 50"

# SOURCE_SQL_STREAM_001 / DEST_SQL_STREAM_001 are created implicitly.
# Without an INSERT INTO there is no sink and the app "runs" forever
# producing nothing.

Interview talking point: “Use runtime SQL-1_0, because FLINK_1_11 is retired and rejected, with Flink available only for upgrading existing applications. The code must include an INSERT INTO, otherwise there is no sink and the application sits RUNNING producing nothing.”

AWS Athena

Q243: How do you query data with Athena?

What it is: Athena is serverless SQL over S3: you register a table location and schema in the Data Catalog, then query and pay per TB scanned.

Why it is used: To query logs or Parquet in S3 with SQL, with no warehouse cluster or running infrastructure.

# Create database
aws athena start-query-execution \
  --query-string "CREATE DATABASE IF NOT EXISTS mydb" \
  --query-execution-context DatabaseName=mydb

# Create table
aws athena start-query-execution \
  --query-string "
    CREATE TABLE mydb.s3_logs (
      time STRING,
      method STRING,
      status INT,
      size BIGINT
    )
    ROW FORMAT DELIMITED
    FIELDS TERMINATED BY ','
    LOCATION 's3://my-bucket/logs/'
  " \
  --query-execution-context DatabaseName=mydb

# Query
aws athena start-query-execution \
  --query-string "SELECT * FROM s3_logs WHERE status = 404" \
  --query-execution-context DatabaseName=mydb

Interview talking point: “start-query-execution is asynchronous: you poll get-query-execution for SUCCEEDED, then fetch with get-query-results. Since Athena bills on bytes scanned, partitioning and column projection are the real cost levers, and you must set a query result location bucket.”

AWS QuickSight

Q244: How do you create QuickSight dataset?

What it is: A QuickSight dataset defines data source, query and column types, either imported as a SPICE snapshot or queried live.

Why it is used: So business users build dashboards on your data without anyone hand-writing extracts.

# Create dataset (requires QuickSight console)
# 1. Go to QuickSight
# 2. Datasets → New dataset
# 3. Choose data source (S3, Athena, RDS, etc.)
# 4. Import or direct query
# 5. Visualize

Interview talking point: “Dataset creation is console-driven, with the CLI handling SPICE refreshes and admin tasks. The decision to know is SPICE versus direct query: SPICE copies data for speed but goes stale, while direct query hits the source live and costs per query.”

AWS SageMaker

Q245: How do you create SageMaker notebook?

What it is: A SageMaker notebook instance is a managed EC2 instance with Jupyter, ML libraries and an IAM role, billed like EC2.

Why it is used: For interactive exploration and prototyping before committing to a training job or pipeline.

# Create notebook instance
aws sagemaker create-notebook-instance \
  --notebook-instance-name my-notebook \
  --instance-type ml.t2.medium \
  --role-arn arn:aws:iam::123456789012:role/sagemaker-role

# Start notebook
aws sagemaker start-notebook-instance --notebook-instance-name my-notebook

Interview talking point: “The instance stays Stopped until you call start-notebook-instance, and even a stopped notebook keeps costing because it is still provisioned, so a lifecycle config or scheduled stop is needed to save money. Production work belongs in a training job or pipeline.”

AWS Glue Studio

Q246: How do you create Glue Studio job?

What it is: Glue Studio is Glue’s visual ETL builder where you place sources and transforms on a canvas and it generates the Spark script.

Why it is used: To let analysts build pipelines without writing Spark, while still producing a real script you can version and review.

# Create job (visual)
# Use AWS Glue Console → ETL Jobs → Visual ETL
# Or use Glue Studio API

# Create job via CLI
aws glue create-job \
  --name my-glue-studio-job \
  --role arn:aws:iam::123456789012:role/glue-role \
  --command '{
    "Name": "glueetl",
    "ScriptLocation": "s3://my-bucket/scripts/etl.py"
  }'

Interview talking point: “The underlying resource is the same as a CLI-created job, so you can round-trip: build visually, export the script into version control, or create the job from git-backed code. The role must cover every source and target, so partial failures are usually a role scope problem.”

AWS Lake Formation

Q247: How do you set up Lake Formation?

What it is: Lake Formation sits between the Glue Data Catalog and S3 data, granting permissions per table and column instead of raw bucket access.

Why it is used: To give teams and analytics tools a governed data lake view with column and row level access control.

# Register S3 location
aws lakeformation register-resource \
  --resource-arn arn:aws:s3:::my-data-lake \
  --use-service-linked-role

# Grant permissions
aws lakeformation grant-permissions \
  --principal DataLakePrincipalIdentifier=arn:aws:iam::123456789012:user/john \
  --permissions SELECT \
  --resource '{"Table":{"DatabaseName":"mydb","TableName":"table1"}}'

Interview talking point: “You register the S3 location first, then grant per-table permissions. SELECT on a database grants metadata-only access while SELECT on a table grants data access, letting ETL jobs see schemas without seeing data, though the bucket policy must also allow the Lake Formation service role.”

AWS Redshift

Q248: How do you create Redshift cluster?

What it is: A Redshift provisioned cluster is managed RA3 or DC2 nodes with a leader serving SQL and compute nodes running queries.

Why it is used: For a traditional data warehouse with predictable high-volume BI queries, not sub-second OLTP reads like DynamoDB.

# Create cluster
aws redshift create-cluster \
  --cluster-identifier my-cluster \
  --node-type dc1.large \
  --master-username admin \
  --master-user-password mypassword123 \
  --cluster-type single-node \
  --db-name mydb

Interview talking point: “Create the subnet group and IAM role first, since the cluster only becomes available once those prerequisites exist. Prefer —manage-master-user-password over typing a password on the command line, and RA3 managed storage decouples capacity from compute so nodes can be added without reloading data.”

Q249: How do you resize Redshift cluster?

What it is: Resizing changes a Redshift cluster’s node type or count, with a snapshot taken, new nodes provisioned and swapped in.

Why it is used: To scale compute up for a heavy query period or down to cut cost when idle.

# Resize cluster
aws redshift resize \
  --cluster-identifier my-cluster \
  --cluster-type multi-node \
  --node-type dc2.large \
  --number-of-nodes 3

Interview talking point: “The resize call is asynchronous: the cluster moves through starting, configuring and available, so a script querying immediately sees a non-available cluster. Only one resize can run at a time, and it is rejected if the snapshot or cluster status is unhealthy.”

AWS Elasticsearch

Q250: How do you create Elasticsearch domain?

What it is: An Elasticsearch domain is a managed cluster of search nodes with an EBS-backed data tier and a dedicated master tier.

Why it is used: To run search and log analytics with an open-source engine you control.

# Create domain
aws es create-elasticsearch-domain \
  --domain-name my-domain \
  --elasticsearch-version 7.10 \
  --cluster-config '{
    "InstanceType": "t3.medium.elasticsearch",
    "InstanceCount": 2,
    "DedicatedMasterEnabled": false,
    "ZoneAwarenessEnabled": true
  }' \
  --ebs-options '{
    "EBSEnabled": true,
    "VolumeType": "gp2",
    "VolumeSize": 20
  }'

Interview talking point: “For new domains use aws opensearch create-domain with an OpenSearch engine version, because aws es create-elasticsearch-domain now just creates an OpenSearch-managed domain. Zone awareness requires an even instance count, and without a dedicated master a two-node setup makes a data node double as master.”

AWS OpenSearch

Q251: How do you create OpenSearch domain?

What it is: OpenSearch is AWS’s managed Elasticsearch fork, deployed as a provisioned domain, Serverless collection, or managed cluster for search and log analytics.

Why it is used: Provides search, log analytics, and vector search with an API-compatible migration path from self-managed Elasticsearch.

# Create domain
aws opensearch create-domain \
  --domain-name my-domain \
  --engine-version OpenSearch_1.0 \
  --cluster-config '{
    "InstanceType": "t3.medium.search",
    "InstanceCount": 2,
    "ZoneAwarenessEnabled": true
  }' \
  --ebs-options '{
    "EBSEnabled": true,
    "VolumeType": "gp2",
    "VolumeSize": 20
  }'

Interview talking point: “Instance types use the .search suffix, not .elasticsearch. Without —vpc-options the domain gets a public endpoint, a common security review finding, and creation takes 15 to 30 minutes.”

AWS Macie

Q252: How do you enable Macie?

What it is: Macie discovers and classifies sensitive data in S3, including PII, credentials, and financial data, producing findings per bucket and object.

Why it is used: To learn what sensitive data you hold and whether it is exposed, before compliance asks.

# Enable Macie
aws macie2 enable-macie

# Create classification job
aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --name my-classification-job \
  --s3-job-definition '{
    "bucketDefinitions": [{"accountId":"123456789012","buckets":["my-bucket"]}]
  }'

Interview talking point: “Enable with macie2 enable-macie, then create-classification-job with a bucketDefinitions block. Unlike Macie Classic, Macie 2 scans only specific filtered objects rather than whole buckets, and covers only S3, not EBS or RDS.”

AWS GuardDuty

Q253: How do you enable GuardDuty?

What it is: GuardDuty is agentless threat detection analysing CloudTrail events, VPC Flow Logs, DNS queries, and runtime telemetry, producing severity-ranked findings.

Why it is used: A continuous detective control for compromised credentials, malicious IPs, reconnaissance, and exfiltration with no agents.

# Enable GuardDuty
aws guardduty create-detector \
  --enable

# Create sample findings
aws guardduty create-sample-findings \
  --detector-id detector-id

Interview talking point: “create-detector —enable is all it takes. Use create-sample-findings to test the notification pipeline before an incident, aggregate through organisation delegated admin, and filter by severity or low-severity noise is unusable.”

AWS Security Hub

Q254: How do you enable Security Hub?

What it is: Security Hub aggregates findings from GuardDuty, Inspector, Macie, and IAM Access Analyzer into standards checks like CIS and PCI-DSS.

Why it is used: One compliance dashboard where findings from every service land, instead of checking each separately.

# Enable Security Hub
aws securityhub enable-organization-admin-account --admin-account-id 123456789012

# Enable standards
aws securityhub enable-standards \
  --standards-arn arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0

Interview talking point: “Security Hub detects nothing itself, it only normalises and aggregates. enable-organization-admin-account gives organisation-wide rollup, without it each account has an independent hub, and AWS Config rules can appear as custom controls.”

AWS Detective

Q255: How do you enable Detective?

What it is: Detective builds a graph of AWS entities like accounts, roles, IPs, and instances, plus their relationships, fed by CloudTrail and GuardDuty.

Why it is used: Answers investigations into what an IP touched or who assumed a role, without your own log pipeline.

# Enable Detective
aws detective create-graph

# Create member invitation
aws detective create-members \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph/abc \
  --accounts '[{"AccountId":"123456789012","EmailAddress":"admin@example.com"}]'

Interview talking point: “create-graph then create-members —graph-arn to span the organisation. The graph takes about 48 hours to fill, so it is not for the first minutes of an incident; its edge is one-hop evidence from IP to instance to role.”

AWS Control Tower

Q256: How do you set up Control Tower?

What it is: Control Tower provisions and governs a landing zone across an AWS Organisation: management, log archive, and audit accounts with guardrails.

Why it is used: Creates a governed landing zone with baseline controls and an account model instead of building accounts individually.

# Set up Control Tower (requires console)
# 1. Go to AWS Control Tower console
# 2. Choose "Set up landing zone"
# 3. Configure:
#    - Home region
#    - Shared accounts (management, log archive, audit)
#    - Organization structure
# 4. Review and set up

Interview talking point: “Setup is console-driven. It creates three shared accounts, a workload OU structure, and guardrails as Config rules plus SCPs, either preventive, detective, or both; preventive guardrails apply immediately, so test in a sandbox first.”

AWS Systems Manager Session Manager

Q257: How do you configure Session Manager?

What it is: Session Manager gives shell access to private instances using the SSM agent and an instance profile with AmazonSSMManagedInstanceCore attached.

Why it is used: Shell and port forwarding with no inbound security group rule, and every session recorded in CloudTrail.

# Create IAM role for Session Manager
aws iam create-role \
  --role-name SessionManagerRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "ec2.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

# Attach policy
aws iam attach-role-policy \
  --role-name SessionManagerRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

Interview talking point: “Create the role, attach AmazonSSMManagedInstanceCore, then create-instance-profile, add-role-to-instance-profile, and associate-iam-instance-profile; miss the last and it cannot connect. It is outbound-only, so no port 22 or bastion, and ssm describe-instance-information is the first check.”

AWS Systems Manager Parameter Store

Q258: How do you use Parameter Store for secure strings?

What it is: Parameter Store holds hierarchical config, and a SecureString parameter is KMS-encrypted, returned in plaintext only when decryption is requested.

Why it is used: Application configuration including small credentials, without Secrets Manager’s rotation machinery and per-secret cost.

import boto3
import json

ssm = boto3.client('ssm')

# Create secure string parameter
ssm.put_parameter(
    Name='/myapp/database/password',
    Value='my-secret-password',
    Type='SecureString',
    KeyId='alias/aws/ssm',
    Overwrite=True
)

# Get parameter
response = ssm.get_parameter(
    Name='/myapp/database/password',
    WithDecryption=True
)
password = response['Parameter']['Value']

Interview talking point: “put_parameter with Type=‘SecureString’ and KeyId=‘alias/aws/ssm’ for the AWS-managed key, then get_parameter(WithDecryption=True); decryption calls land in CloudTrail. Parameters are versioned via get-parameter-history, and a repeat put_parameter fails unless Overwrite=True.”

AWS Systems Manager Distributor

Q259: How do you create package in Distributor?

What it is: SSM Distributor packages agent software, scripts, and applications into named, versioned distributions instances install on a schedule or on demand.

Why it is used: Rolls out internal tooling across a fleet with the version control and error reporting patching already has.

# Create package (requires console or API)
# 1. Package name
# 2. Version
# 3. Platform (Windows/Linux)
# 4. Files to include
# 5. Install script
# 6. Associate with instances

Interview talking point: “Create a package with —file-s3-url, —version, and —manifest for Windows or —file-url for Linux, then attach-package or an SSM association. Distributor ships your software, Patch Manager applies vendor OS patches, Run Command runs ad-hoc scripts.”

AWS OpsWorks

Q260: How do you create OpsWorks stack?

What it is: An OpsWorks stack groups layers, instances, configuration, and Chef recipes; opsworks-cm is the newer Chef-based managed version.

Why it is used: For legacy Chef-based configuration management on EC2 instances.

# Create stack
aws opsworks create-stack \
  --name my-stack \
  --region us-east-1 \
  --service-role-arn arn:aws:iam::123456789012:role/opsworks-role \
  --default-instance-profile arn:aws:iam::123456789012:instance-profile/opsworks-ec2-role

Interview talking point: “create-stack needs —service-role-arn and —default-instance-profile, which supplies permissions for every instance’s recipes. OpsWorks is legacy and EC2-only, so the modern answers are OpsWorks CM or Ansible with SSM Run Command.”

AWS AppConfig

Q261: How do you create AppConfig application?

What it is: AppConfig is a config store with environments, configuration profiles, hosted versions, and deployment strategies that roll out gradually with automatic rollback.

Why it is used: Changes production configuration safely with staged rollout and alarm-triggered rollback, instead of a flag baked into a deploy.

# Create application
aws appconfig create-application \
  --name my-app

# Create environment
aws appconfig create-environment \
  --application-id abc123 \
  --name production

# Create configuration profile
aws appconfig create-configuration-profile \
  --application-id abc123 \
  --name my-config \
  --location-uri s3://my-bucket/config.json \
  --type AWS.AppConfig.FreeFormConfiguration

Interview talking point: “The chain is create-application, create-environment, create-configuration-profile —location-uri, create-hosted-configuration-version, start-deployment. Strategies define GrowthFactor and alarms that auto-revert; FreeFormConfiguration takes an S3 URI, FeatureFlag is the other type, and runtime values come from the AppConfig Agent SDK.”

AWS Proton

Q262: How do you create Proton environment?

What it is: Proton provides environment and service templates so platform teams define infrastructure shape and developers get compliant resources automatically.

Why it is used: Standardises environment and service creation so the resulting infrastructure follows security and cost baselines by construction.

# Create environment
aws proton create-environment \
  --name my-env \
  --template-major-version 1 \
  --proton-service-role-arn arn:aws:iam::123456789012:role/proton-role

Interview talking point: “create-environment —template-name —template-major-version, then create-service; Proton renders CloudFormation from both templates. Note the flag is —proton-service-role-arn, not —service-role-arn, and platform teams own environment templates so policy changes propagate to every service.”

AWS Amplify

Q263: How do you create Amplify app?

What it is: Amplify is managed full-stack web hosting that connects a Git repository, builds with a build spec, and serves over HTTPS per branch.

Why it is used: Ships a web frontend with hosting, PR previews, and branch environments without running infrastructure.

# Create app
aws amplify create-app \
  --name my-app \
  --repository https://github.com/user/repo \
  --oauth-token my-oauth-token

Interview talking point: “amplify create-app —name —repository —oauth-token, where the token is a GitHub personal access token, and storing it that way is itself a secret-management smell. Apps get *.amplifyapp.com with a per-branch environment for PR previews.”

AWS App Runner

Q264: How do you create App Runner service?

What it is: App Runner runs a container image or source repo as a managed, autoscaled service behind an HTTPS endpoint with no cluster to manage.

Why it is used: For containerised apps where you want push image, get URL, without operating ECS, EKS, or a load balancer.

# Create service
aws apprunner create-service \
  --service-name my-service \
  --source-configuration '{
    "ImageRepository": {
      "RepositoryUrl": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image",
      "ImageIdentifier": "latest",
      "ImageConfiguration": {"Port": "8080"}
    },
    "AutoDeploymentsEnabled": true
  }' \
  --instance-configuration '{
    "Cpu": "1024", "Memory": "2048"
  }'

Interview talking point: “create-service —source-configuration needs ImageRepository.RepositoryUrl, ImageIdentifier, and ImageConfiguration.Port; a wrong or omitted port means the service starts and never becomes healthy. AutoDeploymentsEnabled deploys on every push, and unlike ECS you manage no instances or security groups.”

AWS Batch

Q265: How do you create Batch compute environment?

What it is: A Batch compute environment is a pool of EC2 or Fargate capacity that job queues pull from, and MANAGED scales it.

Why it is used: Runs bursty scientific, rendering, or high-throughput jobs without keeping an idle cluster between runs.

# Create compute environment
aws batch create-compute-environment \
  --compute-environment-name my-env \
  --type MANAGED \
  --state ENABLED \
  --compute-resources '{
    "type": "FARGATE",
    "maxvCpus": 64,
    "subnets": ["subnet-12345"],
    "securityGroupIds": ["sg-12345"]
  }' \
  --service-role-arn arn:aws:iam::123456789012:role/batch-role

# For type EC2 you must ALSO supply instanceTypes, an ImageIdOverride
# on a newer EC2 AMI, and an ImageOsOverride, plus an EC2_INSTANCE_ROLE:
aws batch create-compute-environment \
  --compute-environment-name my-ec2-env \
  --type MANAGED \
  --compute-resources '{
    "type": "EC2",
    "maxvCpus": 128,
    "instanceTypes": ["m5.large"],
    "subnets": ["subnet-12345"],
    "securityGroupIds": ["sg-12345"],
    "ec2Configuration": [
      {"ImageIdOverride": "ami-0c55b159cbfafe1f0", "ImageOsOverride": "AL2"}
    ],
    "ec2ConfigurationSupported": true
  }' \
  --service-role-arn arn:aws:iam::123456789012:role/batch-role

Interview talking point: “create-compute-environment —type MANAGED —compute-resources with —service-role-arn. EC2 additionally needs instanceTypes, ec2Configuration with ImageIdOverride, and an instance role or it fails. Capacity only exists once a job queue references it through compute-environment-order, and idle capacity costs nothing.”

Q266: How do you create Batch job queue?

What it is: A Batch job queue holds pending jobs and dispatches them to compute environments in a configured priority and fallback order.

Why it is used: Prioritises work and queues submissions when no compute capacity is available.

# Create job queue
aws batch create-job-queue \
  --job-queue-name my-queue \
  --priority 100 \
  --compute-environment-order '[{"computeEnvironment": "my-env","order": 1}]'

Interview talking point: “create-job-queue —priority with —compute-environment-order; higher priority numbers are served first. The order list is a fallback chain, so jobs spill from Fargate to spot EC2, and you submit with submit-job. Job definitions, not jobs, are what you version.”

AWS Lightsail

Q267: How do you create Lightsail instance?

What it is: Lightsail instances are simple, fixed-price compute bundles with a blueprint, built-in firewall, and static IP option.

Why it is used: For small workloads, demos, or low-traffic services where simplicity beats EC2’s control.

# Create instance
aws lightsail create-instances \
  --instance-name my-instance \
  --availability-zone us-east-1a \
  --blueprint-id ubuntu_20_04 \
  --bundle-id medium_2_0

Interview talking point: “create-instances takes —blueprint-id and —bundle-id, not an instance type, because bundles are fixed size tiers. Most VPC features do not apply, and the classic mistake is expecting IAM instance roles to work as they do on EC2.”

AWS Global Accelerator

Q268: How do you create Global Accelerator?

What it is: Global Accelerator gives anycast IPs, routes traffic to the nearest healthy regional endpoint, and adds connection metrics and fast failover.

Why it is used: For multi-region TCP and UDP services needing fast failover where Route 53 DNS failover is too slow.

# Create accelerator
aws globalaccelerator create-accelerator \
  --name my-accelerator

# Create listener
aws globalaccelerator create-listener \
  --accelerator-arn arn:aws:globalaccelerator::123456789012:accelerator/abc \
  --protocol TCP \
  --port-range '[{"FromPort": 80,"ToPort": 80}]'

# Create endpoint group
aws globalaccelerator create-endpoint-group \
  --listener-arn arn:aws:globalaccelerator::123456789012:listener/xyz \
  --endpoint-group-region us-east-1 \
  --traffic-dial-percentage 100

Interview talking point: “create-accelerator, then create-listener with protocol and port range, then create-endpoint-group. Endpoints must be static IPs or an NLB, since it does not front an ALB. Health checks run every 10 seconds with traffic shifting in about a minute.”

AWS DataSync

Q269: How do you create DataSync task?

What it is: DataSync moves data between on-premises storage and AWS at scale using agents for sources, with S3 the usual destination.

Why it is used: Bulk migration and ongoing sync of NAS, SMB, NFS, or Hadoop file data without writing transfer tooling.

# Create location (source)
aws datasync create-location-smb \
  --server-hostname my-server.example.com \
  --subdirectory /share \
  --agent-arn arn:aws:datasync:us-east-1:123456789012:agent/agent-id

# Create location (destination)
aws datasync create-location-s3 \
  --s3-bucket-arn arn:aws:s3:::my-bucket \
  --s3-config '{
    "BucketAccessRoleArn": "arn:aws:iam::123456789012:role/datasync-role"
  }'

# Create task
aws datasync create-task \
  --source-location-arn source-arn \
  --destination-location-arn dest-arn

Interview talking point: “Three steps: create-location for source, create-location-s3 with a BucketAccessRoleArn, then create-task. SMB needs an agent-arn because DataSync reads through it, so a public share alone will not work, and ChangeOverlappingMode is SKIP or OVERWRITE.”

AWS Migration Hub

Q270: How do you create Migration Hub application?

What it is: Migration Hub’s application registry grouped discovered resources into applications so you could plan and track migration waves.

Why it is used: Migration planning through inventory, dependency mapping, and wave planning before choosing how each workload moves.

# Create application
aws migrationhub create-application \
  --name my-application \
  --description "My migration application"

Interview talking point: “The Migration Hub portfolio model closed on 30 June 2024. New work uses AWS Application Migration Service (aws mgn) to perform migrations and aws discovery for discovery, and saying that beats reciting the command.”

AWS Application Discovery Service

Q271: How do you enable Agentless Discovery?

What it is: Agentless discovery uses connectors and network probes to observe workloads without installing anything on the servers.

Why it is used: Inventories VMware, Hyper-V, or bare-metal estates where installing an agent is not possible.

# There is NO `start-agentless-connection` API. Running it fails with:
#   An error occurred (InvalidAction): Could not find operation
#   startAgentlessConnection for version 2015-11-01
#
# The real operations:

# One-off agent-based discovery
aws discovery create-invocation-configuration \
  --configuration-name my-invocation \
  --agent-ids "i-1234567890abcdefg"

aws discovery start-invocation \
  --configuration-id ic-12345 \
  --ids '["i-1234567890abcdefg"]'

# Continuous agent
aws discovery create-continuous-discovery \
  --configuration-name my-continuous

# Agentless: import an existing inventory file
aws discovery start-import-task \
  --import-task-config '{
    "ImportTaskId": "it-1234",
    "Source": {"S3BucketName": "discovery-bucket", "S3ObjectKey": "inventory.json"}
  }' \
  --name my-import

Interview talking point: “Correction: start-agentless-connection is not a real API and fails with InvalidAction. Real operations are create-invocation-configuration plus start-invocation, create-continuous-discovery, and start-import-task to bring in an inventory file from ServiceNow or vCenter.”

AWS Database Migration Service

Q272: How do you create DMS replication instance?

What it is: A DMS replication instance is a managed host running replication, consuming tasks that each define source, target, and table mappings.

Why it is used: Ongoing database replication to a new instance or between on-premises and RDS with minimal downtime using CDC.

# Create replication instance
aws dms create-replication-instance \
  --replication-instance-identifier my-replica \
  --replication-instance-class dms.t3.medium \
  --allocated-storage 50 \
  --vpc-security-group-ids sg-12345 \
  --availability-zone us-east-1a

Interview talking point: “create-replication-instance needs —replication-instance-class and —allocated-storage, and takes minutes to become available. Each instance caps task count, so large migrations use several. The three types are full load, full load plus CDC, and CDC only; CDC enables near-zero downtime.”

AWS Schema Conversion Tool

Q273: How do you assess schema conversion?

What it is: The Schema Conversion Tool connects source and target databases and reports how well a schema converts, categorised by resolution effort.

Why it is used: Estimates migration effort before committing, especially Oracle to RDS or SQL Server to RDS.

# Create assessment (requires SCT tool installation)
# 1. Connect to source database
# 2. Select schema to assess
# 3. Run assessment
# 4. View conversion report

Interview talking point: “SCT is a desktop tool, not a CLI service, so no aws sct commands exist; you download it, run an assessment, then a conversion. The manual-action count is your risk estimate, and it pairs with DMS for data movement.”

AWS Transfer Family

Q274: How do you create SFTP server?

What it is: Transfer Family provides a managed SFTP, FTPS, or FTP server fronting S3, with IAM or custom identity provider authentication.

Why it is used: Partner, customer, or legacy file transfer into S3, replacing the EC2 instances you would otherwise run.

# Create server
aws transfer create-server \
  --identity-provider-type SERVICE_MANAGED \
  --protocols SFTP \
  --endpoint-type PUBLIC

# Create user
aws transfer create-user \
  --server-id s-1234567890abcdef0 \
  --user-name myuser \
  --role arn:aws:iam::123456789012:role/transfer-role \
  --home-directory /my-bucket/myuser \
  --ssh-public-key-body "ssh-rsa AAAAB..."

Interview talking point: “create-server —identity-provider-type SERVICE_MANAGED —protocols SFTP, then create-user with —role, —home-directory, and —ssh-public-key-body. That per-user role is the entire security model, the home directory acts as a chroot, and VPC endpoints keep the server in your subnets.”

AWS Elemental MediaConvert

Q275: How do you create MediaConvert job?

What it is: MediaConvert is managed file transcoding that turns media input into outputs like HLS, MP4, thumbnails, and audio renditions.

Why it is used: Video and audio pipelines at scale, with a queue that absorbs bursts and allows retries.

# Create job (requires console or API)
aws mediaconvert create-job \
  --role arn:aws:iam::123456789012:role/mediaconvert-role \
  --settings '{
    "OutputGroups": [{
      "Name": "File Group",
      "OutputGroupSettings": {
        "Type": "FILE_GROUP_SETTINGS",
        "FileGroupSettings": {"Destination": "s3://output-bucket/"}
      }
    }],
    "Inputs": [{
      "FileInput": "s3://input-bucket/video.mp4"
    }]
  }'

Interview talking point: “create-job —role —settings with OutputGroups, OutputGroupSettings, and Inputs.FileInput. Queue it with —status QUEUED, because a synchronous call blocks on the encode and times out; every output needs a NameModifier or later ones overwrite earlier.”

AWS Elemental MediaLive

Q276: How do you create MediaLive channel?

What it is: MediaLive runs a live video pipeline of inputs, transcoding, and outputs feeding MediaPackage or a CDN.

Why it is used: Live streaming ingest using a managed encoder instead of running your own.

# Create channel
aws medialive create-channel \
  --channel-class SINGLE_PIPELINE \
  --input-specification '{
    "Codec": "AVC",
    "Resolution": "HD",
    "MaximumBitrate": "MAX_10_MBPS"
  }' \
  --name my-channel

Interview talking point: “create-channel —channel-class SINGLE_PIPELINE for basic use, STANDARD for ad insertion, plus a channel role and destinations. MediaLive outputs a transport stream, not playable HLS, so you still need MediaPackage, and a channel with no outputs does nothing.”

AWS IoT Analytics

Q277: How do you create IoT Analytics dataset?

What it is: IoT Analytics stores device time-series data in a datastore, and datasets run SQL over it with delivery actions.

Why it is used: Aggregates, filters, and acts on device data at scale without building a stream-processing cluster.

# Create datastore
aws iotanalytics create-datastore \
  --datastore-name my-datastore

# Create dataset
aws iotanalytics create-dataset \
  --dataset-name my-dataset \
  --actions '[{
    "ActionName": "query-action",
    "QueryAction": {"SqlQuery": "SELECT * FROM my_datastore"}
  }]'

Interview talking point: “create-datastore, then create-dataset with a QueryAction SQL string. Cost control is —retention-days up to 3650 and —customer-managed-s3-storage; SELECT * over a raw high-rate feed is the classic way to get an unexpected bill.”

AWS IoT Events

Q278: How do you create IoT Events detector?

What it is: IoT Events is a state machine service for devices, where a detector model’s states and transitions evaluate JSON input.

Why it is used: Expresses operational logic like a valve open over 30 seconds raising an alarm, declaratively.

# Create input
aws iotevents create-input \
  --input-name my-input \
  --input-definition '{
    "attributes": [{"jsonPath": "temperature"}]
  }'

# Create detector model
aws iotevents create-detector-model \
  --detector-model-name my-detector \
  --detector-model-definition '{
    "states": [{
      "stateName": "Normal",
      "onInput": {"events": []}
    }]
  }'

Interview talking point: “create-input declares JSON paths, then create-detector-model with states having onInput and onExit, and actions to Lambda, SNS, DynamoDB, or SQS. It fits device state logic and not data processing, which IoT Analytics or IoT Core rules handle.”

AWS IoT SiteWise

Q279: How do you create IoT SiteWise asset?

What it is: IoT SiteWise models physical assets as hierarchies of asset models, assets, and properties for industrial telemetry.

Why it is used: Collects industrial telemetry into a consistent model and queries fleet performance over time.

# Create asset model
aws iotsitewise create-asset-model \
  --asset-model-name my-model \
  --asset-model-properties '[{
    "name": "Temperature",
    "dataType": DOUBLE,
    "unit": "celsius"
  }]'

# Create asset
aws iotsitewise create-asset \
  --asset-model-id model-id \
  --asset-name my-asset

Interview talking point: “create-asset-model defines properties and hierarchy, then create-asset instantiates it with children attaching to parents. Property dataType is SCALAR, INTEGER, or BOOLEAN, newer versions accepting DOUBLE, and units let you aggregate across unlike assets; built-in alarms replace custom dashboards.”

AWS RoboMaker

Q280: How do you create RoboMaker simulation?

What it is: A RoboMaker simulation application packages a simulation binary and robot software suite, then runs headless Gazebo simulations in the cloud.

Why it is used: Trains and tests robot software against many simulated worlds in parallel instead of one laptop.

# Create simulation application
aws robomaker create-simulation-application \
  --name my-simulation \
  --sources '[{"s3Bucket":"my-bucket","s3Key":"simulation.tar.gz"}]' \
  --robot-software-suite '{
    "name": "ROS2",
    "version": "Humble"
  }'

# Valid name/version pairs are ROS2 + (Galactic|Humble|Iron|Jazzy) or
# ROS1 + (Melodic|Noetic). "Kinetic" is rejected with a ValidationException.

Interview talking point: “create-simulation-application —sources —robot-software-suite with the archive in S3. Valid suites are ROS1 (Melodic, Noetic) or ROS2 (Galactic, Humble, Iron, Jazzy), and Kinetic is rejected with a ValidationException. Simulation, Fleet Simulation, and Container are distinct services.”

AWS Ground Station

Q281: How do you configure Ground Station?

What it is: Ground Station manages satellite telemetry downlink and command uplink, with missions and dataflow endpoints representing your ground equipment.

Why it is used: Lets satellite operators downlink telemetry and uplink commands without owning ground station hardware.

# Create config
# The CLI flags are HYPHENATED. Passing camelCase fails with:
#   Unknown options: --dataflowEndpointConfig, --dataflowEndpointRegion
aws groundstation create-config \
  --config-type dataflow-endpoint \
  --name my-endpoint-config \
  --dataflow-endpoint-config '{
    "dataflowEndpointName": "my-endpoint"
  }'

aws groundstation create-config \
  --config-type dataflow-endpoint-group \
  --name my-group \
  --dataflow-endpoint-group-config '{
    "dataflowEndpointGroupName": "my-group",
    "dataflowEndpointConfigArn": "cfg-0123456789abcdef0"
  }'

aws groundstation create-mission \
  --name my-mission \
  --dataflow-endpoint-group-config-arn cfg-9876543210fedcba

Interview talking point: “CLI flags are hyphenated: —dataflow-endpoint-config, not camelCase —dataflowEndpointConfig, which fails with Unknown options. The sequence is create-config for the endpoint, create-config for the endpoint group, then create-mission, and commands only deliver within the satellite’s contact window.”

AWS Outposts

Q282: How do you order Outposts?

What it is: Outposts is rack-scale AWS hardware deployed in your data centre, giving compute, storage, and networking with a local AZ.

Why it is used: For latency-sensitive workloads where the round trip to a region is unacceptable, like retail edge.

# Create outpost (requires Outposts console)
# 1. Go to AWS Outposts console
# 2. Create Outpost
# 3. Choose instance type
# 4. Choose location
# 5. Place order

Interview talking point: “Ordering is commercial, not an API: you buy hardware, AWS installs it, and it arrives with an AvailabilityZone and OutpostId. You still get one AZ and one account boundary, trading data locality for dependence on a single rack.”

AWS Local Zones

Q283: How do you use Local Zones?

What it is: A Local Zone is an AWS mini-region, an AZ-like deployment of a subset of services inside a metro area.

Why it is used: Runs latency-sensitive compute near users where a full region is too far away.

# STEP 1 (missed by the original): the account must be SUBSCRIBED to the
# zone. Without this, run-instances into the zone fails and the subnet
# cannot be created.
aws ec2 create-local-zone-group \
  --group-name my-local-zones \
  --zone-name us-east-1-bos-1-lax-1-az

aws ec2 describe-local-zones \
  --zone-name us-east-1-bos-1-lax-1-az \
  --query 'ZoneState.{State:state,Name:name}'

# STEP 2: make the subnet internet-reachable if needed
aws ec2 modify-subnet-attribute \
  --subnet-id subnet-12345 \
  --map-public-ip-on-launch

# Create instance in Local Zone
aws ec2 run-instances \
  --image-id ami-12345 \
  --instance-type t3.medium \
  --subnet-id subnet-in-local-zone

Interview talking point: “First step people miss: the account must be subscribed with create-local-zone-group —group-name —zone-name, or run-instances and subnet creation fail. Only a subset of instance types and services is offered, so some run-instances calls get rejected.”

AWS Wavelength

Q284: How do you deploy to Wavelength Zone?

What it is: Wavelength Zones are 5G carrier-edge AZs deployed at telco locations with direct backhaul to the mobile core.

Why it is used: Ultra-low-latency mobile workloads like AR, VR, and edge ML where mobile-user latency dominates.

# The account must have the Wavelength Zone enabled (carrier partner +
# AWS onboarding), and the AZ must appear in describe-availability-zones
# before this succeeds.
aws ec2 describe-availability-zones \
  --query 'AvailabilityZones[?ZoneName==`us-east-1-wl1-wlz-1`].{Name:ZoneName,Type:ZoneType}'

# Create subnet in the Wavelength Zone
aws ec2 create-subnet \
  --vpc-id vpc-123 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1-wl1-wlz-1

# Deploy to Wavelength Zone
aws ec2 run-instances \
  --image-id ami-12345 \
  --instance-type t3.medium \
  --subnet-id subnet-in-wavelength-zone

Interview talking point: “Zones are named like us-east-1-wl1-wlz-1 and you create-subnet against that AZ, but the account needs carrier-partner onboarding first, since you cannot provision one standalone. Traffic to the parent region crosses the carrier network, not the internet.”

AWS Application Composer

Q285: How do you use Application Composer?

What it is: Application Composer is a visual drag-and-drop tool generating SAM templates and CDK applications for serverless and container apps.

Why it is used: Lets non-specialists assemble apps from vetted components, or gives a starting point to edit as code.

# Use Application Composer (console-based)
# 1. Go to AWS Application Composer console
# 2. Create new application
# 3. Drag and drop components
# 4. Configure connections
# 5. Generate SAM or CDK template

Interview talking point: “It is console-driven and not a runtime: it produces infrastructure-as-code you take away and own in git, reviewing and deploying through CI. Its value is a curated catalogue of approved Lambda, API Gateway, and DynamoDB patterns.”

AWS Clean Rooms

Q286: How do you create Clean Rooms collaboration?

What it is: Clean Rooms lets multiple parties run SQL analytics over a shared dataset without seeing each other’s raw data.

Why it is used: Collaborative analysis where raw data must never leave its owner, like providers sharing with partners.

# Create clean room
aws cleanrooms create-collaboration \
  --name my-collaboration \
  --member-capabilities '{
    "canQuery": true,
    "canReceiveResults": true
  }'

Interview talking point: “create-collaboration —name —member-capabilities with canQuery and canReceiveResults, then invite members and create-configured-table and create-analysis-rule. Per-member SQL policies are evaluated against every query, so unlike a shared S3 bucket no member gets direct data access.”

AWS HealthOmics

Q287: How do you use HealthOmics?

What it is: HealthOmics stores and analyses genomic data in purpose-built reference, variant, and annotation stores, with workflows for processing.

Why it is used: Genomic data at petabyte scale with the storage and query patterns genomics specifically needs.

# Create reference store
aws omics create-reference-store \
  --name my-reference-store

# Create variant store
aws omics create-variant-store \
  --name my-variant-store

Interview talking point: “omics create-reference-store and create-variant-store ingest from S3. Reference stores hold immutable genomes, variant stores support variant query, annotation stores hold annotations, sequence stores hold raw reads, and reads go through StartReadSetReadJob signed URLs.”

AWS Supply Chain

Q288: How do you set up AWS Supply Chain?

What it is: AWS Supply Chain is a managed planning application for demand forecasting, supply planning, and insights over ERP and S3 data.

Why it is used: Gets supply chain planning without running and integrating a dedicated planning system.

# Set up AWS Supply Chain (requires console)
# 1. Go to AWS Supply Chain console
# 2. Create supply chain instance
# 3. Connect data sources
# 4. Configure users and permissions

Interview talking point: “Console-driven: create the instance, then connectors for SAP, Oracle, SQL Server, and Salesforce. Its value is the planning models, not ingestion, and for general demand forecasting the broader answer is Glue plus SageMaker.”

AWS SimSpace Weaver

Q289: How do you create SimSpace Weaver app?

What it is: SimSpace Weaver runs physics-based 3D simulations in managed cloud containers you supply as the simulation code.

Why it is used: Runs computationally expensive simulations that a workstation cannot handle, as managed containerised jobs.

# Create simulation app
aws simspaceweaver create-simulation \
  --name my-simulation \
  --role-arn arn:aws:iam::123456789012:role/simulation-role

Interview talking point: “simspaceweaver create-simulation —name —role-arn uploads containers, then start-simulation runs it with results in S3. The lifecycle is Create, Start, Stop, Delete only, and the real integration work is your container accepting Weaver’s inputs and writing outputs where it expects.”

AWS IoT Express

Q290: How do you use IoT Express?

What it is: AWS IoT Wireless provisions and manages LoRaWAN and Zigbee devices through network, device, and service profiles plus a destination.

Why it is used: For low-power, long-range fleets of cheap devices with no onboard compute, like meters and trackers.

# Create wireless device
aws iotwireless create-wireless-device \
  --type LoRaWAN \
  --lorawan-device '{
    "DevEui": "0011223344556677",
    "ProfileId": "profile-id"
  }'

Interview talking point: “iotwireless create-wireless-device —type LoRaWAN needs a ProfileId defining LoRaWAN version, region, and join or ABP, plus a network profile and destination. LoRaWAN is uplink-only while Zigbee is mains-powered and bidirectional, so device type dictates fleet design.”

AWS Private 5G

Q291: How do you create Private 5G network?

What it is: Private 5G gives a dedicated, isolated on-premises 5G network with AWS-managed radio hardware and a local or edge core.

Why it is used: Industrial, retail, and campus sites needing deterministic low latency and isolated cellular coverage over large areas.

# Create network
aws private5g create-network \
  --network-name my-network \
  --type FULL

Interview talking point: “private5g create-network —network-name —type FULL, then create-network-site, create-device, and the missed step update-network-site attaching radio units for coverage. FULL runs the core on premises while PARTIAL uses AWS-hosted, and traffic lands on a network slice or your VPC.”

AWS End-of-Support Migration Program

Q292: How do you migrate from Windows Server 2008?

What it is: The End-of-Support Migration Program assesses and migrates workloads on unsupported systems like Windows Server 2008 and SQL Server 2008.

Why it is used: Moves the legacy estate that would otherwise become unsupported, insecure, and unpatchable.

# The CLI prefix is `aws discovery` (Application Discovery Service).
# `aws application-discoverer start-assessment` fails with InvalidAction.

# Inventory the estate first
aws discovery list-agents

aws discovery start-import-task \
  --import-task-config '{
    "ImportTaskId": "it-1234",
    "Source": {"S3BucketName": "discovery-bucket", "S3ObjectKey": "inventory.json"}
  }' \
  --name legacy-estate

# Then migrate each server with Application Migration Service
aws mgn create-application \
  --name my-app \
  --description "legacy migration"

aws mgn start-discovery --application-id mgn-app-0123456789abcdef

Interview talking point: “The CLI prefix is aws discovery, not application-discoverer, where start-assessment fails with InvalidAction. The flow is discovery agents to inventory, identify legacy OS versions, then aws mgn per server, with software composition analysis as the key phrase.”

AWS Elasticache Serverless

Q293: How do you create ElastiCache Serverless?

What it is: ElastiCache Serverless is a cache endpoint that scales automatically with no nodes, clusters, shards, or backups to manage.

Why it is used: For variable caching workloads where provisioning and scaling a Redis or Memcached cluster would be most of the work.

# --cache-usage-limits is REQUIRED; omitting it fails validation
aws elasticache create-serverless-cache \
  --serverless-cache-name my-cache \
  --engine redis \
  --cache-usage-limits 'CacheUsageLimits={DataStorage={Maximum=100,Unit=GB},ECPUPerSecond={Maximum=15000}}' \
  --description "serverless redis"

aws elasticache describe-serverless-caches \
  --serverless-cache-name my-cache \
  --query 'ServerlessCaches[].{Status:Status,Conn:Endpoint.Address}'

Interview talking point: “create-serverless-cache requires —cache-usage-limits with DataStorage and ECPUPerSecond maximums, and omitting it fails validation. Billing is ECPU-seconds plus storage, and you give up persistence configuration, replication, and multi-AZ failover, so it is wrong for a cache that must never lose data.”

AWS OpenSearch Serverless

Q294: How do you create OpenSearch Serverless collection?

What it is: An OpenSearch Serverless collection is an auto-scaling search or vector index behind a SigV4-signed endpoint, with no instances or shards.

Why it is used: Vector search, semantic search, and logging where you want an index without sizing or running a cluster.

# An ENCRYPTION POLICY is required or the collection fails to create
aws opensearchserverless create-security-policy \
  --name my-enc \
  --type encryption \
  --policy '{
    "Rules": [{"ResourceType": "collection", "Resource": ["collection/my-collection"]}],
    "AWSOwnedKey": true
  }'

# Use --type VECTOR for k-NN / vector search. A SEARCH collection
# cannot serve vector queries.
aws opensearchserverless create-collection \
  --name my-collection \
  --type VECTOR \
  --encryption-policy-name my-enc

Interview talking point: “create-collection takes —type SEARCH or VECTOR, and VECTOR is required for k-NN, since a SEARCH collection cannot serve vector queries. An encryption policy is required or creation fails, and access is via VPC endpoint with a resource policy, never a public endpoint.”

AWS Redshift Serverless

Q295: How do you create Redshift Serverless namespace?

What it is: A Redshift Serverless namespace is isolated, auto-scaling Redshift query compute sized in Redshift Processing Units, with no clusters to provision.

Why it is used: For intermittent or variable analytics where round-the-clock provisioned nodes would dominate cost.

# A namespace must belong to a WORKGROUP -- without it this fails
aws redshift create-namespace \
  --namespace-name my-namespace \
  --workgroup my-workgroup \
  --admin-username admin \
  --admin-user-password 'use-a-secret-manager-value-not-the-cli'

# The workgroup owns the autoscaling policy / RPU limits
aws redshift modify-workgroup \
  --workgroup my-workgroup \
  --autoscaling '{"MaxCapacity": 64}' \
  --manage-master-user-password

Interview talking point: “create-namespace requires —workgroup, which owns the autoscaling policy and RPU limits. Passing —admin-user-password on the CLI leaks a secret into shell history, so create the admin separately with create-user; data lives in S3 and computes only at query time.”

Additional Interview Questions 296-400

Q296: How do you secure EC2 instances?

What it is: Securing EC2 means layering controls: private placement, security groups, an IAM instance profile, encrypted storage, IMDSv2, and patching.

Why it is used: The practical layering answer for making an EC2 instance safe to put in production.

Use Security Groups
Enable VPC
Use IAM roles
Enable CloudWatch monitoring
Regular patching

Interview talking point: “Order by impact: private subnet with no public IP, least-privilege security groups, IAM role over static keys, encrypted EBS, IMDSv2 required, then patching. Session Manager removes port 22 entirely, and —metadata-options http-tokens required blocks SSRF-to-credentials pivots; CloudWatch is observability, not security.”

Q297: What is the difference between EBS and Instance Store?

What it is: EBS is a network-attached volume persisting independently of the instance; instance store is host-local storage discarded when the instance stops.

Why it is used: The choice decides whether data survives a reboot and whether it can be snapshotted or encrypted independently.

EBS: persistent, network-attached
Instance Store: local, temporary

Interview talking point: “Instance store data is physically gone on stop, terminate, or host failure, with no snapshots or separate encryption, which is why it suits only scratch caches; it exists for lower latency. EBS gp3 with 3000 IOPS covers most former NVMe use.”

Q298: How do you backup RDS?

What it is: RDS offers automated backups with transaction logs for point-in-time recovery, manual snapshots, and cross-region snapshot copies.

Why it is used: Recovers the database from corruption, accidental deletion, or a bad migration against a stated RPO.

Automated backups
Manual snapshots
Cross-region replication

Interview talking point: “Automated backups retain 0 to 35 days, default 1, and log retention is the PITR window; snapshots are kept until deleted and restore to a new instance; read replicas are live copies, not backups. The missed setting is BackupRetentionPeriod.”

Q299: What is S3 lifecycle policy?

What it is: An S3 lifecycle configuration transitions objects between storage classes and expires them based on age or size, evaluated daily.

Why it is used: Cuts S3 cost and enforces retention automatically instead of running scheduled move scripts.

Automates object transitions
Move to IA, Glacier
Expiration rules

Interview talking point: “put-bucket-lifecycle-configuration with Transitions and Expiration. IA classes have a 128 KB minimum object size, so small files cost more transitioned; the first 30 days of IA are not billed, and noncurrent versions need their own NoncurrentVersionExpiration rule.”

Q300: How do you secure S3 bucket?

What it is: Securing an S3 bucket means four Block Public Access settings, enforced bucket ownership, a least-privilege policy, default encryption, and versioning.

Why it is used: Makes a bucket private by default rather than trusting every client to send correct headers.

Block public access
Enable encryption
Use bucket policies
Enable versioning
Enable MFA Delete

Interview talking point: “All four Block Public Access settings must be on: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets. BucketOwnerEnforced kills ACLs as a second path to public, and policies scope as bucket/* for objects and bucket for ListBucket; server access logs record requests, not API calls.”

Questions 301-400 continue with more advanced topics and hands-on scenarios…