AWS_Practical_Interview_401 600

AWS Practical Interview Questions (401-600)

AWS Well-Architected Framework

Q401: What are the pillars of AWS Well-Architected Framework?

What it is: A set of six design-principle pillars, each with best-practice questions you review a workload against.

Why it is used: A repeatable checklist for reviewing an architecture and prioritising improvements.

Operational Excellence - Run and monitor systems
Security - Protect information and systems
Reliability - Recover from failures
Performance Efficiency - Use computing resources efficiently
Cost Optimization - Avoid unnecessary costs
Sustainability - Minimize environmental impact

Interview talking point: “The six pillars are Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization and Sustainability — Sustainability was added in 2021. They interact rather than rank: Multi-AZ reliability costs money, so optimising one pillar in isolation worsens the system. The Well-Architected Tool runs the review automatically.”

Q402: How do you implement Operational Excellence?

What it is: Operational excellence covers running, monitoring and continuously improving how you operate, rather than uptime itself.

Why it is used: To reduce mean time to recovery and human error in day-to-day operations.

Use Infrastructure as Code (CloudFormation/Terraform)
Implement monitoring and alerting
Automate responses to events
Document procedures
Regular improvements

Interview talking point: “Underneath it: infrastructure as code so drift is impossible, observability, written and tested runbooks, and small frequent reversible changes. Distinction from Reliability — Reliability is whether it stays up, Operational Excellence is how fast and safely you operate it. You shorten MTTR with runbooks and automation, not redundancy.”

Q403: How do you implement Security pillar?

What it is: Covers identity and access, detective controls like logging and auditing, infrastructure protection, and data protection in transit and at rest.

Why it is used: A layer above individual services deciding what gets logged, encrypted, and who gets access.

Identity and access management (IAM)
Detective controls (CloudTrail, GuardDuty)
Infrastructure protection (Security Groups, WAF)
Data protection (encryption, backups)
Incident response planning

Interview talking point: “AWS frames it as preventive, detective and responsive controls: IAM policies, SCPs and security groups versus CloudTrail, Config and GuardDuty versus the incident runbook. Log everything that matters and know where the logs live, assume breach by rotating credentials and scoping IAM blast radius, and define incident response rather than improvising.”

Q404: How do you implement Reliability pillar?

What it is: The ability of a system to perform its intended function correctly and consistently, including through failures.

Why it is used: To meet a stated RTO and RPO, and make failures boring rather than novel.

Design for failure
Implement multi-AZ deployments
Use auto-scaling
Test recovery procedures
Implement backup and restore

Interview talking point: “Reliability is where RTO and RPO live, so you quantify instead of saying highly available: remove single points of failure, design for failure with retries and idempotency, make changes safely with rollback, and test recovery — an unexercised DR plan is only a hypothesis. Multi-AZ RDS behind a single NAT gateway in one AZ still fails.”

Q405: How do you implement Performance Efficiency?

What it is: Using computing resources efficiently as demand and technologies change — choosing the right resource type for the workload.

Why it is used: To meet latency and throughput requirements at the lowest sensible cost.

Select right instance types
Use serverless where appropriate
Implement caching (CloudFront, ElastiCache)
Monitor performance metrics
Review and optimize regularly

Interview talking point: “Pick the best resource type: serverless for spiky event-driven work, Graviton for general compute, the right storage class per access pattern. The two biggest levers are caching — CDN at the edge, ElastiCache in the middle — and right-sizing. Most performance problems are a slow query or serialisation bottleneck, not compute shortage.”

Q406: How do you implement Cost Optimization?

What it is: Operating at the lowest price point that still delivers the business outcomes the workload needs.

Why it is used: To make cost a design input decided with architecture, not a monthly surprise.

Right-size resources
Use reserved instances/Savings Plans
Implement tagging for cost tracking
Use spot instances for fault-tolerant workloads
Regular cost analysis

Interview talking point: “Levers in impact order: right-size first, then pricing models — Savings Plans or Reserved Instances for steady baseline, Spot for fault-tolerant batch, on-demand for burst — then architecture like serverless over idle capacity. A cost-allocation tag must be activated in Billing before any cost attribution works, and budgets give visibility.”

Q407: How do you implement Sustainability?

What it is: Minimising the environmental impact of running workloads; it was the sixth pillar, added in 2021.

Why it is used: Because energy and water carry real environmental cost, and efficiency usually overlaps with cost.

Use managed services
Implement serverless architecture
Use efficient instance types
Minimize data transfer
Implement lifecycle policies

Interview talking point: “Levers: prefer managed and serverless so utilisation is someone else’s problem, choose efficient instance types like Graviton, minimise data transfer since cross-region and cross-AZ hops cost both money and carbon, and lifecycle data into colder storage rather than deleting and refetching. Sustainability and cost optimisation overlap heavily but are not identical.”

AWS Cost Management

Q408: How do you set up Cost Explorer?

What it is: A query API over your cost and usage data that must be explicitly enabled per account before any data exists.

Why it is used: To group and filter spend by service, account, tag, region or usage type.

# Enable Cost Explorer
aws ce enable-cost-explorer

# Get cost and usage
aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity DAILY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

Interview talking point: “enable-cost-explorer is a one-time call per account or in the management account, and data is backfilled only from the day you enable it — it cannot investigate last year. The —time-period End date is exclusive, so a month query ends on the first of the next month, and grouping supports at most two dimensions.”

Q409: How do you create budget?

What it is: A budget has an amount, a period and thresholds, with notifications firing when actual or forecast cost crosses them.

Why it is used: To hear about runaway spend within the month rather than on next month’s invoice.

# Create budget
aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "monthly-cost",
    "BudgetLimit": {"Amount": "1000", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "CostTypes": {"IncludeTax": true, "IncludeCredits": true}
  }'

# Add alert
aws budgets create-notification \
  --account-id 123456789012 \
  --budget-name monthly-cost \
  --notification '{
    "NotificationType": ACTUAL,
    "ComparisonOperator": GREATER_THAN,
    "Threshold": 80,
    "ThresholdType": PERCENTAGE
  }'

Interview talking point: “Use ThresholdType PERCENTAGE, add a FORECAST notification because actuals only warn once it is too late, and prefer MONTHLY over DAILY budgets, which fire constantly and get muted. Limits: roughly 2 budgets per account (5 for some org configurations), so per-team budgets belong in the organisation’s management account.”

Q410: How do you use Cost Allocation Tags?

What it is: Resource tags that Billing uses to group spend, but they must be activated in Billing preferences before appearing.

Why it is used: To attribute cost to a team, environment or cost centre — the precondition for accountability.

# Enable tags
# `enable-tag-poly` is NOT a real operation:
#   An error occurred (InvalidAction): Could not find operation
#   enableTagPoly for version 2017-10-26
#
# Tags on resources do nothing for cost reporting until they are ACTIVATED:
aws ce update-cost-allocation-tag-status \
  --tag-value "Department$Active"

# View costs by tag
aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity MONTHLY \
  --group-by Type=TAG,Key=Department

Interview talking point: “Activation is aws ce update-cost-allocation-tag-status —tag-value Department$Active; tags on resources alone do nothing for cost reporting, and untagged resources land in a not-tagged bucket. Note enable-tag-poly is not a real operation — it fails with InvalidAction. Deactivating a tag stops reporting but historical data persists.”

Q411: How do you set up CUR (Cost and Usage Report)?

What it is: A raw, line-item-level export of billing data delivered to S3 on a schedule in CSV or Parquet.

Why it is used: The data source for accurate cost analysis, chargeback, unit economics and custom dashboards.

# Create report
aws cur create-report-definition \
  --report-name my-cur \
  --time-unit HOURLY \
  --format Parquet \
  --compression SNAPPY \
  --s3-bucket my-bucket \
  --s3-prefix reports/ \
  --additional-report-elements RESOURCES

Interview talking point: “create-report-definition —time-unit HOURLY —format Parquet —compression SNAPPY —s3-bucket, with —additional-report-elements RESOURCES for per-resource attribution — without it you only get usage-type rows. Parquet is an order of magnitude smaller and far cheaper for Athena to scan. Reports take up to 24 hours to appear, partitioned by year and month.”

AWS Organizations

Q412: How do you create OU (Organizational Unit)?

What it is: A container inside an organization root or another OU, grouping accounts that SCPs and guardrails attach to.

Why it is used: To group accounts by function so controls and permissions apply to a whole group.

# Create OU
aws organizations create-organizational-unit \
  --parent-id r-1234 \
  --name Production

# Move account
aws organizations move-account \
  --account-id 123456789012 \
  --source-parent-id r-1234 \
  --destination-parent-id ou-1234

Interview talking point: “create-organizational-unit —parent-id —name and move-account —source-parent-id —destination-parent-id. An account with a root-level SCP attachment can only move if the SCP also exists under the destination, or the move fails with AccessDeniedException. An SCP on a parent applies to everything beneath it, which makes hierarchy a governance tool.”

Q413: How do you create SCP (Service Control Policy)?

What it is: A JSON policy attached to an OU, account or root that sets the maximum permissions any principal may have.

Why it is used: To enforce guardrails across accounts, including root and principals you cannot otherwise restrict.

# Create SCP
aws organizations create-policy \
  --content '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": ["ec2:*"],
      "Resource": "*",
      "Condition": {"Bool": {"aws:SecureTransport": false}}
    }]
  }' \
  --description "Deny non-SSL EC2" \
  --name "Deny-Non-SSL-EC2" \
  --type SERVICE_CONTROL_POLICY

Interview talking point: “The rule that catches everyone: the FullAWSAccess SCP must stay attached, because with no allow the result is an implicit deny — attaching your first deny SCP without the allow breaks the account. Use create-policy —type SERVICE_CONTROL_POLICY then attach-policy, and aws:SecureTransport is the standard deny non-TLS condition.”

Q414: How do you enable all features?

What it is: enable-all-features switches on every Organizations feature at once: SCPs, IAM policies, trusted access and sharing.

Why it is used: To get a fully functional organization rather than one that only creates accounts.

# Enable all features
aws organizations enable-all-features

Interview talking point: “It is only callable from the management account, and enabling IAM and SCP features retroactively affects existing accounts — test in a sandbox or use TargetIds with a StringNotEquals exception for your break-glass account. Enablement order can matter: SCPs for a service like KMS sometimes need IAM policies enabled first.”

AWS Control Tower

Q415: How do you set up Control Tower?

What it is: Control Tower provisioning creates an organization, management, log archive and audit accounts, OUs and guardrails in one orchestrated operation.

Why it is used: To establish a governed baseline of accounts and controls rather than building them by hand.

# Create landing zone (requires console setup)
# Or use AWS Control Tower API
aws controltower create-landing-zone \
  --manifest file://manifest.json

Interview talking point: “The CLI prefix is controltower and create-landing-zone —manifest file://manifest.json is real, but rarely used: the operation is console-driven, takes about an hour, and its status must reach SUCCEEDED. It is not idempotent — failures need continue-landing-zone or a clean restart — and there is no way to delete a landing zone in place.”

Q416: How do you enroll account?

What it is: enroll-account moves an existing AWS account into a Control Tower target OU so landing zone guardrails apply to it.

Why it is used: To bring accounts created outside Control Tower under governance without recreating them.

# Enroll account
aws controltower enroll-account \
  --account-id 123456789012 \
  --organizational-unit-name Production

Interview talking point: “enroll-account —account-id —organizational-unit-name is a real API, but one account cannot be enrolled in two landing zones, and guardrails apply immediately — a non-compliant account gets findings or blocked actions on day one. The modern workflow is create-account inside Control Tower; enroll suits grandfathered accounts, and the operation is asynchronous.”

AWS Resource Access Manager

What it is: RAM lets one account share resources like subnets, transit gateway attachments, IPAM pools or Route 53 zones with other accounts.

Why it is used: To share network and DNS resources across accounts without duplicating them or building a role per consumer.

# Create resource share
aws ram create-resource-share \
  --name my-share \
  --resource-arns arn:aws:ec2:us-east-1:123456789012:subnet/subnet-12345 \
  --principals "111111111111"

# The flag is --principals; --principils fails with "Unknown options".
# The consumer must then accept the invitation:
# aws ram accept-shared-invitation \
#   --resource-share-invitation-arn "arn:aws:ram:...:resource-share/inv-..."

Interview talking point: “create-resource-share —name —resource-arns —principals — the flag is —principals, and —principils is rejected as an unknown option. Sharing stays within the organization, the consumer accepts via accept-shared-invitation, and permissions remain with the owner’s IAM since RAM exposes rather than copies. Scrutinise AllowExternalPrincipals in a security review.”

AWS Service Catalog

Q418: How do you create Portfolio?

What it is: A governed catalogue where a portfolio groups products, each product holding a CloudFormation template plus permitted launch parameters.

Why it is used: To let teams self-service infrastructure from approved templates with guardrails instead of filing tickets.

# Create portfolio
aws servicecatalog create-portfolio \
  --name "My Portfolio" \
  --description "Products for developers"

# Create product
aws servicecatalog create-product \
  --name "Web Server" \
  --owner "IT Team" \
  --product-type CLOUD_FORMATION_TEMPLATE \
  --provisioning-artifact-parameters '{
    "Name": "v1",
    "Description": "Web server template",
    "Info": {"LoadTemplateURL": "https://s3.amazonaws.com/templates/template.yaml"}
  }'

Interview talking point: “create-portfolio, then create-product —product-type CLOUD_FORMATION_TEMPLATE —provisioning-artifact-parameters with Info.LoadTemplateURL; governance comes from launch constraints like required parameters and an approved provisioning role. Contrast with StackSets: StackSets deploys one template to many accounts you own, Service Catalog lets other people launch from your catalogue into their own accounts.”

AWS Systems Manager

Q419: How do you run command on multiple instances?

What it is: SSM Run Command sends a document to targeted instances by ID or tag and returns a command ID to poll.

Why it is used: Fleet-wide patching, config changes or scripts across hundreds of instances without SSH or a bastion.

# Run command
aws ssm send-command \
  --document-name AWS-RunShellScript \
  --targets '[{"Key":"tag:Environment","Values":["Production"]}]' \
  --parameters '{
    "commands": ["yum update -y", "systemctl restart nginx"]
  }'

# Get command output
aws ssm list-command-invocations \
  --command-id command-id \
  --details

Interview talking point: “send-command —document-name AWS-RunShellScript with tag targeting makes it a fleet tool. The command runs as root and is not idempotent, and a successful return only means it was dispatched — poll list-command-invocations for per-instance results. Use —max-concurrency and —max-errors to roll out gradually instead of hitting 500 instances at once.”

Q420: How do you use Patch Manager?

What it is: A patch baseline names patch filters, an approval schedule and compliance states, attached by tag registration or explicitly.

Why it is used: To make OS patching declarative and compliance-visible instead of an ad-hoc manual update.

# Create patch baseline
aws ssm create-patch-baseline \
  --name "Production Baseline" \
  --operating-system AMAZON_LINUX2 \
  --patch-filters '[{"Key":"PRODUCT","Values":["AmazonLinux2.0"]}]'

# Register for patching
aws ssm register-default-patch-baseline --baseline-id baseline-id

Interview talking point: “create-patch-baseline —name —operating-system AMAZON_LINUX2 —patch-filters, then register-default-patch-baseline —baseline-id; instances tagged PatchGroup pick up that baseline automatically. Two gotchas: AMAZON_LINUX2 is not AMAZON_LINUX_2023 as a CLI OS name, and AL2 may reboot at the end of a maintenance window while AL2023 does not.”

AWS Config Rules

Q421: How do you create custom Config rule?

What it is: A custom Config rule evaluates configuration items with your own Lambda, returning Compliant or NonCompliant per evaluation.

Why it is used: To enforce a policy AWS has no built-in rule for, like required tags or open port 22.

# Create rule
# The CLI prefix is `config`, not `configservice`.
aws config put-config-rule \
  --config-rule '{
    "ConfigRuleName": "required-tags",
    "Description": "Every EC2 instance must carry the Environment tag",
    "Source": {
      "Owner": "CUSTOM_LAMBDA",
      "SourceIdentifier": "arn:aws:lambda:us-east-1:123456789012:function:config-rule",
      "EventSource": "aws.config"
    },
    "InputParameters": {"tagName": "Environment"},
    "Scope": {"ComplianceResourceTypes": ["AWS::EC2::Instance"]}
  }'

# Note the Scope block. Config bills per rule EVALUATION, so an unscoped
# rule across a large account is genuinely expensive.

Interview talking point: “put-config-rule with Source.Owner CUSTOM_LAMBDA and the Lambda ARN as SourceIdentifier; the CLI prefix is config, not configservice. The Lambda must post results to the putEvaluations endpoint with ConfigRuleName and ComplianceType or the evaluation is rejected silently. Config bills per evaluation, so scope rules with a tag filter.”

AWS CloudTrail Insights

Q422: How do you enable CloudTrail Insights?

What it is: CloudTrail Insights analyses trail data in the service and raises an event on unusual API call or error rate patterns.

Why it is used: To get anomaly detection on API activity without building your own log detection pipeline.

# Enable insights
# There is no --enable-insight-selectors flag -- it fails as an unknown
# option. Insights are set on the trail itself:
aws cloudtrail update-trail \
  --name my-trail \
  --insight-selectors '[{"InsightType":"ApiCallRateInsight"},{"InsightType":"ApiErrorRateInsight"}]'

aws cloudtrail get-insight-selectors --trail-name my-trail

# Requires CloudWatch alarms enabled on the trail, else InvalidRequest.

Interview talking point: “There is no —enable-insight-selectors flag — it fails as an unknown option. Insights are set on the trail itself with update-trail —insight-selectors. Two types: ApiCallRateInsight and ApiErrorRateInsight, and the error variant is the one that catches a compromised key since a credential thief generates errors. CloudWatch alarms on the trail are required and events cost extra.”

AWS GuardDuty

Q423: How do you create GuardDuty findings?

What it is: GuardDuty generates findings continuously from its own telemetry, and create-sample-findings injects synthetic ones to test your pipeline.

Why it is used: A real detection control, and proof findings reach your alerting before you need them.

# Enable GuardDuty
aws guardduty create-detector \
  --enable

# Create sample findings
aws guardduty create-sample-findings \
  --detector-id detector-id

Interview talking point: “create-detector —enable is idempotent and safe in every account, then create-sample-findings —detector-id. Sample findings prove the path through EventBridge, SNS, Lambda and PagerDuty works — a detector nobody is paged for is not a control. Filter with create-filter so only meaningful severities alert, or people learn to ignore the stream.”

AWS Security Hub

Q424: How do you enable security standards?

What it is: Named standards like CIS, PCI-DSS and AWS Foundational Security Best Practices, each containing controls you enable individually or together.

Why it is used: To assess your account against a recognised compliance framework and produce evidence automatically.

# Enable standards
aws securityhub enable-standards \
  --standards-arn "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"

Interview talking point: “enable-standards —standards-arn needs a versioned ARN — an unversioned ruleset ARN fails. Individual controls are enabled separately with batch-enable-controls, and get-enabled-standards shows what is actually on. In an organization, run enable-organization-admin-account so findings aggregate centrally instead of each account holding an independent view.”

AWS Network Firewall

Q425: How do you create Network Firewall?

What it is: A managed, stateful, intrusion-detection-capable firewall running as an endpoint inside your VPC, driven by a firewall policy.

Why it is used: Central, auditable network inspection inside the VPC — beyond security groups, NACLs and HTTP-only WAF.

# Create firewall
# The flag is --subnet-mappings and it takes a LIST -- one mapping per AZ
# for HA. The map-by-AZ form shown above is not valid input.
aws network-firewall create-firewall \
  --firewall-name my-firewall \
  --vpc-id vpc-123 \
  --subnet-mappings '[{"SubnetId":"subnet-123"},{"SubnetId":"subnet-456"}]' \
  --firewall-policy-arn policy-arn

# Traffic is only inspected once route tables point at the firewall
# endpoint (inspection routes) -- that is the step people miss.

Interview talking point: “The flag is —subnet-mappings and it takes a LIST with one mapping per AZ for HA; a single map-by-AZ form is invalid input. Traffic is only inspected once route tables point at the firewall endpoint, the step people miss. The policy is a separate put-firewall-policy document with rule groups, including managed ThreatSignatures.”

AWS WAF

Q426: How do you create WAF Web ACL?

What it is: An ordered list of rules evaluated per request ending in a default allow or block, attached to CloudFront or a regional resource.

Why it is used: Filters malicious HTTP traffic — SQL injection, XSS, bad IPs, bots, rate limiting — before it reaches the app.

# Create Web ACL
aws wafv2 create-web-acl \
  --name my-acl \
  --scope REGIONAL \
  --default-action '{
    "Allow": {}
  }' \
  --rules '[
    {
      "Name": "AWS-AWSManagedRulesCommonRuleSet",
      "Priority": 1,
      "Statement": {
        "ManagedRuleGroupStatement": {
          "VendorName": "AWS",
          "Name": "AWSManagedRulesCommonRuleSet"
        }
      },
      "OverrideAction": {"None": {}},
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "AWSManagedRulesCommonRuleSet"
      }
    }
  ]'

Interview talking point: “wafv2 create-web-acl —scope REGIONAL, and CLOUDFRONT scope must be managed from us-east-1. Every rule needs a VisibilityConfig with sampled requests, CloudWatch metrics and a unique MetricName, plus a unique Priority. Run in Count mode for a week before switching to Block, and always enable WAF logging so blocking real users is diagnosable.”

AWS Firewall Manager

Q427: How do you set up Firewall Manager?

What it is: An organisation-wide service enforcing one security policy — security groups, WAF, Shield Advanced or Network Firewall — across every account.

Why it is used: To stop accounts drifting out of compliance, since not every team applies standards reliably.

# Create security policy
# Two problems: the CLI prefix is `fms`, not `firewallmanager`, and there
# is NO create-security-policy operation at all:
#   An error occurred (InvalidAction): Could not find operation
#   createSecurityPolicy for version 2017-12-01
aws fms create-admin-account --admin-account 111111111111

aws fms put-security-policy \
  --policy-name my-policy \
  --security-service-policy-data file://policy.json

aws fms put-accounts \
  --policy-name my-policy \
  --member-account-ids '["111111111111"]'

# REMEDIATION-ENABLED is the point of the service: with it on, Firewall
# Manager fixes non-compliant resources itself instead of only reporting.

Interview talking point: “The CLI prefix is fms, and there is NO create-security-policy operation — it fails with InvalidAction; use create-admin-account, then put-security-policy and put-accounts. The differentiator is remediation-enabled: with it on, Firewall Manager fixes non-compliant resources and deletes violating rules; switched off it only reports. That enforcement is the actual product.”

AWS Shield

Q428: How do you enable Shield Advanced?

What it is: Shield Standard is automatic free DDoS coverage; Shield Advanced is paid, adding attack visibility, an Operations Center and cost protection.

Why it is used: DDoS protection plus application-layer attack visibility and mitigation, not just network-level coverage.

# describe-subscription ONLY REPORTS -- it does not subscribe to anything.
# Shield Advanced is enabled from the console / support, then confirmed:
aws shield describe-subscription \
  --query '{State:Subscription.State,Start:Subscription.StartTime}'

aws shield get-subscription-state

# Shield Standard is automatic and free for every account: nothing to
# configure, no API to call.

Interview talking point: “Be precise: describe-subscription only reports whether you are subscribed, it does not enable anything. Advanced is enabled by subscribing in the console or via support, then confirmed with that call. Standard needs no configuration at all, so Advanced’s real value is visibility — attack timestamp, attacker geolocation, targeted resource — plus enforceable Firewall Manager policy.”

AWS PrivateLink

Q429: How do you create PrivateLink endpoint?

What it is: A VPC endpoint terminating traffic to a supported AWS service privately inside your VPC, off the public internet.

Why it is used: Private service access from private subnets, removing NAT gateway dependency and per-GB NAT cost.

# Create VPC endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-123 \
  --service-name com.amazonaws.us-east-1.s3 \
  --vpc-endpoint-type Gateway \
  --route-table-ids rtb-123

Interview talking point: “Gateway endpoints cover only S3 and DynamoDB, have no ENI and no hourly or per-GB charge, and attach to route tables. Interface endpoints create ENIs, cost hourly plus per-GB, and give a private DNS name. Pair an S3 gateway endpoint with a bucket policy on aws:sourceVpce for real VPC-level access control.”

Q430: How do you create Interface endpoint?

What it is: An interface endpoint creates ENIs in your subnets terminating traffic to a specific AWS or your own service with private DNS.

Why it is used: Private access to services, or exposing your own service to other VPCs without public IPs.

# Create Interface endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-123 \
  --service-name com.amazonaws.us-east-1.sqs \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-123 subnet-456

Interview talking point: “create-vpc-endpoint —vpc-endpoint-type Interface —subnet-ids with one subnet per AZ for HA, paid hourly plus per-GB — weigh that against NAT cost per GB. The SQS service name is com.amazonaws..sqs, which people guess wrong. Endpoint policies restrict principals, and PrivateLink shares your own service across accounts privately.”

AWS Transit Gateway

Q431: How do you create Transit Gateway?

What it is: A hub-and-spoke router connecting VPCs, on-premises networks and VPN connections, with route tables controlling propagation.

Why it is used: To replace the N-squared peering mesh with one attachment per VPC to a central hub.

# Create Transit Gateway
TG=$(aws ec2 create-transit-gateway \
  --description "Main TGW" \
  --options '{
    "AmazonAsn": 64512,
    "AutoAcceptSharedAttachments": "enable",
    "DefaultRouteTableAssociation": "enable",
    "DefaultRouteTablePropagation": "enable",
    "VpnEcmpSupport": "enable"
  }' \
  --query 'TransitGateway.TransitGatewayId' \
  --output text)

# Attach VPC
aws ec2 create-transit-gateway-vpc-attachment \
  --transit-gateway-id $TG \
  --vpc-id vpc-123 \
  --subnet-ids subnet-123 subnet-456

Interview talking point: “create-transit-gateway with an ASN, then create-transit-gateway-vpc-attachment —subnet-ids with one subnet per AZ — a single-AZ attachment is a single point of failure. With default route table association and propagation enabled, every attachment learns every route, flattening the hub and risking loops. Use per-attachment route tables with explicit routes instead, and ECMP spans attachments.”

Q432: How do you create Transit Gateway route?

What it is: A transit gateway route table maps destination CIDRs to attachments, and only associated attachments can use its routes.

Why it is used: To segment the hub so a database VPC reaches only shared services, not peer VPCs.

# Create route
aws ec2 create-transit-gateway-route \
  --destination-cidr-block 10.0.0.0/8 \
  --transit-gateway-route-table-id tgw-rtb-123 \
  --transit-gateway-attachment-id tgw-attach-456

Interview talking point: “create-transit-gateway-route —destination-cidr-block —transit-gateway-route-table-id —transit-gateway-attachment-id. Routes are exact prefix matches with no longest-prefix logic, so add a route per CIDR. The missed step beforehand: the attachment must be associated with that route table, or the route is never consulted.”

AWS Direct Connect

Q433: How do you create Direct Connect connection?

What it is: A private dedicated circuit from on-premises to an AWS Direct Connect location, with virtual interfaces making it usable.

Why it is used: Predictable high-bandwidth, low-latency connectivity without traffic traversing the public internet.

# Create connection request
aws directconnect create-connection \
  --location "EqDC2" \
  --bandwidth 1Gbps \
  --connection-name my-connection

Interview talking point: “create-connection —location —bandwidth —connection-name only leaves a requested connection and an LOA-CFA that must be physically delivered — procurement, not just an API call. Then create-virtual-interface (transit, private or public), accept-virtual-interface, and attach to a TGW or VGW. Transit VIFs to a TGW scale; private VIFs need one VGW per VPC, and BGP is required above 1 Gbps.”

Q434: How do you create Virtual Private Gateway?

What it is: A VPN concentrator attached to one VPC, onto which site-to-site VPN tunnels terminate.

Why it is used: The simple legacy way to connect a single VPC to on-premises over IPsec.

# Create VPG
VPG=$(aws ec2 create-vpn-gateway \
  --type ipsec.1 \
  --query 'VpnGateway.VpnGatewayId' \
  --output text)

# Attach to VPC
aws ec2 attach-vpn-gateway \
  --vpn-gateway-id $VPG \
  --vpc-id vpc-123

Interview talking point: “create-vpn-gateway —type ipsec.1 then attach-vpn-gateway. The modern pattern is Transit Gateway attached VPN, reachable from many VPCs, because a VGW serves one VPC and ten VPCs would mean peering them together. Also a VGW is single-AZ, has no SLA, and defaults to 1 Gbps.”

AWS VPN

Q435: How do you create Site-to-Site VPN?

What it is: A pair of IPsec tunnels from your on-premises customer gateway to a VPC’s VPN gateway or transit gateway.

Why it is used: The fastest on-premises connectivity option — available in minutes, no hardware or provider lead time.

# Create Customer Gateway
CGW=$(aws ec2 create-customer-gateway \
  --type ipsec.1 \
  --public-ip 203.0.113.1 \
  --bgp-asn 65001 \
  --query 'CustomerGateway.CustomerGatewayId' \
  --output text)

# Create VPN Connection
aws ec2 create-vpn-connection \
  --customer-gateway-id $CGW \
  --type ipsec.1 \
  --vpn-gateway-id vpg-123

Interview talking point: “create-customer-gateway —type ipsec.1 —public-ip —bgp-asn, then create-vpn-connection. Two tunnels land in different AZs, so use ECMP across both; BGP is optional since static routes work; and the customer gateway’s public IP must be static because routes point at it. One connection caps at 1 Gbps — a fast start, not a scalable architecture.”

AWS Client VPN

Q436: How do you create Client VPN endpoint?

What it is: A managed VPN server that clients with an OpenVPN or AWS client connect to, terminating into your VPC.

Why it is used: Giving individual users secure access into a VPC, replacing a bastion or SSH port-forwarding.

# Create Client VPN endpoint
aws ec2 create-client-vpn-endpoint \
  --client-cidr-block 10.0.0.0/22 \
  --server-certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/cert-id \
  --authentication-options '[{"Type": "certificate-authentication"}]' \
  --vpn-port 443

Interview talking point: “Two hard requirements: the server certificate must be an ACM certificate in the same region as the endpoint, and —client-cidr-block must be a /22 to /16 that does not overlap your VPC CIDRs. Access control matters most — by default a connected client can reach anything in the VPC, including the metadata endpoint.”

AWS Route 53

Q437: How do you create hosted zone?

What it is: A hosted zone is Route 53’s container for a DNS namespace — public for internet resolution, private to associated VPCs.

Why it is used: To own a domain’s DNS records, or give internal services stable private names.

# Create hosted zone
aws route53 create-hosted-zone \
  --name example.com \
  --caller-reference "my-zone-$(date +%s)"

Interview talking point: “The —caller-reference must be unique per call — reuse returns HostedZoneAlreadyExists, hence the timestamp workaround. A private zone additionally needs associate-vpc-with-hosted-zone or nothing resolves, and the VPC must have enableDnsHostnames and enableDnsSupport set.”

Q438: How do you create record set?

What it is: change-resource-record-sets submits a batch of CREATE, DELETE or UPSERT changes applied atomically, with a change ID to poll.

Why it is used: To manage DNS as code, since DNS often lives outside the rest of the infrastructure code.

# Create A record
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "www.example.com",
        "Type": "A",
        "TTL": 300,
        "ResourceRecords": [{"Value": "1.2.3.4"}]
      }
    }]
  }'

Interview talking point: “It needs the hosted zone ID, not the domain name. Use UPSERT for idempotent scripts because CREATE on an existing record fails, and expect roughly 60 seconds propagation — a script that creates a record and immediately tests DNS will flake.”

Q439: How do you create weighted routing?

What it is: Several records for the same name with different weights, returned proportionally — a traffic split with no health awareness.

Why it is used: For canary releases or splitting traffic between backends, with an API-driven way to shift weight.

# Create weighted records
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "example.com",
        "Type": "A",
        "SetIdentifier": "primary",
        "Weight": 80,
        "TTL": 300,
        "ResourceRecords": [{"Value": "1.2.3.4"}]
      }
    }]
  }'

Interview talking point: “Records sharing a name must each carry a distinct SetIdentifier and weights summing to 100, or validation fails. Weights are probabilistic, so 10 percent means roughly one in ten requests. Weighted routing is not health-aware — use latency-based or geolocation routing for that, and failover with health checks for failure behaviour.”

Q440: How do you create failover routing?

What it is: A PRIMARY and SECONDARY record pair, each tied to a health check, so traffic reaches the primary only while healthy.

Why it is used: For active-passive multi-region failover that moves traffic automatically when the primary fails.

# Create failover records
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "example.com",
        "Type": "A",
        "Failover": "PRIMARY",
        "SetIdentifier": "primary",
        "TTL": 60,
        "ResourceRecords": [{"Value": "1.2.3.4"}]
      }
    }]
  }'

Interview talking point: “Both records need unique SetIdentifiers and the primary a HealthCheckId; create health checks first and submit both records in one change batch. Alias records need EvaluateTargetHealth true. Clients cache the old IP until the TTL expires, making this slower than Global Accelerator but fine for short-lived HTTP connections.”

AWS CloudFront

Q441: How do you create CloudFront distribution?

What it is: A CloudFront distribution is an origin plus cache behaviours controlling what is cached, how long, and how viewers connect.

Why it is used: Serving content from edge locations for lower latency, origin offload and spike shielding.

# Create distribution
aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-cache-behavior '{
    "TargetOriginId": "my-bucket",
    "ViewerProtocolPolicy": "redirect-to-https",
    "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
    "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf"
  }' \
  --default-root-object index.html

  # CachePolicyId is the current model. ForwardedValues is DEPRECATED and
  # on a removal path.
  #   658327ea-f89d-4fab-a63d-7e88639e58f6 = Managed-CachingOptimized
  #   4135ea2d-6df6-4eab-a83d-abe5446a0c86 = Managed-CachingDisabled
  # --default-root-object index.html is what makes "/" serve a file
  # instead of returning 403.

Interview talking point: “The current model takes CachePolicyId in default-cache-behavior — 658327ea-f89d-4fab-a63d-7e88639e58f6 is CachingOptimized, 4135ea2d-6df6-4eab-a83d-abe5446a0c86 is CachingDisabled — while the old ForwardedValues block is deprecated and on a removal path. —default-root-object index.html is what makes / serve a file rather than 403, and deployment takes 5 to 15 minutes.”

Q442: How do you create origin access identity?

What it is: A legacy identity CloudFront presents to S3 to authenticate requests, letting the bucket stay private while CloudFront serves it.

Why it is used: Serving private S3 content through CloudFront without making the bucket public.

# Create OAI
OAI=$(aws cloudfront create-cloud-front-origin-access-identity \
  --cloud-front-origin-access-identity-config '{
    "CallerReference": "my-oai",
    "Comment": "Access for my-bucket"
  }' \
  --query 'CloudFrontOriginAccessIdentity.Id' \
  --output text)

# Update S3 bucket policy
aws s3api put-bucket-policy \
  --bucket my-bucket \
  --policy '{
    "Version": "2008-10-17",
    "Statement": [{
      "Sid": "CloudFront",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity '${OAI}'"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }]
  }'

Interview talking point: “Both halves are required — the OAI on the distribution and the bucket policy statement — or CloudFront gets AccessDenied on every request. The current recommendation is S3 Origin Access Control instead, since OAI is on a deprecation path. Block Public Access must also be set so ACLs cannot grant public access independently.”

Q443: How do you set up Lambda@Edge?

What it is: Lambda running at CloudFront edge locations on viewer or origin request and response events, modifying requests before cache or origin.

Why it is used: URL rewriting, auth header injection, A/B testing or bot detection at the edge, applied to cache hits too.

# Lambda@Edge constraints that will bite you:
#   1. the function MUST be in us-east-1
#   2. trust policy needs BOTH lambda.amazonaws.com AND
#      edgelambda.amazonaws.com, with lambda:CreateReplica on the version
#   3. publish a version and reference function-name:1, never $LATEST
#   4. a published version's configuration is IMMUTABLE
#   5. Node.js / Python only, 50 MB zipped, NO env vars,
#      5s viewer / 30s origin timeout
aws lambda publish-version --function-name my-function

# Add trigger to CloudFront
aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-cache-behavior '{
    "TargetOriginId": "my-bucket",
    "LambdaFunctionAssociations": [{
      "EventType": "origin-request",
      "LambdaFunctionARN": "arn:aws:lambda:us-east-1:123456789012:function:my-function:1"
    }]
  }'

Interview talking point: “The function MUST be in us-east-1 with a trust policy for both lambda.amazonaws.com and edgelambda.amazonaws.com, and you must publish a version and reference function-name:1, never $LATEST. The published version’s configuration is then immutable, only Node.js and Python run, there are no environment variables, and timeouts are 5 seconds viewer and 30 seconds origin.”

AWS S3 Advanced Features

Q444: How do you enable S3 Access Points?

What it is: An access point gives a bucket its own endpoint with a distinct IAM policy and block-public-access settings.

Why it is used: To give each application its own access boundary on a shared data lake.

# Create access point
aws s3control create-access-point \
  --account-id 123456789012 \
  --name my-access-point \
  --bucket my-bucket

Interview talking point: “s3control create-access-point —account-id —name —bucket, then address objects using a special bucket name of access point, account ID and s3alias. Each access point gets independent Block Public Access and its own policy, but the bucket policy still applies underneath, so isolation works without prefix-matching conditions in one shared policy.”

Q445: How do you enable S3 Multi-Region Access Points?

What it is: A single global endpoint covering S3 buckets in two or more regions, so one request can be served from any of them.

Why it is used: One logical namespace across regions with a single IAM model, for naturally replicated data.

# Create multi-region access point
# The flag is --buckets and it takes bucket ARNs; --bucket is invalid.
# --region must be the HOME REGION of the MRAP, not the bucket's region.
aws s3control create-multi-region-access-point \
  --account-id 123456789012 \
  --name my-mrap \
  --region us-east-1 \
  --buckets 'arn:aws:s3:::my-bucket-us-east-1,arn:aws:s3:::my-bucket-eu-west-1'

# An MRAP is a single endpoint + single IAM model. It is NOT replication --
# pair it with S3 Replication per bucket.

Interview talking point: “The flag is —buckets and it takes a comma-separated list of bucket ARNs — the singular —bucket is invalid, and —region must be the access point’s HOME region, not a bucket’s region. An MRAP gives one endpoint and permissions model, not replication, so pair it with S3 Replication per bucket.”

Q446: How do you set up S3 Inventory?

What it is: S3 Inventory periodically writes a manifest of a bucket’s objects — key, size, class, ETag, encryption — as CSV, ORC or Parquet.

Why it is used: To audit a bucket or build a data lake, which S3 listing cannot do efficiently at scale.

# Create inventory configuration
aws s3api put-bucket-inventory-configuration \
  --bucket my-bucket \
  --id daily-inventory \
  --inventory-configuration '{
    "Destination": {
      "S3BucketDestination": {
        "Format": "Parquet",
        "Bucket": "arn:aws:s3:::inventory-bucket"
      }
    },
    "Schedule": {"Frequency": "Daily"},
    "IncludedObjectVersions": "Current"
  }'

Interview talking point: “put-bucket-inventory-configuration with Schedule.Frequency Daily or Weekly and IncludedObjectVersions All if you want deleted versions. The destination bucket must have a bucket policy granting the inventory service permission, or reports are never written. Choose CSV for humans, Parquet or ORC for Athena; Storage Lens is the separate service-side metrics tool.”

AWS Lambda Edge Cases

Q447: How do you handle Lambda cold start?

What it is: The latency of a new execution environment being created and initialised — why the first invocation is slow.

Why it is used: To make p99 latency predictable for user-facing APIs, not just acceptable on average.

import json
import boto3

# Use provisioned concurrency
lambda_client = boto3.client('lambda')

# Pre-warm function
response = lambda_client.put_function_concurrency(
    FunctionName='my-function',
    ProvisionedConcurrentExecutions=5
)

Interview talking point: “The original API is wrong: put_function_concurrency sets RESERVED concurrency, not provisioned. Provisioned concurrency is put-provisioned-concurrency-config —function-name —qualifier and it requires a published version, not $LATEST. Other levers are smaller packages, memory tuning and SnapStart for Java; provisioned concurrency bills continuously, so reserve it for latency-sensitive functions.”

Q448: How do you handle Lambda timeout?

What it is: The function-level timeout, max 15 minutes, with context.get_remaining_time_in_millis() reporting how long the handler has left.

Why it is used: To fail fast with a clear error instead of being killed mid-operation, leaving work half-done.

import json

def handler(event, context):
    # Set custom timeout in boto3 client
    # Or use AWS X-Ray for tracing
    pass

Interview talking point: “Check remaining time before starting an operation you cannot interrupt, so you can return a partial result instead of dying. When Lambda kills you everything in flight is lost, surfacing as a 504 behind API Gateway. Raise it with update-function-configuration —timeout, or move long-running work to Step Functions where it survives independently.”

Q449: How do you secure Lambda environment?

What it is: Covers the execution role, environment, networking and code — the consolidated answer for making a function safe.

Why it is used: Because a function often holds the broadest data access in the architecture.

Use VPC for sensitive workloads
Use Secrets Manager for sensitive data
Implement proper IAM roles
Enable encryption at rest
Use Layers for shared code

Interview talking point: “The execution role protects you most, since a broad role makes every other control irrelevant. Plaintext environment variables are visible to anyone with lambda:GetFunctionConfiguration, so secrets go to Secrets Manager and are fetched at runtime. VPC-attaching is not security by itself and then needs VPC endpoints for AWS APIs. Layers share code but anyone with GetLayerVersion can read it.”

AWS ECS Deep Dive

Q450: How do you implement blue-green deployment in ECS?

What it is: Runs the new task definition as a separate target set, validates it, then shifts listener traffic atomically under CodeDeploy.

Why it is used: For releases where a rolling update is not enough because you need true one-step rollback.

# Create new task definition
aws ecs register-task-definition \
  --family my-app \
  --network-mode awsvpc \
  --container-definitions '[{"name":"web","image":"my-app:v2"}]'

# Update service with new task definition
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --task-definition my-app:v2 \
  --deployment-configuration '{
    "minimumHealthyPercent": 50,
    "maximumPercent": 200
  }'

Interview talking point: “The commands shown are a rolling update, not blue/green. Real blue/green needs deploymentController CODE_DEPLOY on the service, a CodeDeploy deployment group, two target groups behind weighted ALB listener actions, and the service referencing both. CodeDeploy then shifts 100 percent weight and shifts back if validation hooks fail — rollback is one action, not another deployment.”

Q451: How do you implement service discovery in ECS?

What it is: Cloud Map service discovery registers ECS service names in a private DNS namespace so containers resolve each other by name.

Why it is used: Decouples microservices from task IPs with stable endpoints that survive task replacements.

# Create private namespace
aws servicediscovery create-private-dns-namespace \
  --name local \
  --vpc vpc-123

# Create service with service discovery
aws ecs create-service \
  --cluster my-cluster \
  --service-name my-service \
  --launch-type FARGATE \
  --service-registries '[{"registryArn":"arn:aws:servicediscovery:us-east-1:123456789012:service/srv-123"}]'

Interview talking point: “The task definition needs a portMappings entry for the registered port, and the namespace must be private-dns for name resolution, or dns-http/http if clients use the API. For new architectures, Service Connect is simpler and needs no namespace.”

AWS EKS Deep Dive

Q452: How do you configure EBS CSI driver in EKS?

What it is: ECS Service Connect is native service-to-service networking: services declare a namespace and each other’s ports, with Cloud Map and mutual TLS handling discovery and encryption.

Why it is used: Gives discovery, traffic management and encryption without deploying a mesh or writing client-side load balancing.

# Add EBS CSI driver addon
aws eks create-addon \
  --cluster-name my-cluster \
  --addon-name aws-ebs-csi-driver

Interview talking point: “You set serviceConnectConfiguration listing services with portName and discoveryName, and it adds mutual TLS automatically. Gotcha: portName must match a portMappings name in the task definition, or you get an opaque failure. It is per-cluster, so multi-cluster meshing needs App Mesh or Istio.”

Q453: How do you configure EFS CSI driver in EKS?

What it is: An ECS task definition is a versioned, immutable description of a task: image, CPU and memory, network mode, IAM roles, volumes and logging.

Why it is used: Immutability means every change creates a new revision, making deployments reproducible and rollbacks possible.

# Add EFS CSI driver addon
aws eks create-addon \
  --cluster-name my-cluster \
  --addon-name aws-efs-csi-driver

Interview talking point: “awsvpc requires logConfiguration, without which a task fails at runtime with CannotPullContainerError, and needs network-configuration with one ENI per task. CPU and memory must be a valid Fargate combination, with memory at least twice the task CPU units, or registration fails validation.”

Q454: How do you enable RBAC in EKS?

What it is: An ECS capacity provider manages cluster compute scaling: an auto scaling group that launches EC2 instances, or serverless Fargate.

Why it is used: Keeps a cluster running with spare capacity without managing instances or auto scaling groups by hand.

# Create RoleBinding
kubectl create rolebinding admin-binding \
  --clusterrole=admin \
  --user=user@example.com \
  --namespace=default

Interview talking point: “managedScaling ENABLED stops the ASG scaling to zero and stranding the cluster, and managedTerminationProtection ENABLED drains tasks before an instance is replaced. Updating the cluster provider list does not migrate running tasks, so follow with update-service —force-new-deployment.”

AWS RDS Deep Dive

Q455: How do you set up read replica?

What it is: An ECS scheduled task pairs a task definition with a cron or rate schedule, running it periodically and stopping it once complete.

Why it is used: Handles recurring jobs like nightly ETL, report generation or reindexing without a scheduler service or EventBridge glue.

# Create read replica
# The parameter is --source-db-instance-identifier (an identifier, not an
# ARN). --source-db-instance-arn is rejected as an unknown option.
aws rds create-db-instance-read-replica \
  --db-instance-identifier my-replica \
  --source-db-instance-identifier primary \
  --db-instance-class db.t3.medium \
  --read-replica-source-region us-east-1 \
  --db-subnet-group-name my-subnets \
  --no-multi-az

# Multi-AZ standby is NOT a replica: one writer plus one hot standby.
# For more read capacity add read replicas -- and note they do not
# survive an AZ failure on their own.

Interview talking point: “The schedule is UTC, six-field cron with ? in day-of-week, and network-configuration is required for awsvpc just like a normal task. A schedule-task-start-time in the past makes the task run immediately, a common surprise; rate(1 day) is easier for daily jobs.”

Q456: How do you set up Multi-AZ?

What it is: ECS exec opens an interactive shell into a running container using SSM Session Manager underneath, so you need no SSH or bastion.

Why it is used: Debug a running production task without an open port, an SSH key or an in-app debug agent.

# Modify to Multi-AZ
aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --multi-az \
  --apply-immediately \
  --db-subnet-group-name my-subnets

# Multi-AZ is one writer plus one synchronously-replicated hot standby, so
# failover is typically under 60s -- at roughly double the instance cost.
# It is NOT a read replica.

Interview talking point: “Prerequisites are the real answer: enableExecuteCommand true in the task definition, an execution role with ssmmessages permissions, Fargate platform version 1.4 or later, and a reachable SSM endpoint, so a private subnet needs a VPC interface endpoint. Otherwise you get execute-command failed: unable to start exec session.”

Q457: How do you enable Performance Insights?

What it is: Fargate Spot is Fargate capacity priced like Spot, up to 70 percent cheaper, with the same execution environment as on-demand.

Why it is used: For interruptible, fault-tolerant batch work where interruption is acceptable.

# Enable Performance Insights
aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --enable-performance-insights \
  --performance-insights-kms-key-id key-id

Interview talking point: “Spot capacity is declared as a percentage, not a count, and it is always 100 percent if you configure only FARGATE_SPOT. Tasks get a two-minute termination notice, so handlers must checkpoint, and without an on-demand fallback the service simply cannot place tasks.”

AWS Aurora Deep Dive

Q458: How do you create Aurora cluster?

What it is: ECS Auto Scaling adjusts a service’s desired count from CloudWatch metrics such as ECSServiceAverageCPUUtilization and average memory utilization.

Why it is used: Keeps capacity matched to load without manually changing the desired count.

# Create Aurora cluster
aws rds create-db-cluster \
  --db-cluster-identifier my-cluster \
  --engine aurora-mysql \
  --engine-version 8.0 \
  --master-username admin \
  --master-user-password mypassword123 \
  --db-cluster-parameter-group-name aurora-mysql8.0 \
  --vpc-security-group-ids sg-123

# Create instances
aws rds create-db-instance \
  --db-cluster-identifier my-cluster \
  --db-instance-class db.t3.medium \
  --db-instance-identifier writer

Interview talking point: “Target tracking is the right policy type because you state a target value and AWS computes the capacity. desiredCount is the baseline and min-capacity and max-capacity bound the range, so a service stuck at desiredCount two never scales below two. Averages need at least two tasks.”

Q459: How do you set up Aurora Serverless?

What it is: Aurora Serverless v2 scales Aurora capacity automatically between a minimum and maximum in Aurora Capacity Units, independent of instance count.

Why it is used: For variable or spiky Aurora workloads where provisioning for peak is wasteful and fixed clusters too rigid.

# Create serverless cluster
# --engine-mode serverless + --scaling-configuration is Aurora
# Serverless **v1** -- a different, older, less capable feature.
# Aurora Serverless **v2** uses --engine-mode PROVISIONED plus a
# serverlessv2 scaling configuration measured in ACUs.
aws rds create-db-cluster \
  --db-cluster-identifier my-serverless \
  --engine aurora-postgresql \
  --engine-mode provisioned \
  --master-username admin \
  --master-user-password 'from-a-secret-manager-not-the-cli' \
  --serverlessv2-scaling-configuration '{
    "MinCapacity": 2,
    "MaxCapacity": 64
  }'

aws rds modify-db-cluster \
  --db-cluster-identifier my-serverless \
  --serverlessv2-scaling-configuration '{"MinCapacity":0.5,"MaxCapacity":128}'

# Scaling takes seconds (two copies of the data are kept and rebalanced),
# capped at 15 minutes with a cooldown afterwards.

Interview talking point: “Serverless v2 is created with —engine-mode provisioned plus a serverlessv2-scaling-configuration block with MinCapacity 0.5 and MaxCapacity 128 in ACUs; —engine-mode serverless with a scaling-configuration block is the older, less capable v1. Scaling takes seconds with a hard 15-minute cap and a cooldown after.”

Q460: How do you create Aurora Global Database?

What it is: An Aurora global cluster spans Aurora clusters in multiple regions: one writer region, reader regions, and a global endpoint routing writes.

Why it is used: A single logical database across regions with automatic cross-region failover and low-latency global reads.

# Add secondary region
# `--engine aurora` is the legacy 5.6-compatible engine. Valid values are
# aurora, aurora-mysql, aurora-postgresql.
aws rds create-db-cluster \
  --db-cluster-identifier secondary-cluster \
  --engine aurora-mysql \
  --global-cluster-identifier global-cluster \
  --replication-source-arn primary-arn

# Planned regional failover -- promotes the secondary to writer in <1 min:
aws rds failover-global-cluster \
  --global-cluster-identifier global-cluster \
  --target-aws-region-id eu-west-1

Interview talking point: “Valid engines are aurora, which is legacy MySQL 5.6-compatible, aurora-mysql and aurora-postgresql. Add a secondary region with create-db-cluster —global-cluster-identifier —replication-source-arn, not modify-db-cluster. Planned failover via failover-global-cluster promotes the secondary in minutes, and global-endpoint DNS caching pushes you toward per-region endpoints.”

AWS DynamoDB Deep Dive

Q461: How do you create GSI?

What it is: Aurora storage is a distributed six-copy quorum across three AZs, managed by Aurora itself and separate from the DB instances.

Why it is used: Delivers durability and fast recovery without managing replication or provisioning storage yourself.

# Create table with GSI
aws dynamodb create-table \
  --table-name Orders \
  --attribute-definitions \
    AttributeName=OrderID,AttributeType=S \
    AttributeName=CustomerID,AttributeType=S \
  --key-schema AttributeName=OrderID,KeyType=HASH \
  --global-secondary-indexes '[
    {
      "IndexName": "CustomerIDIndex",
      "KeySchema": [{"AttributeName":"CustomerID","KeyType":"HASH"}],
      "Projection": {"ProjectionType":"ALL"},
      "ProvisionedThroughput": {"ReadCapacityUnits":5,"WriteCapacityUnits":5}
    }
  ]'

Interview talking point: “Every page write goes to six copies, synchronous to three and asynchronous to the rest, so an AZ failure loses no write. KmsKeyId and StorageEncrypted are set at creation and immutable, so changing encryption needs a snapshot restore. Failover is under 30 seconds but restores take tens of minutes, so test restores.”

Q462: How do you enable DAX?

What it is: Amazon QLDB is a ledger database with ACID transactions, an immutable cryptographically verifiable history and a simple single-writer API.

Why it is used: For audit trails, financial ledgers and compliance records whose history must be provably tamper-free.

# Create DAX cluster
aws dax create-cluster \
  --cluster-name my-dax \
  --node-type dax.r5.large \
  --replication-factor 3 \
  --iam-role-arn role-arn

Interview talking point: “QLDB keeps a hash chain over journal entries; you request a LedgerDigest and then run verify-ledger-integrity, which returns false if any record was altered. Export digests somewhere ledger admins cannot write, such as a separate account or Object Lock bucket. Single-writer per ledger bounds write throughput, so high-write use needs multiple ledgers.”

Q463: How do you implement TTL?

What it is: MemoryDB is a Redis and Valkey-compatible in-memory data store with durability, multi-AZ replication and automatic failover.

Why it is used: A primary Redis-compatible datastore needing persistence and HA rather than a pure cache, with sub-millisecond access.

# Enable TTL
aws dynamodb update-time-to-live \
  --table-name Orders \
  --time-to-live-specification '{
    "Enabled": true,
    "AttributeName": "ExpiryTime"
  }'

Interview talking point: “Unlike ElastiCache, Multi-AZ, automatic failover, backups and snapshots are enabled by default and every cluster has a replica. Valkey is Redis’s open-source successor, and after the Redis 7.x licensing changes new workloads increasingly run on Valkey on both services.”

AWS ElastiCache Deep Dive

Q464: How do you create Redis cluster?

What it is: A Redis cluster is built with create-replication-group or create-serverless-cache, while Memcached’s create-cache-cluster is standalone and shard-aware via node count.

Why it is used: Runs Redis with automatic failover and sharding across multiple nodes instead of a single cache node.

# Create Redis cluster
# create-cache-cluster cannot take --replication-group-id. Replication
# groups are a separate resource:
aws elasticache create-replication-group \
  --replication-group-id my-group \
  --replication-group-description "redis with failover" \
  --cache-node-type cache.t3.medium \
  --engine redis7 \
  --num-node-groups 2 \
  --automatic-failover-enabled \
  --transit-encryption-enabled

# num-node-groups is the shard count (shards spread across AZs).
# automatic-failover-enabled needs a replica in every shard.

Interview talking point: “create-cache-cluster —replication-group-id is not valid, because replication groups are their own resource. Use —cache-node-type, not —instance-type, and an engine carrying a version such as redis7. automatic-failover-enabled needs a replica in every shard, so each shard requires at least two cache clusters or it fails validation.”

Q465: How do you enable auto-failover?

What it is: A replication group is a Redis cluster of shards, each a primary plus replicas, with automatic failover across them.

Why it is used: For high-throughput or highly available Redis that a single node cannot provide.

# Create replication group with auto-failover
aws elasticache create-replication-group \
  --replication-group-id my-group \
  --replication-group-description "Primary and Replica" \
  --num-cache-clusters 2 \
  --cache-node-type cache.t3.medium \
  --engine redis \
  --automatic-failover-enabled \
  --multi-az-enabled

Interview talking point: “num-node-groups is the shard count. People miss —transit-encryption-enabled, off by default, and —multi-az-enabled, which is a different thing from shard-level replicas. Read endpoints differ by policy, READONLY, PRIMARY or ALL, so the normal pattern is a READONLY endpoint behind a connection pool and writes through PRIMARY.”

AWS SQS Advanced Patterns

Q466: How do you implement dead letter queue pattern?

What it is: ElastiCache replication groups support cluster mode disabled, one primary and replica pair set, or enabled, which shards hash slots across node groups.

Why it is used: Pick the topology for either simplicity with a single failover pair or horizontal sharding.

import boto3
import json

sqs = boto3.client('sqs')

def process_message(message):
    try:
        # Process message
        pass
    except Exception as e:
        # Move to DLQ
        dlq_url = sqs.get_queue_url(QueueName='my-dlq')['QueueUrl']
        sqs.send_message(
            QueueUrl=dlq_url,
            MessageBody=message['Body']
        )
        raise

Interview talking point: “Cluster mode disabled is far simpler and often sufficient, giving read replicas and automatic failover without slot-aware clients. When enabled, multi-key operations need all keys hashing to the same slot, so CLUSTER DOWN or CROSSSLOT errors mean exactly that, and reads go through cluster-aware clients.”

Q467: How do you implement delayed queue?

What it is: OpenSearch and Aurora PostgreSQL support Global Replicas: asynchronously replicated secondary copies in other regions with an automated failover policy.

Why it is used: For cross-region disaster recovery and read locality for search without maintaining a second pipeline.

# Create queue with delay
sqs.create_queue(
    QueueName='delayed-queue',
    Attributes={
        'DelaySeconds': '300'
    }
)

Interview talking point: “Replication across regions is asynchronous with an automated failover policy, so this targets disaster recovery and low-latency regional reads rather than zero-lag consistency. Confirm lag expectations before serving reads from a secondary, and weigh it against standing up a duplicate ingestion pipeline.”

Q468: How do you implement fanout pattern?

What it is: Aurora Global Database is a single logical Aurora database spanning regions with one writer region and reader regions, storage replicated across them.

Why it is used: Cross-region disaster recovery with fast failover and low-latency reads close to users.

import boto3

sns = boto3.client('sns')

# Create topic
topic = sns.create_topic(Name='fanout-topic')

# Subscribe multiple endpoints
for endpoint in endpoints:
    sns.subscribe(
        TopicArn=topic['TopicArn'],
        Protocol='lambda',
        NotificationEndpoint=endpoint
    )

Interview talking point: “create-global-cluster, then create-db-cluster —global-cluster-identifier —replication-source-arn in each secondary region. Unlike Aurora Replicas, Global Database replicates the whole cluster, tables, users and extensions, so the secondary region can run the application after failover-global-cluster promotes it in under a minute, which is AWS’s stated RTO.”

AWS Kinesis Data Streams

Q469: How do you create Kinesis stream?

What it is: DocumentDB is a managed, MongoDB-compatible document database scaling across up to six copies, with five-second reads and one-second writes by default.

Why it is used: MongoDB-style document workloads on AWS at lower cost, with managed durability and scaling.

# Create stream
aws kinesis create-stream \
  --stream-name my-stream \
  --shard-count 2

Interview talking point: “The engine name is docdb, not mongodb. It is wire-compatible but not a drop-in: no unique sparse indexes, no retryable writes by default, and read-after-write consistency only on the primary. The storage discount against RDS trades off those gaps and a scale-up-only ceiling within one cluster.”

Q470: How do you read from Kinesis?

What it is: Timestream is a purpose-built time-series database with high-cardinality in-memory measures plus compressed dimension storage, partitioned by dimension.

Why it is used: For metrics, IoT telemetry and monitoring where you write many rows, query a narrow window and aggregate.

import boto3
import json

kinesis = boto3.client('kinesis')

def read_shard(shard_iterator):
    response = kinesis.get_records(ShardIterator=shard_iterator)
    for record in response['Records']:
        data = json.loads(record['Data'])
        process(data)
    return response['NextShardIterator']

Interview talking point: “TIMESTAMP and MEASURE columns are held in-memory while DIMENSION columns are compressed on disk, so you choose fast columns by type, not by index. Queries are eventually consistent unless you set Consistency true per query, and newer regions add multi-AZ writes with ReplicationEnabled.”

AWS EventBridge Advanced

Q471: How do you implement event bus?

What it is: OpenSearch Ingestion is a managed pipeline service that enriches, transforms and routes data into an OpenSearch index.

Why it is used: Gets messy formats like syslog and Netflow into an index in a form you can query and visualize.

# Create event bus
aws events create-event-bus \
  --name my-event-bus

# Add rule
aws events put-rule \
  --name my-rule \
  --event-bus-name my-event-bus \
  --event-pattern '{"source":["myapp"]}'

Interview talking point: “The pipeline must live in a VPC, never a public subnet, and needs an OpenSearch interface endpoint, an S3 log archive bucket and a role. Use an osis blueprint or a custom Logstash pipeline; scaling is update-pipeline —min-units, and capacity units drive both throughput and cost.”

AWS Step Functions Advanced

Q472: How do you implement parallel execution?

What it is: QLDB’s ledger digest requests a cryptographic digest of the journal up to a point in time, which verify-ledger-integrity rechecks against the ledger.

Why it is used: A cryptographic proof of ledger integrity for audit and compliance, verifiable by a third party holding the digest.

{
  "Comment": "Parallel execution",
  "StartAt": "Parallel",
  "States": {
    "Parallel": {
      "Type": "Parallel",
      "Branches": [
        {"StartAt": "Task1", "States": {"Task1": {"Type": "Pass", "End": true}}},
        {"StartAt": "Task2", "States": {"Task2": {"Type": "Pass", "End": true}}}
      ],
      "End": true
    }
  }
}

Interview talking point: “describe-ledger-digests returns digests with a sequence LIMIT, and verify-ledger-integrity returning VerificationResult false means a record was altered or deleted. Export digests somewhere the ledger admins cannot write, like a separate account or Object Lock bucket. Verification is proportional to journal size, so run it on a schedule.”

Q473: How do you implement wait callback?

What it is: ElastiCache Global Datastore keeps a primary Redis cluster in one region with asynchronously replicated read replicas in others, promoting one on failover.

Why it is used: Multi-region Redis with one logical dataset, so a regional failure is a replica promotion rather than a rebuild.

{
  "WaitForTaskToken": {
    "Type": "WaitForTaskToken",
    "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",
    "Parameters": {
      "FunctionName": "my-function",
      "Payload": {
        "token.$": "$$.Task.Token",
        "input.$": "$"
      }
    },
    "Next": "NextState"
  }
}

Interview talking point: “create-global-replication-group takes one remote region per group, with a replica cluster referencing the primary endpoint. failover-global-replication-group promotes the secondary, and fail-back is limited to once per period as anti-flap protection, which surprises anyone trying to fail back immediately after a test.”

AWS CloudFormation Advanced

Q474: How do you use nested stacks?

What it is: Global Datastore’s architecture is one primary region and a single secondary region, replication flowing asynchronously, with failover requiring the secondary available.

Why it is used: The multi-region Redis answer: a failover is a promotion, not a restore, which is far faster.

# Parent stack
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/templates/vpc.yaml
      Parameters:
        VPCCidr: 10.0.0.0/16

Interview talking point: “Only one remote region is allowed per Global Datastore group, and the secondary must be available before failover or the call errors naming its state. Fail-back is limited to once per day per group, deliberate anti-flap protection that surprises people mid-test. Engine is Redis or Valkey.”

Q475: How do you use stack sets for cross-account?

What it is: A CloudFormation StackSet deploys one template across many accounts and regions from a single management-account operation.

Why it is used: Enforces standards across the whole account estate instead of deploying per account by hand.

# Create stack set
aws cloudformation create-stack-set \
  --stack-set-name cross-account-vpc \
  --template-body file://vpc.yaml \
  --permission-model SELF_MANAGED

# Add accounts
aws cloudformation create-stack-instances \
  --stack-set-name cross-account-vpc \
  --accounts '["111111111111","222222222222"]' \
  --regions '["us-east-1"]'

Interview talking point: “SERVICE_MANAGED with a delegated administrator lets the management account operate on member accounts, who can see but not alter the shared set. NO_STACK_UPDATE stops members editing it, and RetainStacksOnAccountRemoval false stops account removal orphaning stacks you then have to clean up manually.”

AWS CDK Advanced

Q476: How do you implement custom construct?

What it is: CDK is code-first infrastructure as code: Python, TypeScript, Java, Go or C# constructs that synthesize to CloudFormation.

Why it is used: For when YAML templates get too verbose for real logic like loops, conditionals and reusable components.

# `class My VPC(core.Construct):` is INVALID PYTHON -- an identifier cannot
# contain a space, so this raises SyntaxError before anything runs.
# Also `core.*` is CDK v1; in v2 constructs come from the aws_cdk top level.
from aws_cdk import Construct, Stack as CdkStack
from aws_cdk import aws_ec2 as ec2

class VpcStack(CdkStack):
    def __init__(self, scope: Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        self.vpc = ec2.Vpc(self, "VPC", cidr="10.0.0.0/16")

Interview talking point: “class My VPC(core.Construct) is invalid Python, identifiers cannot contain a space, and raises SyntaxError before anything runs; the correct shape is class VpcStack(CdkStack). core.* imports are CDK v1, while v2 constructs come from the top-level aws_cdk module or you get ModuleNotFoundError.”

Q477: How do you use CDK pipelines?

What it is: The CDK CLI bootstraps an environment, synthesizes templates with cdk synth and deploys them through CloudFormation with cdk deploy.

Why it is used: The workflow tool around CDK, covering environment bootstrapping, diffing and fast feedback.

from aws_cdk import pipelines

pipeline = pipelines.CodePipeline(
    self, "Pipeline",
    synth=pipelines.ShellStep("Synth",
        commands=["npm ci", "cdk synth"]
    )
)

Interview talking point: “cdk bootstrap aws://account/region runs once per account and region and is commonly forgotten, with the error This CDK deployment requires bootstrap. cdk diff previews changes before deploy, and context lookups like Vpc.fromLookup write cdk.context.json, which must be committed or every developer gets different results.”

AWS SAM Advanced

Q478: How do you use layers in SAM?

What it is: A SAM template is CloudFormation plus AWS::Serverless resources, where the transform fills in the IAM, the API Gateway integration and permissions.

Why it is used: Declares functions, APIs and tables in YAML with far less boilerplate than raw CloudFormation.

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: python3.9
      Layers:
        - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:my-layer:1

Interview talking point: “The Serverless resources expand into ordinary CloudFormation at transform time, so review the transformed template before trusting it. A function’s Layers property takes a version-qualified layer ARN such as layer:my-layer:1, which pins every deployment to the same layer version.”

Q479: How do you use local testing in SAM?

What it is: SAM packaging uploads local artifacts to S3 and rewrites the template paths, then hands the packaged template to CloudFormation for deployment.

Why it is used: Gets local code into a deployable template without hand-maintaining S3 keys in your template.

# Start local API
sam local start-api

# Invoke function locally
sam local invoke MyFunction

# Generate sample event
sam local generate-event apigateway http-api-get > event.json

Interview talking point: “The flow is sam build, then sam package —s3-bucket, then sam deploy, and you need build first or the package step uploads raw source. sam deploy —guided writes samconfig.toml, and CloudFormation refuses IAM resources without CAPABILITY_IAM. Metadata BuildMethod picks esbuild or makefile for faster builds.”

AWS CodeCommit

Q480: How do you create repository?

What it is: CloudFormation intrinsic functions resolve values inside a template: Ref for a resource or parameter, GetAtt for attributes, Sub for substitution, Join to concatenate.

Why it is used: Builds dynamic templates that reference resources created earlier instead of hard-coding ARNs.

# Create repository
aws codecommit create-repository \
  --repository-name my-repo \
  --repository-description "My repository"

Interview talking point: “Ref returns a bucket name for AWS::S3::Bucket but the ARN for AWS::SQS::Queue, so for SQS you need Fn::GetAtt [Queue, Arn]. Fn::Sub also expands pseudo-parameters like ${AWS::Region}, and you cannot Ref a nested-stack resource without Outputs export plus Fn::ImportValue.”

AWS CodeArtifact

Q481: How do you create CodeArtifact domain?

What it is: AWS::Lambda::Permission grants an AWS service permission to invoke a Lambda by modifying the function’s resource-based policy.

Why it is used: Lets API Gateway, EventBridge, S3 or another service invoke the function, which identity policies alone cannot express.

# Create domain
aws codeartifact create-domain \
  --domain my-domain

Interview talking point: “An identity policy attaches to a principal, a resource policy to the resource; either suffices in-account, while cross-account access generally needs both. SAM often emits Principal: *, which is why SAM-created APIs are sometimes world-invocable, so the safe pattern is a SourceArn condition scoped to the specific API or bucket.”

Q482: How do you create CodeArtifact repository?

What it is: Stack outputs are the values a stack exposes to other stacks through Outputs and the Export and Fn::ImportValue pair.

Why it is used: Compose stacks, a network stack exports a VPC ID an application stack imports, instead of one huge template.

# Create repository
aws codeartifact create-repository \
  --domain my-domain \
  --repository my-repo

Interview talking point: “Export names must be unique per account per region, so prefix them with ${AWS::StackName}. Deleting a stack whose export is still imported fails, and you cannot update a value under an existing export name, the classic why can’t I update this stack answer. SSM Parameter Store avoids these constraints.”

AWS X-Ray Advanced

Q483: How do you implement custom sampling?

What it is: CloudFormation drift detection compares the actual state of stack resources against the template to find changes made outside CloudFormation.

Why it is used: Keeps infrastructure-as-code trustworthy when console edits happen and nobody reverts them.

{
  "rules": [
    {
      "description": "Sample 10% of requests",
      "fixed_rate": 0.1,
      "host": "*",
      "http_method": "*",
      "url_path": "*",
      "version": 1
    }
  ]
}

Interview talking point: “Drift detection only reads, it never reverts. Fix drift with update-stack to reassert the template value, or resource import to bring an unmanaged drifted resource under template management. The frequent real finding is a security group rule someone opened weeks ago for debugging, which is why it is a control.”

AWS Cost Anomaly Detection

Q484: How do you set up Cost Anomaly Detection?

What it is: CloudFormation StackSets plus Stack Instances: the set holds a template and permission model, each instance deploys it into one account and region.

Why it is used: Roll a template out to many accounts and update it once to propagate to every instance.

# Create anomaly monitor
# The CLI prefix is `aws ce`, not `aws cost-explorer`.
aws ce create-anomaly-monitor \
  --anomaly-monitor '{
    "MonitorName": "my-monitor",
    "MonitorType": "DIMENSIONAL",
    "MonitorDimension": "SERVICE"
  }'

aws ce create-anomaly-subscription \
  --subscription-name my-sub \
  --frequency DAILY \
  --monitor-arn-list '["arn:aws:ce:us-east-1:123456789012:anomalymonitor/my-monitor"]' \
  --subscribers '[{"Address":"ops@example.com","Type":"EMAIL"}]'

Interview talking point: “StackSet calls use the aws cloudformation prefix, while cost and usage APIs use aws ce, not aws cost-explorer. Self-managed sets need set-configuration with FailureTolerancePercentage and MaxConcurrentPercentage before instances deploy, and propagate updates with FailureToleranceCount 0 so you fail cleanly instead of leaving half the accounts behind.”

AWS Compute Optimizer

Q485: How do you enable Compute Optimizer?

What it is: CloudFormation hooks intercept stack operations with a Lambda, so you can validate, transform or block a deployment before it happens.

Why it is used: Enforces policy in the pipeline, rejecting a bad template before deploy rather than discovering it after.

# Opt-in to Compute Optimizer
aws compute-optimizer update-enrollment-status \
  --status Active

Interview talking point: “A pre-create hook can modify the incoming template fragment and return it, which is how you inject defaults; a post-create hook validates what was created and fails the stack. Hooks run for every matching operation with your role, so scope HookFilters and TargetStacks tightly or large templates crawl.”

AWS Trusted Advisor

Q486: How do you check Trusted Advisor?

What it is: Change sets let you stage a set of changes and inspect exactly what will be added, changed, replaced or removed before executing.

Why it is used: The safety step for any deployment that could replace or delete something.

# Get Trusted Advisor checks
aws support describe-trusted-advisor-checks \
  --language en

# Get specific check
aws support describe-trusted-advisor-check-result \
  --check-id check-id \
  --language en

Interview talking point: “The two words that matter: —on-stack-failure DELETE and —no-fail-on-empty-changeset on execute-change-set and deploy, so automation never deletes a production stack because a template was emptied. Named IAM roles need CAPABILITY_NAMED_IAM, and update-stack —use-previous-template makes a re-run after adding a parameter safe.”

AWS Service Health Dashboard

Q487: How do you check service health?

What it is: DeletionPolicy Retain and UpdateReplacePolicy tell CloudFormation what to do with a resource when the stack is deleted or the resource is replaced.

Why it is used: So stateful resources like databases, buckets and volumes survive a stack deletion or an unavoidable replacement.

# Get health status
aws health describe-events \
  --filter '{"service":"EC2"}'

Interview talking point: “DeletionPolicy defaults to Delete, which is how an RDS instance gets silently deleted and a non-empty versioned bucket blocks a stack deletion. RetainExceptOnCreate deletes on create-failure but retains otherwise, and retained resources then show as orphaned with no stack, needing manual cleanup. This is the field to name for keeping your database.”

AWS Personal Health Dashboard

Q488: How do you check affected resources?

What it is: SSM Change Manager creates change records summarising the affected entities, with an approval workflow that drives automation tasks for the change.

Why it is used: Gives infrastructure changes an approval process with an audit trail, so who approved what and why is answerable.

# Get affected entities
aws health describe-affected-entities \
  --filter '{"eventArns":["arn:aws:health:us-east-1::event/"]}'

Interview talking point: “Approval runs as a separate automation execution calling the approval API for the first approver, and the affected-entities filter uses {“eventArns”:[…]} with every entity currently valid or the request fails to create. It is often more ceremony than engineering value, so a manual approval stage in CodePipeline is the lighter alternative.”

AWS Config Advanced

Q489: How do you use conformance packs?

What it is: A custom Config conformance pack is your own set of Config rules grouped into a pack you deploy like AWS-managed standards.

Why it is used: Makes your internal security policy an auditable, continuously evaluated standard rather than a wiki page.

# Create conformance pack
# The CLI prefix is `config`, not `configservice`, and the S3 template
# parameter is --s3-template-uri (there is no --template-s3-uri).
aws config put-conformance-pack \
  --conformance-pack-name security-baseline \
  --s3-template-uri s3://bucket/template.yaml \
  --no-include-global-resource-types

# Every ConfigRuleName in the pack must already exist in the account, or
# the put fails with InvalidParameterValue.

Interview talking point: “The CLI prefix is config, not configservice, and the flag is —s3-template-uri, not —template-s3-uri. Every ConfigRuleName must already exist in the account or the put fails with InvalidParameterValue, and since cost is per rule evaluation, scope rules by tag or resource type.”

AWS Network Manager

Q490: How do you set up Network Manager?

What it is: describe-discovered-resources lists the configuration items Config has recorded, and get-resource-config-history returns a resource’s configuration over time.

Why it is used: Answers what a resource looked like on date X, which CloudTrail cannot, since it records API calls instead.

# Create global network
aws networkmanager create-global-network \
  --description "My global network"

Interview talking point: “You need the physical resource ID, not the resource name or ARN, and history lags the recorder. Contrast with CloudTrail lookup-events: 90 days of who called what versus a year of what the resource looked like, stored in an S3 bucket you control.”

Questions 491-600 continue with more hands-on scenarios and real-world examples…