Interview Q&A / AWS & Cloud

1. What is the difference between IAM users, groups, roles and policies in AWS?

   A user is an identity for one person or app with long-term credentials. A group is a set of users that share permissions. A role is an identity that anyone or anything trusted can assume to get temporary credentials. A policy is the JSON document that says what is allowed or denied. Grant only the permissions needed, which is least privilege.

   BeginnerIn-depth4 min read
2. What is the difference between a security group and a network ACL in AWS?

   A security group is a stateful firewall attached to an instance's network interface, with allow rules only. A network ACL is a stateless firewall on a subnet, with numbered allow and deny rules checked in order. Because NACLs are stateless, you must allow return traffic explicitly, usually on ephemeral ports.

   IntermediateIn-depth4 min read
3. How should you protect and use the AWS account root user?

   Enable MFA on the root user, do not create access keys for it, and use it only for the few tasks that need it. For daily work use IAM Identity Center or IAM users and roles with least privilege.

   BeginnerQuick answer1 min read
4. What does the AWS shared responsibility model mean in practice for EC2, RDS and S3?

   AWS is responsible for security of the cloud: facilities, hardware and the managed service layers. You are responsible for security in the cloud: your data, access control, and configuration. The more managed the service, the more AWS handles.

   BeginnerQuick answer1 min read
5. Why use an IAM role for an EC2 instance instead of storing access keys on it?

   A role gives the instance temporary credentials that AWS rotates automatically, so no long-lived secret sits on disk or in code. Access keys can leak through code repos, images or logs and stay valid until someone revokes them.

   BeginnerQuick answer1 min read
6. What is an S3 presigned URL and when would you use it?

   A presigned URL is a temporary link, signed with someone's credentials, that lets a person upload or download one specific S3 object without having AWS credentials. It stops working when it expires.

   IntermediateQuick answer1 min read
7. What is the difference between AWS Secrets Manager and Systems Manager Parameter Store?

   Both store configuration securely. Secrets Manager is built for secrets, with automatic rotation for supported databases and a per-secret charge. Parameter Store is simpler, has a free standard tier, and can encrypt values with KMS as SecureString.

   IntermediateQuick answer1 min read
8. What is a VPC endpoint and what is the difference between gateway and interface endpoints?

   A VPC endpoint lets resources in your VPC reach AWS services privately without an internet gateway or NAT. Gateway endpoints, for S3 and DynamoDB, are route-table entries and free. Interface endpoints use PrivateLink with a network interface and are charged.

   AdvancedQuick answer1 min read