AWS¶

What experienced AWS developers and DevOps engineers forget before an interview, grouped by subtopic; facts follow the AWS documentation. For PostgreSQL and Redis internals see postgresql.md and redis.md; for delivery semantics and retries see distributed.md; for deployment patterns and Terraform see devops.md.

Identity and access¶

Policy evaluation¶

• Requests start with an implicit deny; any applicable explicit deny wins over every allow.
• Identity and resource policies grant; permissions boundaries, session policies, and SCPs/RCPs only cap what can be granted.
• A role needs both a trust policy allowing the principal to assume it and permissions for the resulting session to perform actions.

Workload credentials¶

• Use temporary role credentials for EC2, ECS tasks, and Lambda; use OIDC federation for external CI so pipelines do not store long-lived AWS keys.
• In ECS, the task role grants the application access to AWS APIs; the execution role lets the ECS agent pull images, fetch configured secrets, and send logs.

Cross-account access¶

• Within one account, an allow in the identity policy or the resource policy suffices (KMS key policies and role trust policies are exceptions).
• Across accounts, both sides must allow: the resource policy trusts the other account or principal, and that principal's identity policy grants the action.
• Third parties assume your role with an sts:ExternalId condition, preventing the confused-deputy problem.
• aws:PrincipalOrgID in a resource policy limits access to accounts in your organization.

KMS and envelope encryption¶

• GenerateDataKey returns a data key in plaintext (use it, then discard it) and wrapped under the KMS key (store it with the data) — the envelope pattern in security.md; KMS Encrypt itself takes at most 4 KB.
• Every KMS key has a key policy; IAM policies grant access only if the key policy delegates to the account.

Networking¶

Public and private subnets¶

• A subnet is public when its route table points internet-bound traffic to an internet gateway; an EC2 instance also needs a public address and permissive rules to receive internet traffic.
• A NAT gateway in a public subnet lets private-subnet instances initiate IPv4 internet connections; the private subnet routes outbound traffic to it.

Network filters and endpoints¶

• Security groups are stateful and attach to network interfaces; network ACLs are stateless and apply at subnet boundaries, so return traffic needs an explicit ACL rule.
• Gateway VPC endpoints route S3 and DynamoDB traffic without a NAT device or internet gateway; interface endpoints use private IPs and AWS PrivateLink for supported services.

ALB vs NLB¶

Gateway Load Balancer inserts inline appliances such as third-party firewalls.

Connecting VPCs¶

Route 53 routing¶

• Policies: simple, weighted (canary), latency, failover (with health checks), geolocation, geoproximity, multivalue.
• Alias records work at the zone apex (example.com → ALB/CloudFront), where a CNAME isn't allowed; queries are free when the target is an AWS resource, but billed when it is a plain record in the same zone.

Compute¶

Workload choice¶

Lambda limits and concurrency¶

• Maximum timeout 15 minutes; synchronous payloads 6 MB each way (quotas; streamed responses allow more).
• Reserved concurrency guarantees capacity and caps a function; provisioned concurrency pre-initializes environments to reduce startup latency and incurs separate charges.

Lambda cold starts and scaling¶

• A cold start downloads code, starts the runtime, and runs init code; the INIT phase is billed since August 2025.
• Reduce it with provisioned concurrency or SnapStart (Java, Python, .NET), which restores a snapshot of an initialized environment — make sure randomness and connections are recreated after restore.
• Default 1,000 concurrent executions per account per Region; each function scales by up to 1,000 more every 10 seconds.

API Gateway vs ALB¶

• API Gateway REST API: auth, throttling, usage plans, request validation; integration timeout 29 s by default (raisable for Regional and private APIs, see quotas).
• HTTP API: cheaper, JWT/Lambda/IAM authorizers and throttling, but no usage plans or request validation; integration timeout max 30 s (quotas).
• ALB in front of Lambda or containers can authenticate via OIDC/Cognito but has no throttling, usage plans, or validation; LCU pricing is usually cheaper at sustained high volume.

Storage and databases¶

S3 consistency and versions¶

• S3 has strong read-after-write consistency for object PUT and DELETE, including list results; a successfully written object is immediately readable.
• With versioning, deleting an object without a version ID adds a delete marker; deleting a specific version permanently removes it. Lifecycle rules can expire noncurrent versions.
• A presigned URL grants temporary access using the signer's permissions and expires no later than the credentials used to sign it.

S3 access and CloudFront¶

• New buckets block public access and disable ACLs (bucket owner enforced) by default since April 2023; objects are encrypted with SSE-S3 by default since January 2023.
• Serve a private bucket through CloudFront with Origin Access Control, which replaces the legacy OAI; the bucket policy allows only that distribution.
• CloudFront signed URLs or signed cookies gate private content at the edge; S3 presigned URLs bypass the CDN.

S3 performance and classes¶

• Each prefix supports about 3,500 writes and 5,500 reads per second; spread hot keys over prefixes.
• Classes trade storage price against retrieval cost and latency: Standard → Standard-IA → Glacier Instant/Flexible/Deep Archive; Intelligent-Tiering moves objects automatically.

Block and shared files¶

• EBS is block storage attached to EC2 instances in the same Availability Zone; Multi-Attach works only for eligible volumes and instances and requires a clustered filesystem for simultaneous writes.
• EFS is shared file storage mountable by instances across Availability Zones in one Region.

Managed database behavior¶

• An RDS Multi-AZ DB instance uses a synchronous standby for failover; that standby does not serve reads. Use a read replica or Multi-AZ DB cluster for read scaling.
• DynamoDB reads are eventually consistent by default; strong reads are available on tables and local secondary indexes, not GSIs.
• DynamoDB global tables support multi-Region eventual and multi-Region strong consistency (strong since June 2025).

Aurora storage¶

• The storage volume keeps 6 copies across 3 AZs; a write needs 4 of 6, so writes survive losing an AZ; the 3-of-6 read quorum survives an AZ plus one more copy.
• Normal reads go to one storage node known to be current; quorum reads are only needed during recovery.
• Up to 15 replicas share the same storage volume, so replica lag is usually well under 100 ms and failover doesn't copy data.

DynamoDB partitions and indexes¶

• Each partition serves about 3,000 RCU and 1,000 WCU and holds ~10 GB; a hot partition key throttles even if table capacity is fine.
• GSIs have their own capacity and are eventually consistent; a throttled GSI throttles writes to the base table. LSIs must be defined at table creation.
• Items are at most 400 KB (quotas); transactions cover up to 100 items; TTL deletes are background work that can lag by days.

Events and workflows¶

SQS delivery¶

• A received SQS message stays in the queue but is hidden for its visibility timeout; delete it after successful processing. Expiry or duplicate delivery can expose it again, so consumers still need idempotency.
• FIFO queues order messages within a message group. A repeated deduplication ID suppresses duplicate sends only within a 5-minute window; it is not permanent business-level deduplication.

Lambda with SQS¶

• Lambda polls SQS and invokes the function with a batch; by default, one failed record makes the whole batch visible again after the visibility timeout. Enable partial batch responses to retry only failed records.
• Set the queue visibility timeout to 6× the function timeout plus the batching window (Lambda rejects anything below 1×); configure the DLQ on the SQS queue, not the Lambda asynchronous-failure destination.

Routing and orchestration¶

• SNS pushes to subscribers; EventBridge matches event patterns and routes to targets, with optional archive/replay; SQS retains work for consumers to poll.
• Step Functions Standard workflows use exactly-once execution unless a task has explicit retries; asynchronous Express is at-least-once, while synchronous Express is at-most-once. Retried external side effects still need idempotency.

Operations¶

Observability and audit¶

• CloudWatch holds metrics, logs, and alarms; CloudTrail records account API activity. CloudTrail data events such as S3 object access are not logged by default when creating a trail.
• VPC Flow Logs record accepted/rejected IP traffic metadata, not packet payloads — for debugging routes and security rules.

Infrastructure changes and secrets¶

• CloudFormation change sets preview resource replacements or deletions before execution. Standard change sets compare templates; drift-aware change sets also compare actual resource state.
• Secrets Manager can rotate a secret in both its store and the backing service; use runtime retrieval or refresh so an application picks up the new value.

Capacity and cost guardrails¶

• Service quotas are per account and Region and often stop scaling before the application does — many are soft and raised by request.
• EC2 Spot capacity can be reclaimed; stop/terminate interruption notices give about 2 minutes on a best-effort basis (hibernation starts immediately). Checkpoint work and replace capacity proactively.

Cost drivers¶

• NAT gateway data processing (~$0.045/GB in us-east-1, plus hourly) is a classic surprise; S3 and DynamoDB gateway endpoints are free and skip it.
• Cross-AZ traffic costs ~$0.01/GB in each direction, so chatty services and replicas spread across AZs add up.
• Internet egress and CloudWatch Logs ingestion (~$0.50/GB) are the other usual suspects.
• Discounts: Savings Plans and Reserved Instances (up to ~72% for 1–3 year commitments), Spot (up to ~90%), Graviton (roughly 20% cheaper per hour than comparable x86).