IAM, which comes up in every loop
- Roles versus users versus policies, and why application code should assume a role rather than hold keys.
- How does an EC2 instance or a container get credentials without any being stored?
- Resource-based versus identity-based policies, and how an explicit deny interacts with an allow.
- How would you find over-permissioned roles across an organisation?
- What do you do about a leaked access key? Revoke first, then rotate, then audit what it touched.
Networking
- VPC basics: public and private subnets, route tables, internet gateway versus NAT gateway.
- Security groups versus network ACLs - stateful against stateless, and which is evaluated first.
- How does something in a private subnet reach the internet, and how do you avoid paying for a NAT gateway you do not need?
- VPC endpoints, and why they matter for both cost and security.
Choosing services
- EC2 versus ECS versus Lambda for a given workload, with the trade-offs stated.
- When is Lambda the wrong answer? Long-running work, predictable high throughput where cost inverts, and cold-start-sensitive latency.
- S3 storage classes and lifecycle policies.
- RDS versus DynamoDB - and the access-pattern question that decides it.
- SQS versus SNS versus EventBridge - queue, fan-out, and routing.
The architecture scenario
Expect an open prompt: design a resilient web application, or make this single-region system multi-AZ. Work through availability zones and failover, where state lives, how traffic is routed, how it scales, and what you monitor. Then say what you would not build yet. The general structure is in the system design cheat sheet, and the operational half overlaps heavily with DevOps interview questions.
How deep it goes by level
- Junior: the fundamentals above, explained clearly. Nobody expects production scars yet, and honesty about what you have not done reads better than bluffing.
- Mid-level: the same ground, plus an architecture you have operated. Expect follow-ups asking why you made a particular choice rather than whether you know the syntax.
- Senior: a cost reduction you drove, and an outage you were on call for. At this level the language questions get shorter and the judgement questions get longer.
Whatever the level, the reliable way to prepare is to say your answers out loud rather than reading them. Most of what candidates lose in a AWS interview is lost in the gap between knowing something and explaining it under observation - the method is in how to use AI for interview prep.
Where CoPilot Interview fits
Disclosure: we build an interview assistant, so treat this as a disclosed pitch. CoPilot Interview is a native Windows and macOS app that puts suggested answers on your own screen in about two seconds, across coding, system design and behavioral rounds, with a permanent free tier that needs no credit card.
Frequently asked questions
What are the most common AWS interview questions?
IAM roles versus users and how instances get credentials, VPC subnet and gateway design, security groups versus network ACLs, choosing between EC2, ECS and Lambda, and a resilience scenario such as making a system multi-AZ.
How does an EC2 instance get AWS credentials securely?
Through an instance profile attached to an IAM role - the instance retrieves temporary credentials from the metadata service and they rotate automatically. Storing long-lived access keys on an instance is the anti-pattern the question is testing for.
What is the difference between a security group and a network ACL?
Security groups are stateful and attach to resources, so return traffic is automatically allowed. Network ACLs are stateless and attach to subnets, so you must permit both directions explicitly. NACLs are evaluated at the subnet boundary before security groups.
When is Lambda the wrong choice?
For long-running work that exceeds the execution limit, for steady high-throughput workloads where provisioned compute is cheaper, and for latency-sensitive paths where cold starts matter. Saying where it does not fit signals judgement rather than enthusiasm.
Walk into the round with a second pair of eyes
CoPilot Interview is a native Windows and macOS app that puts suggested answers on your own screen in about two seconds, across coding, system design and behavioral rounds. The free tier is permanent: 15 minutes a day, no credit card.
Try it free