AWS basics interview questions

A region is a geographic area, and it contains several Availability Zones, each made of one or more isolated data centres. I would say: I choose the region for latency and data location needs, and I spread servers across zones in that region for high availability.

I would create an IAM role with a policy that allows only the needed S3 actions on that bucket, then attach the role to the instance. The application gets temporary credentials automatically, so there are no access keys stored on the server.

AWS is responsible for security of the cloud, such as data centres, hardware and the virtualisation layer. The customer is responsible for security in the cloud, such as patching the EC2 operating system, security group rules, IAM permissions and data encryption choices. With a managed service like RDS, AWS also patches the database engine, but I still control who can connect.

A security group is attached to resources, has allow rules only and is stateful, so replies are allowed automatically. A network ACL is attached to a subnet, has numbered allow and deny rules and is stateless, so return traffic needs its own rule. In practice I do most filtering with security groups.

On-demand fits short, new or unpredictable workloads because there is no commitment. Reserved Instances or Savings Plans fit steady workloads that will run for one to three years. Spot fits fault-tolerant jobs, like batch processing, that can handle being interrupted.

I read the error to see which action and resource were denied, then check the user's policies, group policies and any explicit deny statements, since an explicit deny overrides allows. I also check resource policies such as the bucket policy. Then I add only the specific missing permission instead of a broad one.