AWS · Beginner interview

AWS is Amazon's cloud platform offering on-demand compute, storage, databases, networking, and managed services billed pay-as-you-go. The benefits are elasticity (scale up/down with demand), no upfront hardware cost, global reach, managed services that reduce operational burden, and faster delivery. You trade some control and a recurring cost for agility and removing undifferentiated infrastructure work.

A region is a geographic area (e.g. us-east-1) containing multiple, isolated availability zones. An availability zone (AZ) is one or more discrete data centers with independent power and networking within a region. You deploy across multiple AZs for high availability (an AZ failure doesn't take you down) and choose regions for latency to users, data residency, and service availability.

AWS secures the cloud itself — the physical infrastructure, hardware, and managed-service software ('security of the cloud') — while you're responsible for what you put in it: your data, IAM configuration, OS/patching on EC2, network rules, and encryption ('security in the cloud'). The line shifts with the service — more managed services (e.g. Lambda, S3) put more on AWS. Knowing where the boundary is prevents misconfiguration.

EC2 (Elastic Compute Cloud) provides resizable virtual servers (instances) you launch from an AMI, choosing an instance type sized for CPU/memory/network. You manage the OS and software, making it flexible for almost any workload, and pay per running time. Instance families are optimized for general purpose, compute, memory, or storage workloads.

EC2 gives you a server you manage and that runs continuously (you pay while it's up). Lambda is serverless: you upload a function and AWS runs it on demand in response to events, scaling automatically and billing only for execution time, with no servers to manage. EC2 suits long-running or stateful workloads and full control; Lambda suits event-driven, spiky, or short tasks where you don't want to manage infrastructure.

An Auto Scaling group adds or removes EC2 instances automatically based on demand or schedule, keeping capacity matched to load and replacing unhealthy instances. An Elastic Load Balancer distributes incoming traffic across those instances (across AZs) and routes around unhealthy ones. Together they give horizontal scalability and high availability for a tier of servers.

S3 (Simple Storage Service) is object storage for files ('objects') organized in buckets, accessed via API/URL, with very high durability (designed for 11 nines) and effectively unlimited scale. It's used for static assets, backups, data lakes, logs, and serving static websites. It's not a filesystem or block storage — it's flat object storage addressed by key.

Storage classes trade cost against access speed/frequency: S3 Standard for frequently accessed data; Standard-IA / One Zone-IA for infrequently accessed; Glacier and Glacier Deep Archive for cheap long-term archival with retrieval delay; and Intelligent-Tiering, which moves objects between tiers automatically based on access patterns. You pick a class (or lifecycle rules to transition objects) to cut cost for data you rarely read.

EBS is block storage — a virtual disk attached to a single EC2 instance, for OS and databases. S3 is object storage — independent, infinitely scalable, accessed via API, for files and backups. EFS is a managed network file system (NFS) that multiple instances can mount and share concurrently. You choose block (EBS) for a single instance's disk, file (EFS) for shared POSIX access, and object (S3) for scalable file storage.

IAM (Identity and Access Management) controls who can do what in your AWS account. Users and roles are identities; policies (JSON documents) grant or deny permissions on resources. Roles provide temporary credentials to services and federated users without long-lived keys. The guiding principle is least privilege — grant only the permissions needed — and using roles over hardcoded access keys.

A VPC (Virtual Private Cloud) is your isolated virtual network in AWS where you launch resources, defined by an IP range and divided into subnets (typically public subnets with internet access and private subnets without). You control routing, internet/NAT gateways, and security. It's the networking foundation that isolates and secures your infrastructure.

A security group is a stateful firewall at the instance/ENI level — you define allow rules, and return traffic is automatically permitted. A network ACL is a stateless firewall at the subnet level with ordered allow and deny rules, where you must permit both directions explicitly. Security groups are the primary, everyday control; NACLs add a coarse subnet-level layer, often for explicit deny rules.