AWS · Intermediate interview

A cold start is the latency when Lambda initializes a new execution environment (download code, start the runtime, run init) for the first request or when scaling out; subsequent 'warm' invocations reuse it. You mitigate with provisioned concurrency (pre-warmed environments), smaller deployment packages and lighter runtimes, keeping initialization minimal, and avoiding VPC-attached functions where unnecessary. Cold starts matter most for latency-sensitive, spiky workloads.

API Gateway is a managed service that fronts HTTP/REST or WebSocket APIs, handling routing, request validation, throttling, auth (e.g. with Cognito or IAM), and integration with backends like Lambda. The common serverless pattern is API Gateway → Lambda → data store, giving you a scalable API without managing servers. It also provides usage plans, API keys, and caching.

Components react to events instead of calling each other directly: an S3 upload triggers a Lambda, a DynamoDB stream fans out changes, SNS/EventBridge broadcasts events, and SQS buffers work for consumers. This decouples producers from consumers, scales each part independently, and absorbs spikes. The trade-off is eventual consistency and harder end-to-end tracing, addressed with good observability.

RDS is managed relational (Postgres/MySQL etc.) — choose it for relational data, complex queries/joins, transactions, and flexible ad-hoc querying. DynamoDB is a managed NoSQL key-value/document store — choose it for massive scale, predictable single-digit-millisecond latency, high write throughput, and access patterns known in advance. The decision hinges on query flexibility and relational needs (RDS) vs scale and predictable access patterns (DynamoDB).

DynamoDB items are located by a partition key (which determines the physical partition, so it must distribute load) and optionally a sort key for ranges within a partition. You design tables around access patterns, often using secondary indexes (GSIs/LSIs) and single-table design. Capacity is provisioned or on-demand; a poorly chosen partition key causes hot partitions that throttle. You query by keys, not arbitrary fields, so modeling up front is essential.

ElastiCache (Redis/Memcached) is a managed in-memory cache you put in front of databases to serve hot reads with sub-millisecond latency and offload the database. DAX is a DynamoDB-specific in-memory cache for read-heavy DynamoDB workloads. Caching reduces latency and cost and absorbs read spikes, with the usual challenge of invalidation and choosing TTLs to balance freshness against hit rate.

SQS is a queue: messages are processed by one consumer (work distribution), with retries and a dead-letter queue. SNS is pub/sub: a message fans out to many subscribers (topics → multiple endpoints). EventBridge is an event bus with rich routing/filtering rules and many AWS/SaaS integrations, suited to event-driven architectures and schema-based routing. Roughly: SQS to decouple/buffer work, SNS to broadcast, EventBridge to route events by rules.

Putting an SQS queue between a producer and consumer lets them scale and fail independently: the producer enqueues quickly without waiting, the consumer processes at its own pace, spikes are buffered, and failed messages retry or go to a dead-letter queue. The classic pattern is fronting slow work (image processing, emails) with a queue so the user-facing request returns fast. The cost is eventual consistency and added operational pieces.

AWS Step Functions orchestrate multi-step workflows as a state machine — sequencing Lambda functions and service calls with built-in retries, error handling, parallelism, and waits. They're ideal for long-running or complex processes (order fulfillment, ETL, approval flows) where you want visible, durable orchestration instead of chaining Lambdas manually. The trade-off is added cost and another service, justified when coordination logic gets complex.

You split the VPC's address space into public subnets (with a route to an Internet Gateway, for load balancers and bastions) and private subnets (no direct internet route, for app servers and databases). Private resources reach the internet outbound via a NAT Gateway in a public subnet. You spread subnets across AZs for HA and use security groups and route tables to control traffic — keeping databases and app tiers private is a core security practice.

Long-lived access keys are a leak risk and hard to rotate. IAM roles provide temporary, automatically-rotated credentials: an EC2 instance, Lambda, or container assumes a role and gets short-lived credentials via STS, so no secrets are baked into code. Cross-account and federated access also use AssumeRole. The best practice is roles everywhere, least-privilege policies, and no static keys in application code.

IaC defines your infrastructure declaratively in version-controlled templates — CloudFormation (native), the CDK (in real programming languages), or Terraform — so environments are reproducible, reviewable, and automated rather than click-configured. It enables consistent dev/staging/prod, easy teardown/recreate, and change tracking. The shift is treating infrastructure like software: code-reviewed, tested, and deployed through pipelines.