AWS Cloud Architect Interview Prep

EC2: Virtual servers with full control over OS and configuration. Best for applications requiring specific OS configurations, long-running workloads, or when you need persistent storage.

Lambda: Serverless compute that runs code in response to events. Best for event-driven workloads, short-running tasks (up to 15 min), and when you want zero server management.

Fargate: Serverless containers without managing servers. Best for containerized applications where you want container benefits without cluster management.

S3 Standard: Frequently accessed data, low latency, high throughput.

S3 Intelligent-Tiering: Unknown or changing access patterns - automatically moves data between tiers.

S3 Standard-IA: Infrequently accessed but requires rapid access when needed.

S3 One Zone-IA: Infrequent access, lower cost, data stored in single AZ.

S3 Glacier Flexible Retrieval: Archive data with retrieval times of minutes to hours.

S3 Glacier Deep Archive: Lowest cost, retrieval times of 12-48 hours.

RDS: Managed relational database service supporting MySQL, PostgreSQL, Oracle, SQL Server, MariaDB. Good for traditional relational workloads with predictable scale.

Aurora: AWS-built relational database compatible with MySQL/PostgreSQL. 6x the throughput of MySQL and PostgreSQL, with automated scaling up to 256 TiB. Best for high-performance relational workloads.

DynamoDB: Fully managed NoSQL key-value and document database. Single-digit millisecond latency at any scale. Best for high-scale, low-latency workloads with flexible schema requirements.

Key components:

• Route 53 for DNS with health checks and failover routing
• CloudFront CDN for static content and edge caching
• Application Load Balancer across multiple AZs
• Auto Scaling Group with EC2 instances in multiple AZs (or ECS/EKS)
• RDS Multi-AZ or Aurora for database with read replicas
• ElastiCache for session management and caching
• S3 for static assets and user uploads
• WAF for web application firewall protection

Components:

• API Gateway for HTTP endpoints, or AppSync for GraphQL
• Lambda functions for business logic
• EventBridge for event routing and scheduling
• SQS for decoupling and buffering
• SNS for fan-out patterns and notifications
• Step Functions for orchestrating complex workflows
• DynamoDB for NoSQL data with streams for CDC
• S3 with event notifications for file processing

Patterns to mention: Event sourcing, CQRS, saga pattern, fan-out/fan-in, dead letter queues for error handling.

DR Strategies (in order of cost/complexity):

• Backup & Restore: Lowest cost, highest RTO. Regular backups to S3, restore when needed.
• Pilot Light: Core components running in DR region, scale up during failover.
• Warm Standby: Scaled-down version running in DR region, scale up during failover.
• Active-Active: Full deployment in both regions with traffic routing. Lowest RTO/RPO, highest cost.

Key services: Route 53 (failover routing), Aurora Global Database, DynamoDB Global Tables, S3 Cross-Region Replication, AWS Backup.

AWS Responsibility (Security OF the Cloud):

• Physical security of data centers
• Hardware and infrastructure
• Network infrastructure
• Virtualization layer

Customer Responsibility (Security IN the Cloud):

• IAM and access management
• Data encryption (at rest and in transit)
• Network configuration (Security Groups, NACLs)
• OS patching and updates
• Application security

Best practices:

• Start with no permissions and add only what's needed
• Use IAM policies with specific actions, resources, and conditions
• Implement permission boundaries for delegated administration
• Use AWS Organizations SCPs for account-level guardrails
• Regular access reviews using IAM Access Analyzer
• Use IAM roles instead of long-term credentials
• Implement just-in-time access with IAM Identity Center
• Monitor with CloudTrail and set up alerts for privilege escalation

Data at Rest:

• S3: Server-side encryption (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C)
• EBS: Encrypted volumes using KMS
• RDS: Encryption at rest using KMS
• DynamoDB: Encryption using AWS owned or customer managed keys

Data in Transit:

• TLS/SSL for all communications
• VPC endpoints for AWS service traffic
• ACM for certificate management
• VPN or Direct Connect for hybrid connectivity

Security Groups:

• Operate at instance/ENI level
• Stateful (return traffic automatically allowed)
• Only allow rules (implicit deny)
• All rules evaluated before decision

NACLs:

• Operate at subnet level
• Stateless (must define both inbound and outbound)
• Allow and deny rules
• Rules processed in order by rule number

VPC Peering:

• Simple 1:1 connection between two VPCs
• Lower cost for simple setups
• Non-transitive (can't route through peered VPCs)
• Best for: Small number of VPCs, simple connectivity

Transit Gateway:

• Hub-and-spoke model for connecting multiple VPCs
• Transitive routing supported
• Connect VPCs, VPNs, Direct Connect
• Best for: Large number of VPCs, complex routing, hybrid connectivity

Key components:

• AWS Organizations: Account management and SCPs
• Transit Gateway: Central hub for VPC connectivity
• RAM (Resource Access Manager): Share subnets across accounts
• Centralized egress VPC: NAT Gateways, inspection
• Shared services VPC: AD, DNS, monitoring tools
• Network Firewall: Centralized inspection
• Route 53 Resolver: DNS resolution across accounts

IP addressing: Plan non-overlapping CIDR ranges, use IPAM for management.

Key strategies:

• Rightsizing: Use Compute Optimizer to identify underutilized resources
• Reserved Instances/Savings Plans: Commit to 1-3 year terms for 30-72% savings
• Spot Instances: For fault-tolerant workloads, up to 90% savings
• S3 lifecycle policies: Move data to cheaper storage classes
• Auto Scaling: Scale down during low demand
• Delete unused resources: EBS snapshots, unattached volumes, idle load balancers
• Use managed services: Often cheaper than self-managed

Reserved Instances:

• Commitment to specific instance type, region, OS
• Standard RIs less flexible, Convertible RIs can change attributes
• Available for EC2, RDS, ElastiCache, Redshift, OpenSearch

Savings Plans:

• Commitment to $/hour spend, more flexibility
• Compute Savings Plans: Apply across EC2, Lambda, Fargate
• EC2 Instance Savings Plans: Specific to instance family in a region
• Generally recommended over RIs for most use cases

Use the STAR method:

• Situation: Describe the context and challenge
• Task: Your responsibility in the situation
• Action: What you did, focusing on trade-off analysis
• Result: Quantifiable outcomes

Good topics: Cost vs performance trade-offs, build vs buy decisions, migration strategies, handling tech debt.

Good answers include:

• AWS re:Invent sessions and announcements
• AWS blogs and What's New feed
• AWS certifications and recertification
• Hands-on experimentation in personal/sandbox accounts
• Community involvement (user groups, forums)
• Following AWS Heroes and Community Builders
• Reading architecture whitepapers

Key points to cover:

• Use analogies and real-world comparisons
• Focus on business outcomes, not technical details
• Use visual aids and diagrams
• Translate technical benefits to business value (cost savings, time to market, risk reduction)
• Check for understanding and adjust explanation

Example: Explaining multi-AZ deployment as "having a backup generator that kicks in automatically if the power goes out."