Interview map, not certification notes

Goal: recognize the service, explain the problem it solves, connect it to the rest of the architecture, and give one practical example.

Internet → Route 53 → ALB → VPC → private EC2 / ECS / Fargate → RDS ↘ IAM · Secrets Manager · CloudWatch · CloudTrail · S3 · SQS/SNS ↘ Terraform describes and recreates the infrastructure

P1 · interview coreP2 · useful nextP3 · recognize by name

Region vs Availability Zone

Region = geographic area · AZ = isolated location inside a Region

A Region contains multiple Availability Zones. Spreading workloads across AZs improves resilience against a single-AZ failure.

“I choose a Region for latency, compliance and service availability, then use multiple AZs when the workload needs high availability.”

Ping-pong: Why would two EC2 instances in the same AZ still be a risk?

Shared Responsibility Model

AWS secures the cloud · customer secures what runs/configures in the cloud

AWS operates facilities, hardware and core cloud infrastructure. The customer still owns identity, data, application security and much of the resource configuration.

Ping-pong: Who is responsible for an overly permissive Security Group?

IaaS vs managed vs serverless

More control ↔ less operational work

EC2: VM / IaaS-like control.
Beanstalk / App Runner: more managed deployment.
Lambda: code per event without managing servers.

Managed Service

AWS operates more of the undifferentiated infrastructure

RDS manages database infrastructure tasks; Fargate removes container-host management; Lambda removes server management almost entirely.

“Managed does not mean no responsibility; I still own configuration, permissions, data and application behavior.”

IAM

Who can do what on which AWS resource?

IAM manages identities and permissions. Think users/groups for people and roles for temporary permissions assumed by people, AWS services or workloads.

“IAM is the authorization layer around AWS resources. I would design for least privilege and prefer temporary role credentials over long-lived keys.”

User vs Group vs Role

User = identity · Group = collection · Role = assumable permissions

An EC2 instance, ECS task or Lambda function can assume a role instead of storing AWS access keys.

Ping-pong: How should an EC2 application access S3 without hardcoded AWS keys?

IAM Policy

Effect + Action + Resource + optional Condition

Policies grant or deny permissions. Start narrow, grant only required actions and resources, and use conditions when useful.

“Least privilege means only the permissions required for the job, not AdministratorAccess because it is convenient.”

Secrets Manager / KMS

Secrets Manager stores secrets · KMS manages encryption keys

Avoid secrets in source code, images or Terraform configuration. Give workloads permission to retrieve only what they need.

VPC

Your logically isolated network in AWS

A VPC defines the network boundary and IP range. Inside it you create subnets, routing and security controls.

“I think of a VPC as my private AWS network, with CIDR ranges, subnets, routes and security rules.”

CIDR

Defines an IP address range

Example: 10.0.0.0/16 for a VPC, then smaller ranges such as 10.0.1.0/24 for subnets. Avoid overlapping ranges when networks may later connect.

Public vs Private Subnet

Public = route to Internet Gateway · Private = no direct route to IGW

Private subnets keep workloads from being directly internet-routable. Outbound internet access can be provided through NAT.

Ping-pong: Where would you normally place an RDS database?

Route Table

Destination network → next hop

Typical routes: 0.0.0.0/0 → Internet Gateway for a public subnet or 0.0.0.0/0 → NAT Gateway for private outbound access.

Internet Gateway

Connects a VPC to the public internet

Attaching an IGW alone is not enough: routing, addressing and Security Group rules must also allow the traffic.

NAT Gateway

Private subnet → outbound internet without unsolicited inbound internet

Useful when private instances need package updates or external APIs but should not be directly reachable from the internet.

“NAT solves outbound internet access for private resources; it is not how users enter the application.”

Security Group vs NACL

SG = resource-level, stateful · NACL = subnet-level, stateless

Security Groups are the main virtual firewall around resources. NACLs add a subnet boundary and evaluate inbound/outbound traffic separately.

Ping-pong: Which one automatically permits return traffic for an allowed connection?

Elastic Load Balancing

One entry point → distribute traffic across healthy targets

An Application Load Balancer is common for HTTP/HTTPS and can distribute requests across EC2 instances or container tasks in multiple AZs.

Route 53

DNS and traffic routing

Maps domain names to AWS or external endpoints. Often sits in front of an ALB, CloudFront or another public service.

EC2

Virtual machine in AWS

You choose OS image, instance type, networking, storage and security. EC2 gives control but you remain responsible for OS-level administration.

“EC2 is the closest AWS equivalent to renting a VM/VPS, integrated with AWS networking, IAM, storage and monitoring.”

AMI + Instance Type

AMI = machine image · Instance type = CPU/memory/network profile

An AMI is the template used to launch an EC2 instance. The instance type defines its compute characteristics.

Auto Scaling Group

Maintain desired capacity and scale an EC2 fleet

Can add or remove instances based on policies and health. Commonly paired with an Elastic Load Balancer.

“The load balancer distributes traffic; Auto Scaling changes how many instances are available to receive it.”

Elastic Beanstalk

Deploy code with more platform management

A higher-level deployment service that can provision and manage the underlying AWS environment while exposing less infrastructure detail than raw EC2.

App Runner

Managed deployment for web apps/APIs from source or container image

Recognize it as a simpler managed path when you do not want to orchestrate the underlying compute yourself.

S3

Object storage: buckets + objects, not a mounted disk

Used for files, backups, static assets, logs and data lakes. Key ideas: permissions, versioning, lifecycle policies and storage classes.

“S3 is object storage. I access objects by key/API rather than treating it like an EC2 filesystem.”

EBS

Persistent block storage for EC2

Think virtual disk attached to an EC2 instance. Supports snapshots. It is a different abstraction from S3 object storage.

EFS

Managed shared file system

Useful when multiple compute instances need a shared filesystem abstraction.

S3 vs EBS vs EFS

Object vs block vs shared file

S3: objects via API.
EBS: block device, usually attached to EC2.
EFS: shared network filesystem.

Ping-pong: User-uploaded images? EC2 root disk? Shared filesystem?

RDS

Managed relational database service

Supports engines such as PostgreSQL, MySQL, MariaDB, Oracle and SQL Server. AWS handles much of provisioning, backups and maintenance.

“RDS manages the database infrastructure, but I still own schema design, queries, indexes, permissions and application consistency.”

Multi-AZ vs Read Replica

Multi-AZ = availability/failover · Read replica = read scaling

A classic Multi-AZ DB instance has a standby in another AZ for failover. Read replicas copy data asynchronously and can serve read traffic.

Ping-pong: Which one would you choose to scale a read-heavy workload?

Aurora

AWS relational database compatible with MySQL/PostgreSQL

Know it as an AWS-native relational option with cloud-oriented storage and scaling characteristics.

DynamoDB

Managed NoSQL key-value/document database

Designed for predictable low-latency access and horizontal scale. Model data around access patterns rather than relational joins.

ElastiCache

Managed in-memory cache

Useful for hot reads, sessions, rate limiting and reducing database load. You still need TTL, invalidation and consistency decisions.

Lambda

Event-driven code execution without managing servers

Functions run in response to events or requests and scale automatically within configured limits. Good for short-lived event-driven work.

“Serverless means I do not manage the servers, not that servers do not exist.”

API Gateway

Managed front door for APIs

Can expose HTTP APIs and integrate with Lambda or other backends, with API concerns such as routing, authorization options and throttling.

SQS

Durable queue for asynchronous work

A producer sends a message and a consumer processes it later. Useful for decoupling, buffering bursts and retrying work.

“With SQS I would design consumers to be idempotent because retries and duplicate delivery can happen.”

SNS

Publish one message to multiple subscribers

Pub/sub notification service. A topic can fan out to multiple consumers, including SQS queues and Lambda functions.

SQS vs SNS

Queue/work distribution vs fan-out/pub-sub

They are often combined: publish an event to SNS, fan it out into multiple SQS queues, then let independent consumers process at their own pace.

SES / Cognito

SES = email delivery · Cognito = application user identity

Useful names to recognize from the video. Do not confuse Cognito application users with IAM identities that manage AWS resources.

ECR

Container image registry

Store Docker/OCI images in AWS, then pull them from ECS, EKS or other compute environments.

ECS

AWS container orchestration

ECS manages tasks and services. Containers can run on EC2 capacity you manage or on Fargate capacity managed by AWS.

“ECS is the orchestrator, ECR can store the image, and Fargate is one way to provide the compute capacity.”

Fargate

Run containers without managing EC2 container hosts

You specify task CPU/memory, networking and IAM; AWS manages the underlying server capacity.

Ping-pong: What operational work disappears when moving ECS from EC2 capacity to Fargate?

EKS

Managed Kubernetes control plane on AWS

Use when Kubernetes is a deliberate platform choice. It brings Kubernetes concepts and operational complexity beyond ECS.

CloudWatch

Metrics + logs + alarms + observability

Collect service/application metrics and logs, query them, create alarms and trigger configured actions or notifications.

“CloudWatch tells me how the system is behaving; I use metrics, logs and alarms together during troubleshooting.”

CloudTrail

Audit AWS API activity: who did what?

Records account/API activity for governance, security investigations and audit. That is a different question from application performance monitoring.

“CloudWatch is operational observability; CloudTrail is the audit trail of AWS actions.”

Systems Manager

Operate and automate managed nodes without treating SSH as the only tool

Useful for remote operations, automation, patching, inventory and parameter management.

Troubleshooting: app unreachable

Work layer by layer, not randomly

DNS resolves?
Load balancer healthy?
Route table / IGW correct?
Security Group allows the port?
Target process listening?
CloudWatch logs/errors?

“I isolate the failing layer before changing configuration.”

Infrastructure as Code

Declare infrastructure in versioned code instead of manual clicks

Benefits: repeatability, reviewability and reproducibility. AWS-native option: CloudFormation. Cross-cloud option: Terraform.

Terraform Lifecycle

init → plan → apply → change → destroy

init prepares providers/backend; plan previews changes; apply converges infrastructure; destroy removes managed resources.

“For labs I want disposable infrastructure: Terraform apply, practice, validate, then destroy.”

Terraform State

Mapping between configuration and real resources

State is operationally important and can be sensitive. Team environments normally need an appropriate remote backend and locking strategy.

Ping-pong: What happens when somebody changes AWS manually outside Terraform?

CloudFormation

AWS-native Infrastructure as Code

Templates describe AWS resources and CloudFormation creates or updates stacks. Know the concept even when your labs use Terraform.

AWS Budgets

Track cost/usage + alerts + optional configured actions

Budgets are not a universal hard spending cap. Configure alerts and, when appropriate, specific actions. For labs, combine this with disciplined Terraform destroy and resource checks.

Lab 00 · Core Infrastructure

VPC → public/private subnets → IGW/NAT → SG → EC2 → CloudWatch → destroy

The interview-focused lab: networking, security, compute, monitoring and Terraform in one small reproducible environment.

Next Portfolio Labs

Small disposable architectures

01 · Lambda + API Gateway
02 · .NET + ECS/Fargate + ECR
03 · SQS workers
04 · RDS in private network
05 · Serverless stack

Typical Interview Architecture

Route 53 → ALB → private compute → RDS

Public entry points only where needed; application/database tiers private; IAM roles for permissions; Secrets Manager for secrets; S3 for objects; CloudWatch for observability; Terraform for repeatability.

Ping-pong: Walk through a browser request until the database query returns.

Data / Analytics Landscape

Recognize the problem each family solves

Redshift: data warehouse / analytics.
Kinesis: streaming data.
Glue: managed data integration / ETL.
EMR: managed big-data frameworks.
MSK: managed Apache Kafka.

Specialized Databases

Different data models, different access patterns

DocumentDB: document database with MongoDB compatibility.
Neptune: graph database.
Timestream: time-series database.
OpenSearch: search / log analytics.

AI / ML Landscape

Know the names; do not study them for this interview first

SageMaker: build/train/deploy ML workloads.
Bedrock: foundation models / generative AI.
Rekognition: image/video analysis.
Lex: conversational interfaces.
Polly / Transcribe / Translate / Textract: speech, language and document AI.
Amazon Q: generative AI assistant family.