›What's the difference between a security group and a NACL?
A security group is stateful and attached to individual instances/ENIs — it only supports allow rules, and automatically permits return traffic for anything it let through. A NACL is stateless and attached to a subnet — it supports explicit allow and deny rules evaluated in order, and needs its own explicit rule for return traffic in both directions.
›What's the difference between an IAM role and an IAM user?
A user represents a long-term identity — typically a person or a static credential — with directly attached permissions. A role has no long-term credentials of its own; it's assumed temporarily by a user, service, or another AWS account, granting short-lived credentials scoped to that role's policy. Prefer roles for anything that can assume one — EC2 instances, Lambda functions, CI pipelines — instead of long-lived access keys.
›How does S3 achieve high durability, and what does that guarantee actually mean?
S3 Standard is designed for 99.999999999% ("11 nines") durability by redundantly storing objects across multiple Availability Zones within a region. That's a guarantee about not losing the underlying data — it says nothing about availability (S3 can still be temporarily unreachable) or protecting against your own application deleting or overwriting an object, which versioning addresses separately.
›What's the difference between a public and a private subnet?
There's no subnet-level flag for this — it's purely a consequence of its route table. A subnet is "public" if its route table has a route to an Internet Gateway; "private" if it only routes through a NAT Gateway (outbound-only internet) or has no route out at all.
›What's the difference between horizontal and vertical scaling in AWS, and which does Auto Scaling do?
Vertical scaling means a bigger instance — more CPU/memory on the same box, with a hard ceiling and required downtime to resize. Horizontal scaling means more instances running in parallel behind a load balancer. EC2 Auto Scaling Groups do horizontal scaling — adding and removing instances based on demand, without any single instance needing to get bigger.
›How would you debug an AccessDenied error you didn't expect?
aws iam simulate-principal-policy tests whether a given principal's attached policies allow a specific action
against a specific resource, without actually attempting it — the fastest way to find the exact policy statement
(or missing one) causing the denial, rather than guessing from the error message alone. Also check for an explicit
Deny in an SCP at the AWS Organizations level — those override any Allow no matter what the IAM policy says.
›What's the difference between EBS and S3?
EBS is block storage attached to a single EC2 instance at a time — like a virtual hard drive, with a filesystem the OS manages, low latency, and data that persists independently of the instance's lifecycle. S3 is object storage accessed over HTTP(S) APIs, not mounted as a filesystem, designed for massive scale and durability rather than low-latency block-level access — the right tool for static assets, backups and data lakes, not a database's disk.
›What is an Availability Zone, and why does spreading resources across them matter?
An AZ is one or more physically separate data centers within an AWS region, with independent power, cooling and networking, connected to other AZs in the region by low-latency links. Spreading instances (and subnets) across multiple AZs means a single data center failure doesn't take down the whole application — the basis of most AWS high-availability architecture.
›How does IRSA (IAM Roles for Service Accounts) work in EKS?
EKS clusters have an OIDC identity provider. A Kubernetes ServiceAccount annotated with an IAM role ARN lets pods using that ServiceAccount assume the role via that OIDC trust relationship — the pod gets temporary, scoped AWS credentials injected automatically, without sharing broad node-level IAM permissions with every pod on the node.