AWS Cloud Architecture & DevOps Interview Blueprint
Production blueprints for VPC Multi-AZ networking, EKS IAM Roles for Service Accounts (IRSA), Route53 active-active failover, Terraform state blast radius, and FinOps cost reclamation.
1. Senior AWS Expectations vs. Console Click-Ops
In AWS DevOps loops (especially Amazon L5/L6, Capital One, and enterprise cloud migrations), interviewers do not care if you can navigate the AWS Web Console. They test your capability to design resilient, immutable, and automated architectures:
The Staff Architect Axiom: Everything is treated as code. If an AWS service failure occurs (e.g. an entire Availability Zone experiences power loss or fiber severance), the architecture must heal automatically without waking up on-call engineers to execute manual route table edits.
👉 Practice scenario: Diagnosing ALB 504 Gateway Timeouts Under Sudden Traffic Spikes →
2. Enterprise Multi-AZ VPC & Transit Gateway Topology
A classic design question: "How do you connect 50 development, staging, and production VPCs across multiple AWS accounts with zero routing loops and centralized inspection?"
- Transit Gateway (TGW) Hub-and-Spoke: Eliminates complex full-mesh VPC peering. Uses distinct Route Tables per environment (Dev, Prod, Shared Services) to prevent unauthorized lateral movement.
- NAT Gateway High Availability: Always provision 1 NAT Gateway per Availability Zone. Never route traffic from AZ-b through a NAT Gateway in AZ-a; cross-AZ data transfer fees ($0.01/GB each way) add tens of thousands to bills and introduces single-AZ fate sharing!
- AWS PrivateLink (VPC Endpoints): Keep S3, ECR, DynamoDB, and Secrets Manager traffic strictly inside the AWS private backbone, avoiding NAT Gateway bandwidth charges and internet exposure.
👉 Detailed runbook: Two Instances in the Same VPC Cannot Communicate: Triage Checklist →
3. EKS on AWS & IRSA Security Boundaries
Senior interviewers immediately reject candidates who grant worker node IAM instances broad privileges (e.g. S3 FullAccess on the EC2 instance profile). Instead, articulate the exact mechanics of **IAM Roles for Service Accounts (IRSA)**:
2. AWS IAM configures an OpenID Connect Provider trusting the cluster.
3. Pod annotates Kubernetes ServiceAccount:
eks.amazonaws.com/role-arn.4. EKS Pod Identity Webhook injects projected volume token:
AWS_WEB_IDENTITY_TOKEN_FILE.5. AWS SDK calls
sts:AssumeRoleWithWebIdentity exchanging the token for short-lived credentials!
👉 Interview Runbook: Enforcing Least Privilege with IAM Roles for Service Accounts (IRSA) →
4. Cross-Region Disaster Recovery & Global Active-Active
How do you guarantee an RTO < 2 minutes and RPO < 5 seconds during a full regional outage (e.g. us-east-1 outage)?
Dedicated replication servers maintain typical cross-region lag under 1 second without impacting primary database CPU performance.
Automated health checks trigger routing control shifts across regions in under 30 seconds with 100% control-plane isolation.
👉 Related Architecture Question: Multi-Region Regional Failover Without Changing DNS Layer →
5. Terraform Multi-Account State & Drift Containment
Interviewers will probe your approach to blast-radius containment in Infrastructure as Code:
- Decouple State Files: Never manage VPCs, EKS clusters, and application RDS databases in a single monolithic
terraform.tfstate. Split by lifecycle layer so database state is never touched during application rollouts. - S3 Backend Security: Enable Object Lock, Versioning, KMS Customer Managed Key encryption, and DynamoDB lock tables to prevent concurrent apply collisions.
- Automated Scheduled Drift Detection: Run daily CI pipelines executing
terraform plan -detailed-exitcodewith Slack alerts when manual out-of-band console changes occur.
👉 Study runbook: Detecting and Reconciling Terraform Infrastructure Drift →
6. FinOps & Cloud Cost Optimization (Staff SRE Value)
Proving you can save an enterprise $200k/year instantly elevates you from a Senior engineer to a Staff/Principal candidate:
- Karpenter Spot Orchestration: Blend 70% Spot Instances for stateless microservices with 30% Compute Savings Plans for baseline stateful state.
- S3 Lifecycle Transition Rules: Automatically migrate operational log buckets from Standard to S3 Intelligent-Tiering and Glacier Deep Archive after 90 days.
- VPC NAT Gateway Traffic Reduction: Replace public internet routing for AWS internal services with Gateway VPC Endpoints for S3/DynamoDB (100% free of charge).
7. Top 35 AWS Scenario Runbooks to Master
Explore all 128+ real production AWS scenarios on our dedicated hub or practice your rapid verbal triage under pressure:
AWS Solutions Architect Professional & DevOps Engineer Masterclass
Validate your enterprise multi-account design and cloud governance depth. Master real exam architectures and scenario simulations.