AWS Core — Cheat Sheet
Tags: aws, iam, ec2, s3, vpc, lambda, cloudwatch
Level: intermediate
TL;DR: Quick reference on fundamental AWS building blocks covering compute, storage, networking, identity, and serverless architectures for technical interviews.
Key concepts
IAM manages authentication and fine-grained authorization via identities, roles, and JSON policy evaluation logic.
EC2 provides resizable virtual compute instances with configurable AMIs, instance types, and EBS storage volumes.
S3 offers object storage with high durability (99.999999999%), lifecycle tiers, bucket policies, and cross-region replication.
VPC isolates network topology using subnets across availability zones, route tables, internet gateways, and NAT gateways.
Security Groups act as stateful firewalls at instance level; Network ACLs provide stateless filtering at subnet boundaries.
Lambda runs serverless, event-driven code scaled per request with configurable execution timeouts up to 15 minutes.
RDS automates managed relational engines with automated backups, multi-AZ high availability failover, and read replicas.
CloudWatch aggregates operational metrics, application logs, and alarms; CloudTrail audits all management and API calls.
DynamoDB delivers fully managed, single-digit millisecond latency NoSQL storage partitioned via partition and sort keys.
Application Load Balancer distributes incoming HTTP/HTTPS traffic dynamically across targets based on path and host routing.
Typical questions and ready answers
Q: How do you decide between a Security Group and a Network ACL in a VPC?R: I use Security Groups as primary stateful firewalls for instance-level traffic where outbound return packets are automatically allowed. I apply stateless NACLs at the subnet boundary as a secondary defense layer, specifically for rule-ordered subnet filtering or explicit IP blocklists.
Q: What is the difference between an IAM Role and an IAM User, and when do you use each?R: An IAM User represents an individual or service account with long-term credentials like passwords or access keys. I use IAM Roles for applications running on EC2 or Lambda to assume short-term, rotating credentials via STS, avoiding hardcoded secrets.
Q: How do you design an S3 bucket configuration for cost optimization and high availability?R: I enable versioning and lifecycle policies to transition aging data from Standard to Infrequent Access and Glacier. For business-critical disaster recovery requirements, I configure Cross-Region Replication alongside bucket encryption via KMS.
Q: What causes Lambda cold starts and how do you mitigate them in production?R: Cold starts occur when AWS initializes a new microVM execution environment and runtime upon invocation after scaling or inactivity. I mitigate them by optimizing dependency package sizes, using lightweight runtimes, or provisioning reserved concurrency on critical endpoints.
Pitfalls and common mistakes
Storing long-term IAM access keys in source code or instance configurations instead of using IAM roles.
Forgetting that Network ACLs are stateless, resulting in blocked return traffic when ephemeral ports are omitted.
Placing Lambda functions inside private VPC subnets without a NAT Gateway or VPC endpoint, breaking public internet access.
Confusing S3 bucket policies with IAM policies instead of evaluating the effective intersection of both permissions.
Relying on EC2 instance store volumes for persistent data instead of attaching resilient EBS volumes.
Overlooking DynamoDB partition key hot-spotting caused by uneven access distributions across storage partitions.
Snippets and commands
# Verify caller identity and assumed IAM role
aws sts get-caller-identity
# List EC2 instances with state and instance ID
aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType]" --output table
# Sync local files to an S3 bucket with server-side encryption
aws s3 sync ./dist s3://my-app-assets-bucket/ --sse AES256
# Tail live CloudWatch logs for a specific Lambda function
aws logs tail /aws/lambda/process-order-handler --followTo review
[ ] IAM policy evaluation flow: explicit deny vs implicit deny vs explicit allow
[ ] VPC peering limitations, transit gateway architecture, and CIDR overlap rules
[ ] S3 object locking, versioning lifecycle transitions, and CORS policies
[ ] DynamoDB secondary indexes: Global Secondary Index (GSI) vs Local Secondary Index (LSI)
[x] Basic IAM User vs Role vs Policy differences
[x] S3 storage tiers and core durability metrics
[x] Security Group stateful behavior vs NACL stateless behavior
References
AWS Well-Architected Framework documentation
AWS Identity and Access Management (IAM) User Guide
Amazon VPC Architecture and Networking Documentation
Amazon S3 Developer Guide and Storage Classes Matrix
