Interview Forge

CLOUD & INFRASTRUCTURE / SYSTEM CONCEPT BRIEF

AWS fundamentals

Amazon Web Services is the largest cloud provider.

BeginnerPhase 07 / Topic 2 of 17RequirementsTrade-offsFailure modes
01

Overview

Amazon Web Services is the largest cloud provider. Its core building blocks are compute (EC2, Lambda, ECS, EKS), storage (S3, EBS, EFS), databases (RDS, Aurora, DynamoDB, ElastiCache), networking (VPC, Route 53, CloudFront, Elastic Load Balancing), messaging (SQS, SNS, EventBridge, Kinesis), and security (IAM, KMS, Secrets Manager).

Resources live in regions, each with multiple availability zones. A VPC is your private network with public and private subnets. IAM controls who can do what, using policies attached to users, roles, and resources. Knowing which service fits a need, and how they connect, is the foundation for cloud system design interviews.

A giant hardware and utility store

AWS is a store with aisles for every infrastructure need: servers, storage, databases, networking, and security. You pick building blocks off the shelf and wire them together, paying only for what you use.

02

When to use it

  • Designing systems in interviews where AWS services are expected.
  • Choosing managed services for a new product.
  • Mapping generic components (cache, queue, blob store) to concrete services.
  • Security and network design in the cloud.
03

Where it shows up in interviews

Service mapping

Recognize it when: design X on AWS.

  • Design a URL shortener on AWS
  • Design a serverless image processing pipeline
Secure network layout

Recognize it when: public web tier, private data tier.

  • Design a three-tier web app in a VPC
  • Design PCI-compliant payments
04

Where it is used in real software

Classic three-tier on AWS

Route 53 and CloudFront, then an Application Load Balancer, EC2 or ECS in private subnets, and RDS Multi-AZ.

Serverless stacks

API Gateway, Lambda, DynamoDB, S3, and EventBridge power many startups with no servers.

Well-Architected Framework

AWS's pillars: operational excellence, security, reliability, performance, cost, and sustainability.

05

Key terms

EC2 / Lambda
Virtual machines / serverless functions.
S3 / EBS
Object storage / block volumes for EC2.
VPC / subnet / security group
Private network / IP range in one AZ / instance-level firewall.
IAM role
Identity with permissions assumed by services or users, with temporary credentials.
ALB / NLB
Layer 7 / layer 4 load balancers.
06

How it works, step by step

  1. 1
    Network

    VPC across 2-3 AZs, public subnets for load balancers, private subnets for apps and data.

  2. 2
    Edge

    Route 53 DNS, CloudFront CDN, WAF.

  3. 3
    Compute

    ECS/EKS, EC2 Auto Scaling, or Lambda.

  4. 4
    Data

    RDS/Aurora, DynamoDB, ElastiCache, S3.

  5. 5
    Security and operations

    IAM roles, KMS, Secrets Manager, CloudWatch, CloudTrail.

07

Generic component to AWS service

Cheat sheet for interviews

Step 1 / 7
NeedAWS serviceNotes
DNS / CDNRoute 53 / CloudFrontLatency and failover routing
Load balancerALB / NLBL7 routing / L4 performance
Containers / functionsECS, EKS / LambdaFargate removes node management
Relational / key-value DBRDS, Aurora / DynamoDBMulti-AZ, global tables
CacheElastiCache (Redis/Valkey)In private subnets
Queue / pub-sub / streamSQS / SNS, EventBridge / Kinesis, MSKDecoupling
Object storageS311 nines durability

NOWNeed: DNS / CDN | AWS service: Route 53 / CloudFront | Notes: Latency and failover routing

In interviews, name generic components first, then map them to services with a short reason.

08

Implementation

{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ReadUploadsOnly",      "Effect": "Allow",      "Action": ["s3:GetObject"],      "Resource": "arn:aws:s3:::acme-uploads/*"    },    {      "Sid": "SendToQueue",      "Effect": "Allow",      "Action": ["sqs:SendMessage"],      "Resource": "arn:aws:sqs:us-east-1:123456789012:thumbnails"    }  ]}
09

Complexity and performance

Regions30+

Each with 3+ AZs.

S3 durability99.999999999%

11 nines.

10

Trade-offs

Serverless vs containers vs VMs

Serverless minimizes operations and scales to zero but has limits (duration, cold starts); containers and VMs give more control.

Managed vs self-managed

RDS vs PostgreSQL on EC2: less work vs more tuning control.

11

Variants and related techniques

Azure and GCP equivalents

Blob Storage / Cloud Storage, AKS / GKE, Cosmos DB / Firestore, Service Bus / Pub/Sub.

12

Common mistakes

  • Long-lived access keys.

    Fix: Use IAM roles with temporary credentials and SSO.

  • Databases in public subnets.

    Fix: Keep data tiers private; allow access only from app security groups.

  • Single-AZ deployments.

    Fix: Spread across at least two AZs.

13

Interview questions

Design a highly available web app on AWS.

Route 53 and CloudFront in front of an ALB in public subnets across three AZs, containers on ECS Fargate or EKS in private subnets with auto scaling, Aurora Multi-AZ, ElastiCache for caching, S3 for static assets, SQS for async work, and CloudWatch for monitoring.

What is the difference between a security group and a NACL?

Security groups are stateful, instance-level allow rules; network ACLs are stateless, subnet-level allow and deny rules evaluated in order.

14

Practice problems

ProblemDifficultyWhat it trains
Map a URL shortener to AWS servicesEasyService selection.
Design a VPC for a three-tier appMediumSubnets and security groups.