46.6 AWS Cloud Security Interview Questions
IAM, MFA, security groups, CloudTrail, GuardDuty, IMDSv2 – cloud-sec daily. Aata pudhe.
Q51. What is IAM least privilege?
Grant only the actions and resources a role needs, nothing more. Prefer roles over long-lived access keys. For Sahyadri’s upload role I allow s3:PutObject on one prefix, not s3:* on *.
Q52. Why is MFA important for the AWS root and admins?
Stolen passwords alone should not open the console. MFA adds a second factor. Root is locked away; daily work uses IAM users or SSO with MFA.
Q53. Security group versus network ACL – short version?
Security groups are stateful allow rules on ENIs. NACLs are stateless subnet-level rules. Most app control starts with tight security groups; NACLs add coarse subnet guardrails.
Q54. What is IMDSv2 and why prefer it?
Instance Metadata Service v2 requires session-oriented requests, which makes SSRF-to-steal-role-credentials harder than with IMDSv1. I enable hop-limit/IMDSv2-required settings on EC2 when teaching cloud hardening.
Q55. What does CloudTrail give you?
API audit history: who called which API when. Without CloudTrail, IR in AWS is blind. Logs should be immutable in a locked logging account/bucket where possible.
Q56. What is GuardDuty in one sentence?
A managed threat detection service that looks for suspicious activity patterns in AWS accounts using logs and intel – I treat alerts as investigation starts, not automatic guilt.
Q57. How do you respond if access keys leaked in a GitHub gist?
Deactivate/delete the keys immediately, rotate secrets, review CloudTrail for abuse, remove the gist, and move the app to instance roles. Then teach the team pre-commit secret scanning.
Q58. What is wrong with 0.0.0.0/0 on SSH in a security group?
Anyone on the internet can attempt SSH. Even with strong keys, you face noise and zero-day risk. Restrict to known IPs or use SSM Session Manager patterns where fit.
Q59. How do you design a simple three-tier VPC story?
Public subnet for load balancer or bastion patterns, private subnets for app and database, NAT for outbound patching, security groups between tiers. Raja-Rani warehouse DB never sits with a public IP.
Q60. What AWS shared responsibility idea do you mention?
AWS secures the cloud infrastructure; the customer secures what they put in the cloud – OS config, IAM, data, application code. Misconfigured S3 is usually on the customer side of that model.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Uses leaked keys / SSRF to IMDS | IMDSv2; no long-lived keys; CloudTrail + GuardDuty; rotate fast |
| Opens SG wide for "temporary debug" | IaC review; Config rules; ticket expiry on temporary rules |
Ravindra Bagale's Tip
Students "I know EC2" mhantat pan IAM policy JSON visartat. Ek chhota least-privilege policy example notebook madhe theva – interview gold. Samjla ka?
Lab
On OWN account: create an IAM role for EC2 with read-only on one bucket prefix, attach to a lab instance, prove CLI aws s3 ls works without access keys in ~/.aws/credentials on that box.