AWS Engineer Interview Questions UK: 8 Real Questions and What Interviewers Want

Before your AWS Engineer interview, it helps to see the questions from the interviewer's side. We have picked eight from our set of 16 and added the reason each one gets asked.

Eight AWS Engineer interview questions, and what the interviewer is thinking

1. How would you design a secure, well-structured VPC for a typical three-tier application on AWS?

Why they ask: VPC design is the foundation of most AWS roles and a standard technical opener.

2. Explain how IAM works in AWS, and how you apply least privilege in practice.

Why they ask: IAM mistakes are the most common cause of AWS security incidents.

3. What is the difference between EC2, ECS, EKS and Lambda, and how do you decide which to use?

Why they ask: Compute selection shows judgement across the AWS service catalogue.

4. How do you build highly available and scalable architectures on AWS?

Why they ask: This tests understanding of the Well-Architected reliability pillar in practice.

5. What are the different S3 storage classes, and how would you secure and manage a bucket holding sensitive data?

Why they ask: S3 is used in nearly every AWS environment and misconfiguration is a classic breach cause.

6. An S3 bucket containing customer data has been accidentally made public. What do you do?

Why they ask: Security incident response in AWS is highly likely to be tested.

7. Tell me about a time you migrated or built a significant workload on AWS. What challenges did you face?

Why they ask: They want evidence of real hands-on delivery and problem-solving.

8. What does an AWS Engineer do day to day, and how do you keep your AWS knowledge current?

Why they ask: They want to confirm your understanding of the role and your commitment to learning.

A sample answer to question 1

How would you design a secure, well-structured VPC for a typical three-tier application on AWS?

I'd create a VPC with a sensible CIDR range that leaves room to grow and avoids overlap with on-premises or other VPCs. Across at least two Availability Zones I'd create public subnets for load balancers and NAT gateways, private application subnets, and isolated database subnets with no route to the internet. Internet traffic enters through an Application Load Balancer, possibly fronted by CloudFront and AWS WAF. Application instances sit in private subnets and reach the internet only through NAT gateways. Security groups are stateful and applied tightly, for instance the database group only accepts traffic from the application group on the database port, while network ACLs offer a coarse stateless backstop. I'd use VPC endpoints for S3 and DynamoDB, and interface endpoints for services like Secrets Manager to keep traffic off the internet. VPC Flow Logs go to CloudWatch or S3 for investigation, and I'd define everything in Terraform or CloudFormation.

Common mistake to avoid: Putting databases in public subnets; Overlapping CIDR ranges

Want the rest?

Full model answers, key points and common mistakes for all 16 questions are on the AWS Engineer interview questions page. The first five are free, no sign-up needed.