Q: How would you architect a highly available web application on AWS? "Multi-AZ deployment in a VPC with public and private subnets. ALB in public subnets routes to ECS or EKS tasks running in private subnets across at least two AZs. RDS in Multi-AZ mode for the database. ElastiCache for session and query caching. S3 for static assets, CloudFront in front for CDN. Route 53 with health checks for DNS failover if needed. All managed via Terraform. CI/CD via GitHub Actions with OIDC into AWS."
Q: How do you secure an S3 bucket? "Defaults first: Block Public Access enabled, SSE-KMS encryption at rest, TLS-only in transit via a bucket policy condition on aws:SecureTransport. Bucket policy restricts to least-privilege principals only. CloudTrail data events enabled to log object-level access. Versioning and MFA Delete on critical buckets. For inter-service access, use VPC endpoint with endpoint policy as an additional layer."
Q: EC2 instance can't reach an S3 bucket — how do you troubleshoot? "Layered check: first, IAM — does the instance role have the right S3 permissions? Then bucket policy — does it explicitly allow this principal? Then network — is the instance routed to S3, either via NAT/IGW or VPC endpoint? If VPC endpoint, check the endpoint policy. If KMS-encrypted, check the KMS key policy. CloudTrail will show the exact access-denied event with the cause."