Hire AWS Engineers
in Morocco

01 / The test

Twelve things an AWS engineer
should be able to answer

Certifications tell you somebody passed a test. These tell you somebody has been on call.

Use this list on us. Use it on every other vendor you are talking to. If a candidate stalls on more than three, keep looking.

1. 01

   Why your NAT gateway can cost more than your servers

   It bills hourly and again per gigabyte processed. Route S3 and DynamoDB through gateway VPC endpoints, which are free, and that line drops. We have seen NAT outrank compute on a bill more than once.

2. 02

   The three IAM policy types, and which one is failing

   Identity, resource, trust. An sts:AssumeRole call needs permission on both sides. If someone cannot explain why a role with AdministratorAccess still gets denied, they have not debugged real IAM.

3. 03

   Security groups are stateful. NACLs are not.

   Return traffic flows back through a security group automatically. Through a network ACL it does not, and you must open the ephemeral port range. This causes a large share of mysterious timeouts.

4. 04

   What actually happens during an RDS Multi-AZ failover

   The DNS record swaps and open connections drop. Roughly a minute of disruption. Your application needs retry logic and pool recycling or it stays broken after the database is healthy. Multi-AZ is availability. Read replicas are read scaling.

5. 05

   Cross-AZ traffic is billed in both directions

   Spreading a chatty service across availability zones for resilience is correct. Doing it without measuring the transfer cost is how a bill grows with no growth in traffic.

6. 06

   gp3 over gp2, nearly always

   gp3 separates IOPS and throughput from volume size. On gp2 you buy a bigger disk to get a faster disk. Most estates still on gp2 are paying for capacity they never use.

7. 07

   ALB or NLB, and why

   ALB is layer 7 for HTTP routing, host and path rules, native auth. NLB is layer 4 for static IPs, non-HTTP protocols and very high throughput. The wrong choice shows up months later as a limitation, not an error.

8. 08

   IMDSv2 should be required, not optional

   The instance metadata service is how a server-side request forgery bug becomes stolen credentials. Session-oriented IMDSv2 closes that path. It is one setting and it is still off in a lot of accounts.

9. 09

   A KMS key policy is the root of trust

   IAM permissions alone do not grant access to a key. If the key policy does not allow the principal, the answer is no regardless of what the identity policy says. People lose days to this.

10. 10

    S3 has been strongly consistent since 2020

    Read-after-write is consistent now. Architectures still carrying retry loops and sleep() calls written around the old eventual consistency are adding latency to solve a problem that no longer exists.

11. 11

    Terraform state needs locking

    State in S3 with a DynamoDB lock table. Without the lock, two engineers applying at once corrupt state, and recovering from that is a bad afternoon. If someone has never seen a state lock, they have only ever worked alone.

12. 12

    Savings Plans, Reserved Instances, Spot, and when each is wrong

    Steady baseline workloads sitting on on-demand pricing is the most common finding on a first look at any account. Spot is excellent for interruptible batch and dangerous for a stateful primary.

# Traffic to S3 leaves via the NAT gateway by default,
# and you are billed per GB processed for the privilege.

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"        # Gateway = no charge
  route_table_ids   = aws_route_table.private[*].id
}

# Same again for DynamoDB. Two resources.
# On a busy account this is the single cheapest win there is.