A service needs to read objects from exactly one storage bucket. How do you grant it access?
What they are really testing: Whether least privilege is a real instinct or a slogan. They want scoping by both action and resource, and using a role/managed identity instead of long-lived keys.
A real interview question
A service needs to read objects from exactly one storage bucket. How do you grant it access?
What most people say
drag me
“I would create an access key with S3 permissions and put it in the service config.”
Two failures: long-lived static keys (a leak risk that should be a role) and unscoped "S3 permissions" (likely s3:* on all buckets). It is the answer that causes real breaches.
The follow-ups they ask next
The service runs on-prem, not in the cloud, so it cannot use a role. Now what?
Use a federated/workload-identity approach (OIDC federation) to exchange an external identity for short-lived cloud credentials; if truly impossible, a tightly-scoped key in a secrets manager with rotation, never in config/source.
How would you detect if this policy is too broad in production?
Use access analyzers / last-accessed data (IAM Access Analyzer, "permissions used") to find granted-but-unused actions and tighten them; alert on use of unexpected actions.
What the interviewer is listening for
- Reaches for a role/managed identity over static keys
- Scopes by action AND resource
- Verifies the denials, not just the allow
What sinks the answer
- Static long-lived access keys
- Grants s3:* or Resource: *
- Puts secrets in config or source
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I’d use [a role / managed identity for short-lived creds, not static keys]. The policy grants [only s3:GetObject] scoped to [that one bucket’s ARN], not Resource: *. Then I’d [verify it’s denied on other buckets and on writes].”
Keep going with iam & security
Mid
How would you manage application secrets (DB passwords, API keys) across environments? Walk me through the options and their trade-offs.
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Junior
How does putting a load balancer in front of your app improve availability, and what does it NOT solve?
Junior
In AWS, what is the difference between a security group and a network ACL, and when would you reach for each?
Junior
What is autoscaling, and how does it decide when to add or remove instances?
Junior
Explain the difference between object, block, and file storage, and give one good use case for each.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free