A developer messages you: 'My app suddenly gets Access Denied writing to the S3 bucket. Nothing changed.' It worked yesterday. Walk me through what you do.
What they are really testing: They want to see if you can debug identity calmly and by evidence, instead of guessing and handing out broad permissions to make the error go away.
A real interview question
A developer messages you: 'My app suddenly gets Access Denied writing to the S3 bucket. Nothing changed.' It worked yesterday. Walk me through what you do.
What most people say
drag me
“I would just give the role s3:* on the bucket to unblock the developer, then look at it properly later.”
It treats a permissions bug as an obstacle rather than a signal, it hides the real cause, and the temporary wildcard almost always becomes permanent.
The follow-ups they ask next
How would you tell an SCP denial apart from a missing identity permission?
Say that the policy simulator and CloudTrail both show an explicit deny with no matching allow, and that SCP denials hit even the account admin, which is the giveaway.
The developer is blocked and your fix needs a review. What do you do?
Show that you separate urgency from safety: offer a time boxed, scoped, logged exception with an owner and an expiry, not a permanent wildcard.
What the interviewer is listening for
- Confirms the actual calling identity before theorising
- Knows KMS is a separate gate from S3
- Fixes through IaC and scoped to one action and one ARN
- Assumes something changed and goes looking for it
What sinks the answer
- Reaches for a wildcard policy to unblock
- Debugs the role they assumed rather than the one in use
- Never mentions CloudTrail or any evidence source
- Changes three things at once and cannot say which fixed it
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I have not debugged this exact bucket, but here is the order I would work in: first confirm which identity is really calling, then check what changed in the last day, then walk identity policy, bucket policy, SCP and KMS one at a time.”
Keep going with troubleshooting
Junior
You get paged at 2am. Checkout latency has gone from 200ms to 4 seconds and it started right after the 11pm deploy. Walk me through what you do.
Junior
It is 3am and you get paged: the primary application server is at 100% disk usage and the app is throwing write errors. You are the only one online. Walk me through exactly what you do.
Junior
You push a new version of a service and within two minutes the pods are all showing CrashLoopBackOff. The team is watching you share your screen. Walk me through exactly what you do.
Junior
A developer pings you: the checkout service cannot reach the payments service, the calls just hang and time out. You have never worked on either service. Walk me through what you do.
Mid
Your load balancer shows 5xx errors jumping from 0.1 percent to 12 percent of requests over ten minutes. There was no deploy. What do you do?
Mid
One of your containers keeps getting OOM killed. It restarts, serves traffic for about twenty minutes, then dies again. Talk me through how you handle it.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free