← Amazon Interview Insights

Amazon·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
May 2026

Summary

Amazon software engineering interview that went deep on infrastructure and architecture topics. Five distinct technical areas back to back, no behavioral questions at all, which I honestly wasn't expecting.

Questions Asked (5)

Q1

Design a multi-layer VPC architecture with public, private, and management network segments. Walk through how you'd handle routing between layers, and how subnets, route tables, and security groups enforce isolation.

System DesignTechnical Trade-offs
Author's notes

This is the kind of question where I talk too much upfront and then run out of time on the security group specifics.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements (e.g., number of tiers, compliance needs) and then design a VPC with public, private, and management subnets across multiple AZs. Explain routing and security group rules to enforce isolation, emphasizing the principle of least privilege and defense in depth.

Pro tip: Mention that you would use VPC endpoints for private access to AWS services, avoiding NAT gateways for internal traffic, which reduces cost and attack surface. Also, highlight that management subnets should have no internet gateway route and be accessible only via VPN or bastion hosts with strict security groups.

1. Clarify Requirements and Constraints

Ask about expected traffic patterns, compliance requirements, and existing infrastructure. Determine the number of availability zones and CIDR block size needed.

2. Design Subnet Layout

Create public, private, and management subnets in each AZ. Allocate CIDR blocks carefully, ensuring non-overlapping ranges and room for growth.

3. Configure Route Tables

Associate public subnets with a route table that has a route to an Internet Gateway. Private subnets route outbound traffic through NAT Gateways (or instances) in public subnets. Management subnets have no route to IGW or NAT, only to virtual private gateway or VPN.

4. Implement Security Groups and NACLs

Apply security groups as stateful firewalls at the instance level, allowing only necessary ports and sources. Use network ACLs as stateless subnet-level filters for additional defense.

5. Enforce Isolation and Monitoring

Use VPC Flow Logs, AWS Config, and GuardDuty to monitor traffic. Ensure management subnets are accessible only via bastion hosts or VPN with MFA, and restrict security group rules to specific CIDRs.

Key Points to Mention

  • Use of multiple Availability Zones for high availability and fault tolerance.
  • NAT Gateways for outbound internet access from private subnets, but no inbound access.
  • Security groups are stateful and allow rules only; NACLs are stateless and can deny.
  • Management subnets should have no internet gateway route; access via VPN or bastion host.
  • VPC endpoints (e.g., Gateway Endpoints for S3/DynamoDB, Interface Endpoints for other services) to keep traffic private.
  • Principle of least privilege: restrict security group rules to specific IP ranges and ports.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q2

For a fleet of 2,000 servers, how would you plan CIDR block allocations across subnets, accounting for AWS reserved addresses and room to grow?

System DesignTechnical Trade-offs
Author's notes

The reserved-addresses-per-subnet thing trips people up and I knew it was coming, so I mentioned the five reserved IPs per subnet early.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by calculating the total IP addresses needed, factoring in AWS's 5 reserved addresses per subnet and a growth buffer. Then propose a hierarchical VPC and subnet design using CIDR blocks that allow for future expansion and clear separation of tiers or environments.

Pro tip: Demonstrate awareness of AWS-specific constraints like the 5 reserved IPs per subnet and the fact that you cannot resize a subnet after creation, so over-provisioning at the start is wise. Also, mention using multiple Availability Zones for high availability and fault tolerance.

1. Estimate IP Address Requirements

Calculate the total number of IPs needed for 2,000 servers, including room for growth (e.g., 2x or 3x). Consider that each server may need multiple IPs (e.g., for containers, secondary interfaces).

2. Choose VPC CIDR and Subnet Sizing

Select a VPC CIDR block (e.g., /16) that provides enough subnets. Decide on subnet sizes (e.g., /24 for 256 IPs, minus 5 reserved = 251 usable) based on the number of servers per subnet and growth.

3. Account for AWS Reserved Addresses

For each subnet, subtract 5 IPs for AWS reserved addresses (network, router, DNS, future, broadcast). Ensure the remaining IPs meet your server count per subnet.

4. Design for High Availability and Scalability

Distribute subnets across multiple Availability Zones (at least 2, preferably 3) for fault tolerance. Plan for future growth by leaving unused CIDR ranges or using larger subnets than currently needed.

5. Document and Validate the Plan

Create a CIDR allocation plan that avoids overlaps, allows for expansion, and aligns with organizational needs (e.g., separate subnets for different tiers). Validate against AWS limits and best practices.

Key Points to Mention

  • AWS reserves 5 IP addresses per subnet (first 4 and last 1).
  • Subnet size cannot be changed after creation, so plan for growth.
  • Use multiple Availability Zones for high availability.
  • Consider VPC peering or Transit Gateway for connecting multiple VPCs if scaling beyond a single VPC.
  • Use private subnets for servers and public subnets for load balancers/NAT.
  • Leverage CIDR notation and subnet masks to efficiently allocate IPs.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q3

How would you centrally manage a mixed fleet of Linux and Windows instances, covering configuration management, patching, access control, and inventory?

System DesignTechnical Trade-offs
Author's notes

Went straight to a config management tool plus a cloud-native patch manager combo.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and scale, then propose a unified management layer using AWS Systems Manager (SSM) as the central control plane for both Linux and Windows. Structure your answer around the four pillars—configuration management, patching, access control, and inventory—explaining how SSM integrates with native tools (e.g., Ansible, PowerShell DSC) and AWS services (e.g., IAM, Config, CloudWatch). Emphasize trade-offs like agent-based vs. agentless, and how to handle hybrid or multi-cloud scenarios.

Pro tip: Highlight that you'd use SSM's built-in compliance and patching features to reduce operational overhead, but also mention the importance of tagging strategy and resource groups for scalable management. Show awareness of cost and security implications, such as using VPC endpoints to keep traffic private.

1. Clarify scope and constraints

Ask about fleet size, environment (AWS-only, hybrid, multi-cloud), compliance requirements, and existing tooling. This ensures your solution is tailored and demonstrates thoroughness.

2. Propose a central management platform

Recommend AWS Systems Manager as the core, explaining how it provides a unified interface for both OS types. Mention alternatives like Ansible Tower or Chef if relevant, but justify SSM for AWS-native integration.

3. Detail each pillar: configuration, patching, access, inventory

For configuration, describe using SSM State Manager or Ansible playbooks; for patching, SSM Patch Manager with baselines; for access, IAM roles and Session Manager; for inventory, SSM Inventory and Config. Explain how these work across Linux and Windows.

4. Address cross-platform challenges and trade-offs

Discuss differences in package managers (apt/yum vs. Windows Update), scripting (Bash vs. PowerShell), and how to abstract them. Mention trade-offs like agent overhead, cost of SSM advanced features, and complexity of hybrid setups.

5. Summarize with a scalable, secure architecture

Conclude by tying it together: use tags for targeting, VPC endpoints for security, and CloudWatch for monitoring. Emphasize automation and compliance reporting to reduce manual effort.

Key Points to Mention

  • AWS Systems Manager (SSM) as a unified control plane for Linux and Windows
  • Configuration management: SSM State Manager, Ansible, PowerShell DSC
  • Patching: SSM Patch Manager with patch baselines and maintenance windows
  • Access control: IAM roles, Session Manager for shell access without SSH/RDP
  • Inventory: SSM Inventory and AWS Config for asset tracking and compliance
  • Scalability and security: tagging strategy, VPC endpoints, and least-privilege access

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q4

Recommend a shared storage solution for concurrent access across many servers. Compare NFS-style, SMB-style, and any alternatives on performance, consistency, and cost.

System DesignTechnical Trade-offs
Author's notes

Probably my best answer of the day.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying the workload requirements (e.g., file size, access patterns, consistency needs) and then evaluate NFS, SMB, and alternatives like object storage or distributed file systems against those requirements. Structure your answer as a trade-off analysis, highlighting when each solution is appropriate and why, and conclude with a recommendation tailored to the scenario.

Pro tip: Demonstrate awareness of AWS-specific services like EFS, FSx, and S3, and discuss how they map to the generic protocols. Also, mention that the choice often depends on whether you need POSIX compliance, Windows compatibility, or high throughput for specific workloads.

1. Clarify Requirements

Ask about the workload: file sizes, read/write patterns, number of clients, consistency requirements, latency sensitivity, and budget. This ensures your recommendation is grounded in the actual use case.

2. Compare NFS and SMB

Discuss NFS (typically for Linux/Unix, strong consistency, good performance for small files) and SMB (Windows-centric, supports locking, often used in mixed environments). Highlight differences in performance, consistency, and cost.

3. Explore Alternatives

Introduce alternatives like object storage (S3), distributed file systems (HDFS, Ceph), and cloud-native options (EFS, FSx, Azure Files). Compare them on scalability, consistency models, and cost.

4. Evaluate Trade-offs

For each option, analyze performance (throughput, IOPS, latency), consistency (strong vs. eventual), and cost (storage, requests, data transfer). Relate back to the requirements from step 1.

5. Recommend and Justify

Choose a solution and explain why it fits the scenario, acknowledging any limitations and possible mitigations. If appropriate, mention hybrid approaches.

Key Points to Mention

  • NFS: POSIX compliance, strong consistency, suitable for Linux workloads, but can have performance bottlenecks with many small files.
  • SMB: Windows integration, supports file locking and access control, but may have higher overhead and licensing costs.
  • Object storage (e.g., S3): high durability, scalability, eventual consistency (now strong for new objects), but not a traditional file system; requires API access.
  • Distributed file systems (e.g., HDFS, Ceph): designed for big data, high throughput, but complex to manage and may not be cost-effective for small-scale needs.
  • Cloud-managed services: Amazon EFS (NFS), FSx for Windows (SMB), FSx for Lustre (HPC), which abstract management but come with specific performance characteristics and costs.
  • Cost considerations: include storage cost, request costs, data transfer fees, and operational overhead (management, backup, replication).

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q5

Design a single sign-on system where users authenticate once to access multiple services. Cover identity provider selection, how trust relationships work, and the token flow.

System DesignAPI & Integrations
Author's notes

Knew the token flow cold so I started there, which might have been backwards.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and scale, then choose an identity provider (IdP) based on trade-offs between build vs. buy. Explain the trust relationship using standards like SAML or OIDC, and walk through the token flow from initial authentication to accessing multiple services, highlighting security considerations.

Pro tip: Emphasize token validation and revocation strategies, as these are critical for security and often overlooked. Also, discuss how to handle session management across services to avoid single points of failure.

1. Clarify Requirements and Scale

Ask about the number of users, services, security requirements, and whether it's for internal or external users. This shapes IdP choice and architecture.

2. Select Identity Provider

Evaluate options: build custom, use standard protocols (SAML, OIDC) with an IdP like Okta, Auth0, or cloud provider services (AWS Cognito, IAM). Consider trade-offs in cost, control, and compliance.

3. Design Trust Relationships

Establish trust between IdP and service providers (SPs) using metadata exchange, certificates, and shared secrets. Explain how SPs trust tokens issued by IdP.

4. Define Token Flow

Detail the flow: user authenticates with IdP, receives a token (e.g., JWT or SAML assertion), and presents it to SPs. SPs validate the token and grant access. Include refresh and revocation mechanisms.

5. Address Security and Scalability

Discuss token expiration, secure storage, revocation lists, and how to scale the IdP and token validation across services. Mention monitoring and logging.

Key Points to Mention

  • OIDC vs SAML: trade-offs in simplicity, mobile support, and token format
  • Token types: JWT, SAML assertions, and their validation (signature, expiration, audience)
  • Trust establishment: metadata exchange, certificates, and key rotation
  • Session management: single logout, token revocation, and refresh tokens
  • Scalability: caching tokens, distributed validation, and IdP high availability
  • Security: HTTPS, token binding, and protection against replay attacks

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.