Amazon interviews heavily weigh behavioral competencies scored directly against their 16 Leadership Principles. Every technical question also tests trade-offs, operational metrics, and customer impact. Preparing for Amazon requires practicing structured answers that highlight 16 Leadership Principles (Customer Obsession, Ownership, Bias for Action, Dive Deep, Deliver Results), scale, operational excellence. Below are the highest-yield interview questions with sample spoken responses.
1. Deployment strategy tuning (maxSurge, maxUnavailable). 2. Readiness probe precision. 3. Graceful termination (preStop hook & SIGTERM handling). 4. Pod disruption budgets (PDB).
"I configure rollingUpdate with maxSurge: 25% and maxUnavailable: 0 to ensure capacity never drops during rollout. I configure strict readiness probes with initialDelaySeconds to avoid routing traffic to uninitialized pods. Crucially, I add a preStop sleep hook (5-10s) allowing ingress controllers to remove the pod IP from endpoints before SIGTERM closes active TCP connections, paired with a PodDisruptionBudget."
Using liveness probes for traffic readiness; omitting preStop hooks causing connection drops; setting maxUnavailable to 100%.
1. Push model (Jenkins/GitHub Actions pushes with cluster credentials). 2. Pull model (agent inside cluster syncs desired state). 3. Security benefits (zero external cluster credentials). 4. Reconciliation & drift management.
"In push-based CI/CD, the build runner requires high-privilege cluster credentials to execute kubectl commands, expanding security attack surfaces. In pull-based GitOps (ArgoCD), an in-cluster controller watches git as the single source of truth, pulling manifests and auto-reconciling drift without exposing cluster API credentials externally. I recommend GitOps for multi-cluster production environments where compliance and automated drift rollback are non-negotiable."
Storing long-lived cluster admin credentials in CI environment variables; manual kubectl editing in production.
1. SLI definition (valid requests / total requests over 30d). 2. SLO target (99.99% = 4.38 mins downtime/month). 3. Error budget burn rate alerts. 4. Engineering gatekeeping policy.
"An SLI measures successful requests divided by valid incoming requests from our ingress metrics. A 99.99% SLO grants an error budget of approximately 4.38 minutes of total failure per month. Rather than alerting on point-in-time spikes, we alert on multi-window error budget burn rates (e.g., burning 5% of monthly budget in 1 hour). When the error budget exhausts, feature deployments halt and team velocity shifts 100% to reliability engineering."
Setting arbitrary 100% availability SLOs; alerting on CPU utilization rather than user-facing error budgets.
1. Detection (Trivy scan / git secret alert). 2. Immediate containment (IAM key invalidation). 3. Blast radius audit (CloudTrail logs). 4. Automated rotation guardrail.
"An engineer accidentally committed an AWS access key into a private repository branch. Within 8 minutes of the automated GitGuardian webhook alert, I revoked the active session, deleted the compromised IAM access key, and reviewed CloudTrail logs to confirm zero unauthorized API invocations took place. I then integrated pre-commit secret scanning hooks and migrated application credentials to AWS Secrets Manager with automated 30-day rotation."
Rewriting git history without rotating the compromised credential; storing plain text credentials in config files.
Studying question lists gives you the theory, but live video calls with Amazon interviewers can be intimidating. When high-pressure behavioral or architecture curveballs hit, you need clarity instantly.
ClapAssist is your silent co-pilot. Runs natively on macOS and Windows, listens to the interviewer's exact question, and surfaces concise talking points right next to your camera eye-line. Excluded at the OS level from Zoom, Google Meet, and Teams screen sharing.