Leadership asks you to reduce the cloud bill by 30 percent without hurting reliability. How do you approach it?
What the interviewer wants to hear
- Get visibility first: tagging, cost allocation, find the top cost drivers
- Remove waste: idle resources, unattached volumes, old snapshots, non-prod schedules
- Rightsize and modernize: instance types, Graviton, autoscaling, storage tiers
- Commitment discounts and Spot where safe
- Reduce data transfer and NAT costs; set budgets and ownership for ongoing FinOps
Model answer
I would start with data, not guesses. Using Cost Explorer or the cost and usage report with good tagging, I find the top services, accounts and teams driving spend, since usually a few items make up most of the bill. Quick wins come from waste: idle instances, unattached volumes, old snapshots, oversized dev environments running all night, and forgotten load balancers. Next is rightsizing with Compute Optimizer data, moving to newer or ARM-based Graviton instances, tuning autoscaling, and moving storage to Intelligent-Tiering or cheaper classes with lifecycle rules. After usage is lean, I buy Savings Plans for the steady baseline and move fault-tolerant work to Spot. I also review data transfer: NAT gateway traffic, cross-AZ chatter and egress, often fixed with VPC endpoints and caching. To keep reliability, changes go through normal testing and monitoring. Finally, I set budgets, anomaly alerts and team-level showback so savings last.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Cloud Engineer questions
- Design a multi-region disaster recovery setup for a payments API with an RPO of under 1 minute and an RTO of 15 minutes. What trade-offs do you consider?
- How would you design a multi-account cloud landing zone for a company with 20 product teams?
- How would you migrate a large production database to a managed cloud database with near-zero downtime?
- A company needs reliable connectivity between its data center and the cloud. Compare site-to-site VPN and a dedicated connection like AWS Direct Connect, and describe a resilient design.
- Design a shared Kubernetes platform used by 30 product teams. How do you handle isolation, security, cost and upgrades?
- You find out that long-lived AWS access keys were pushed to a public GitHub repository an hour ago. How do you respond?
- Design observability and alerting for a customer-facing API so on-call gets paged for real problems but not for noise.
- Design an event-driven order processing system on a public cloud that must handle traffic spikes and never lose or double-charge an order.
- Your company has hundreds of Terraform configurations owned by many teams. How do you structure modules, state and governance so it scales safely?