Design a secure three-tier web application on AWS (or your preferred cloud). Walk through the network and services.
What the interviewer wants to hear
- VPC across multiple AZs with public, private app and private data subnets
- Load balancer and CDN/WAF at the edge; app tier in private subnets with auto scaling
- Managed database in isolated subnets with Multi-AZ and encryption
- Security groups referencing each other, least privilege IAM roles, secrets manager
- Monitoring, logging, backups and IaC
Model answer
I would build a VPC across three availability zones with three subnet layers. Public subnets hold only the Application Load Balancer and NAT gateways. CloudFront with AWS WAF sits in front for caching, TLS and protection against common attacks. Private app subnets run the application on ECS Fargate or an EC2 Auto Scaling group, scaling on CPU or request count. Isolated data subnets host Aurora or RDS with Multi-AZ, encryption with KMS and automated backups. Security groups chain together: the ALB accepts 443 from the internet, the app accepts traffic only from the ALB security group, and the database only from the app security group. The app uses an IAM role and reads credentials from Secrets Manager. I add VPC endpoints for S3 and other services, CloudWatch logs and alarms, CloudTrail, and define everything in Terraform with CI review.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cloud Engineer questions
- How do you manage Terraform state and multiple environments (dev, staging, prod) safely?
- A team stores customer documents in an S3 bucket. How would you secure it?
- An instance in a private subnet cannot reach the internet to install packages. How do you troubleshoot it?
- How would you plan the migration of an on-premises application to the cloud?
- Describe how you would build a CI/CD pipeline for Terraform changes across dev, staging and production.
- A team wants to move a service onto your Kubernetes cluster. What do you check before calling it production ready?
- You are on call and p99 latency for a cloud API jumps from 200 ms to 3 seconds. Walk through how you investigate and handle it.
- How do you manage application secrets such as database passwords and API keys in a cloud environment?
- Design a tagging and cost allocation strategy for a company running many teams on AWS.