Cloud security interview questions
Questions about access to cloud resources: storage buckets, workload identities, IAM policies, network boundaries and secrets. The scenarios ask you to reason about who can reach a resource and what they can do with it.
This topic has 15 opening questions and 60 follow-ups in the interview. Choose this domain in setup to practise it by voice or text.
An engineer has an access key pair in a file on their laptop, used to deploy to production from the command line. What is the problem, and what would you replace it with?
A security group allows SSH from 0.0.0.0/0. The team says it is fine because the instance holds no customer data and login needs a key. How do you respond?
A developer asks for admin on the dev account for a week to unblock a migration. How do you respond?
Someone reports that one of your object storage buckets is "public". What does that actually mean, and how do you check? Take AWS S3 as the example, or another provider if you know it better — say which.
A pipeline injects production database credentials as environment variables at job start, pulled from a secrets manager. The team says the secrets are not in git, so this is fine. What do you still want to know?
Your app fetches a user-supplied URL to build a link preview. A researcher says they can reach internal addresses. What worries you? Assume it runs on AWS, or name the provider you are thinking of.
This is the trust policy on a deployment role in our production account. The vendor who runs our CI asked for it. What do you think?
{ "Version": "2012-10-17", "Statement": [ { "Sid": "LetCIDeploy", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::209876543210:root" }, "Action": "sts:AssumeRole", "Condition": { "StringLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/ci-*" } } } ] }A pod in your Kubernetes cluster is running attacker-controlled code. What can the attacker reach, and what is the first thing you want to know about that pod?
Your CI pipeline runs infrastructure-as-code with permission to create and attach IAM roles. What worries you about that, and what would you change?
Review this security group for a service that handles payment data.
resource "aws_security_group" "app" { name = "app-tier" ingress { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { description = "internal only" from_port = 0 to_port = 65535 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } # The VPC is 10.0.0.0/16. A transit gateway attaches three other # accounts, and a site-to-site VPN attaches the corporate network.A serverless function's execution role can read and write any object in any storage bucket in the account. The team says that is fine because it never leaves their cloud account. What is wrong with that framing?
Two hundred internal services talk to each other over the network with no authentication, because it is all inside the VPC. Argue with that.
You are designing a multi-tenant SaaS on a cloud provider. The requirement is that one tenant's data must not become reachable by another tenant even if the application has a bug. Where do you put the boundary, and what does that choice cost you?
Assume a set of cloud credentials will be stolen at some point. How would you make sure that gets noticed quickly?
You inherit a cloud organisation of sixty accounts with no organisation-level guardrails, and every team is an admin in its own account. Where do you start, and what do you deliberately leave alone in the first quarter?
Each question is beginner or advanced. The tier describes the starting question; it is a practice label, not a certification. Questions by Pratik Amin.