Security

Your EC2 instances in a private subnet need to reach S3 and a third-party API, but must never be reachable from the internet. Design the networking.

Outbound-only access comes from a NAT Gateway in a public subnet, but S3 traffic should skip it entirely through a VPC endpoint, which is free and never leaves the AWS network. Nothing can reach in because there's no route for it to take, not because a rule is blocking it, and that distinction is usually the real follow-up question.

How do you continuously monitor an AWS account for security and compliance drift, instead of only finding out during an annual audit?

Point-in-time audits catch a configuration that was wrong when someone happened to look. AWS Config evaluates resources continuously against rules and records every configuration change, CloudTrail records who made it, and Security Hub aggregates both into one place with a severity score so drift gets flagged the hour it happens, not the quarter someone checks.

A secret was committed six months ago and exists in hundreds of commits. What do you do?

Treat it as a security incident, not a Git cleanup task. Rotate first, then work out the blast radius, then decide honestly whether rewriting history is worth the cost. The rewrite is the most visible part of the response and the least important one.

Your organization wants signed commits for production code. How would you implement it?

git config user.email is free text, not identity, so signing is what turns authorship into a cryptographic claim. Roll out SSH signing, enforce it with branch protection and a trusted-key list, and plan for the parts that actually break rollouts: bots, squash merges, and key rotation.

Someone moved a production Git tag to a different commit. Why is that dangerous?

A release tag is a promise that a version name means one exact, unchanging set of code. Moving it breaks that promise everywhere at once: rollbacks, audits, incident timelines, and any pipeline that deploys by tag now point somewhere different from what people believe, and some clones won't even notice the change.

Your organization wants production deployments to be reproducible six months later. How does Git help?

Git pins the source exactly and that's all it pins. Real reproducibility also needs locked dependencies, versioned infrastructure, immutable artifacts, and a stored record linking a deployment to its digest, plus keeping the actual artifact, because rebuilding it later is rarely byte-identical.

A company uses AWS Organizations with all features enabled. For compliance reasons, workloads may only run in two approved AWS Regions. Account administrators in member accounts currently hold the AdministratorAccess policy. The company must prevent resources from being created in any other Region. What should a solutions architect do?

A service control policy is the only control that an account administrator cannot remove, because it caps what identities in a member account may do no matter what their IAM policies say. IAM policies and permissions boundaries can both be edited by the very administrators you are trying to constrain.

An application Pod needs to call the Kubernetes API using a ServiceAccount named deployer. How does the Pod get a token in a current cluster?

Setting serviceAccountName on the Pod is enough. The kubelet requests a short-lived, automatically rotated token through the TokenRequest API and mounts it as a projected volume.

A NetworkPolicy ingress rule has one from entry containing both a namespaceSelector (user=alice) and a podSelector (role=client). Which traffic is allowed?

Selectors inside one from entry are combined with AND. Splitting them into two entries in the from list makes it OR, and that single dash is the whole difference.

A shared Gateway lives in the infra namespace. A team applies an HTTPRoute in their own namespace referencing that Gateway, and it is not accepted. What is required?

A Gateway only accepts routes from its own namespace by default. Attaching a route from elsewhere requires the Gateway's listener to permit it through allowedRoutes.