How it worksPricingInterview questions
Amazon · DevOps Engineer

Amazon DevOps Engineer Interview Questions (2026): process, questions and answers

Updated 4 November 2026 · prep guide

Amazon’s DevOps Engineer interviews usually test deep knowledge of cloud automation, container orchestration, monitoring and incident response. Use this guide to review concise answers, practice scenario storytelling and polish your behavioural narratives.

Preparing for Amazon? Rehearse these questions with Interview AI Helper: ask any question and get a suggested answer in seconds, written from your own resume.

Free 5-minute demo

How the Amazon DevOps Engineer interview usually works

  1. Phone screen: A recruiter or engineer typically asks high‑level design and experience questions.
  2. Technical phone: A senior engineer probes your CI/CD, Linux and cloud tooling knowledge.
  3. On‑site loop: You face multiple rounds covering coding, system design, troubleshooting and culture fit.
  4. HR round: Focuses on leadership principles and teamwork examples.

Technical questions and answers

Which kubectl command displays the current resource usage of a pod?

Use kubectl top pod <pod-name>; it queries the metrics‑server to show CPU and memory consumption for the pod, helping you spot hot spots quickly. If the metrics server is not installed, you would need to deploy it first.

How do you configure Docker to limit a container’s memory usage?

Add the --memory flag to docker run, for example docker run --memory 512m <image>. Docker’s cgroup driver enforces the limit, and the container will be killed if it exceeds the allocation, protecting the host.

What is the purpose of a Terraform backend configuration?

A backend determines where Terraform stores its state file and how it is locked. Using a remote backend such as S3 with DynamoDB enables team collaboration, state versioning and automatic locking to avoid concurrent modifications.

Explain how you would use systemd to restart a failing service automatically.

Create a unit file with Restart=on-failure and optionally RestartSec=5. Then run systemctl enable <service> and systemctl start <service>. systemd will monitor the process and relaunch it after a crash, reducing downtime.

Which Prometheus query would you write to alert when error rate exceeds 5% over five minutes?

Use sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) > 0.05. This calculates the proportion of 5xx responses and triggers an alert if it stays above five percent.

Interview with Amazon coming up?

Practise these DevOps Engineer questions out loud and get suggested answers in real time, based on your own resume. Free 5-minute demo, no subscription.

Try the free demo

How can you safely rotate AWS IAM credentials used by a CI pipeline?

Store the credentials in AWS Secrets Manager, grant the pipeline role secretsmanager:GetSecretValue, and configure the CI tool to fetch the secret at runtime. Rotate the secret in Secrets Manager; the pipeline picks up the new values on the next run without code changes.

What does the --detach (-d) flag do in a docker run command?

It runs the container in the background and prints the container ID. The container’s STDOUT/STDERR are not attached to your terminal, allowing you to continue using the shell while the container runs.

Describe the steps to enable audit logging in Kubernetes.

Create an AuditPolicy YAML defining the events to capture, then edit the API server startup flags to include --audit-policy-file, --audit-log-path, and optionally --audit-log-maxage. Restart the API server; audit logs will be written to the specified path for compliance and forensics.

How would you debug a DNS resolution failure inside a pod?

First exec into the pod and run nslookup <service> or dig. Check /etc/resolv.conf for the correct nameserver. Verify the CoreDNS pods are healthy with kubectl get pods -n kube-system -l k8s-app=kube-dns. If needed, restart CoreDNS or inspect its ConfigMap for errors.

What is the benefit of using a GitHub Actions self‑hosted runner in a private VPC?

A self‑hosted runner runs inside your network, giving you direct access to internal services, reduced latency, and the ability to use private credentials without exposing them to a public SaaS runner. It also allows you to control the runner’s environment and resource limits.

Scenario questions

You notice a sudden spike in latency for an order‑processing microservice that uses Kubernetes and Istio. How do you investigate?

Start by checking Istio metrics for the service’s request latency and error rate. Correlate with Prometheus alerts and look at recent deployment events. Use kubectl top pod to see if any pod is CPU‑starved, and inspect pod logs for exceptions. If a recent config change is found, roll back the virtual service or deployment, then monitor for recovery. Emphasize systematic data collection, root‑cause isolation and quick mitigation.

During a Terraform apply, the state lock cannot be acquired and the run hangs. What steps do you take?

Explain that you first verify the lock provider (e.g., DynamoDB) for stale entries. Use the Terraform CLI to manually unlock with terraform force-unlock <LOCK_ID> after confirming no other run is active. Check IAM permissions for the lock table and ensure network connectivity. Finally, re‑run the apply and monitor for successful lock acquisition. Highlight safe unlocking and verification of underlying lock mechanism.

A Jenkins job that builds Docker images fails intermittently with network timeouts pulling base images. How would you resolve it?

Investigate the network path to the Docker registry, checking for latency spikes or DNS issues. Add a retry wrapper around the docker pull step or enable a local registry cache. Verify Jenkins agents have sufficient bandwidth and that the registry’s rate limits are not being hit. Document the fix and add monitoring for future pull failures. Show a methodical approach and preventive measures.

HR and behavioural questions

Tell me about a time you had to convince a team to adopt a new CI/CD tool.

Use the STAR format: Situation, legacy scripts caused frequent failures; Task, improve reliability; Action, built a proof‑of‑concept pipeline, presented metrics on reduced lead time, addressed security concerns, and offered training; Result, team migrated, deployment frequency increased by 30 % and rollback time dropped. Highlight communication, data‑driven persuasion and stakeholder alignment.

Describe a situation where you handled a production incident under pressure.

Outline the incident: a cache outage caused 5 xx errors. Explain how you followed the on‑call runbook, used runbooks and monitoring dashboards, coordinated with the database team, implemented a temporary fallback, and performed a post‑mortem. Emphasize clear communication, rapid diagnosis, and implementing preventive measures.

Give an example of when you automated a repetitive manual task. What was the impact?

Mention automating the creation of IAM roles for new services using a Terraform module. Detail the script, the reduction in manual effort (e.g., 2 hours per week saved), and how it eliminated human error, leading to more consistent permissions and faster onboarding.

How do you prioritize work when you have multiple high‑urgency tickets?

Explain that you assess business impact, SLA commitments and dependencies. You use a simple matrix to rank tickets, communicate with stakeholders about trade‑offs, and focus on the highest‑impact issue first while delegating or scheduling lower‑priority tasks. Mention using a Kanban board to visualize progress and avoid overload.

Your last 48 hours before the interview

  1. Review the 10 technical Q&A and rehearse each answer aloud, timing yourself.
  2. Run a small Kubernetes cluster locally and practice the troubleshooting steps from the scenario questions.
  3. Write a one‑page summary of your most recent CI/CD pipeline, highlighting tools, metrics and improvements.
  4. Mock a behavioural interview with a friend, using the STAR format for each question.
  5. Set up a Prometheus alert for error rate on a test service and verify the notification flow.
  6. Prepare a concise list of your key achievements and have it ready for the HR round.

Common mistakes to avoid

Frequently asked questions

How many interview rounds does Amazon typically have for a DevOps role?

Candidates usually experience a phone screen, a technical phone, and an on‑site loop with several engineering and HR interviews, though the exact number can vary.

Do I need to know AWS services in detail for this role?

A solid understanding of core services such as EC2, S3, IAM, CloudWatch and EKS is expected, but deep expertise in every service is not required.

What should I bring to a virtual on‑site interview?

A stable internet connection, a quiet environment, a notebook for quick sketches, and any prepared STAR stories. Have a backup device ready in case of connectivity issues.

How important are coding skills for a DevOps Engineer at Amazon?

Coding is important for automation and scripting; you should be comfortable writing Bash, Python or Go snippets and explaining algorithmic thinking when asked.

Interview with Amazon coming up?

Practise these DevOps Engineer questions out loud and get suggested answers in real time, based on your own resume. Free 5-minute demo, no subscription.

Try the free demo

More Amazon interview guides

DevOps Engineer interview questions at other companies

Related reading

This is an independent preparation guide based on commonly reported interview patterns. The process varies by team, location and year. Interview AI Helper is not affiliated with Amazon.

← All interview question guides