أسئلة المقابلة الخاصة بـ AWS 2026: EC2 وS3 وIAM وVPC والهندسة المعمارية

IAM Users: long-term credentials (access key + secret)
  - Human users accessing console
  - Service accounts (avoid - use roles instead)

IAM Roles: temporary credentials, assumed by services
  - EC2 role: allows EC2 to access S3 without hardcoded keys
  - Lambda role: allows Lambda to write to DynamoDB
  - Cross-account role: allows role assumption from another account
  - BEST PRACTICE: use roles for everything, avoid long-term keys

IAM Groups: collection of users with shared policies
  - Developers group: read/write to dev resources
  - Admins group: full access

IAM Policies: JSON documents defining permissions
  {
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::mybucket/*"
  }

VPC (Virtual Private Cloud) = your isolated network in AWS

Components:
  Subnets — segments of IP range
    Public subnet: routes to Internet Gateway (internet accessible)
    Private subnet: no direct internet access

  Internet Gateway — connects VPC to internet
  NAT Gateway — allows private subnets to access internet (outbound only)
  Route Tables — control traffic routing
  Security Groups — stateful firewall at instance level
  NACLs — stateless firewall at subnet level

Typical architecture:
  VPC: 10.0.0.0/16
    Public Subnet AZ-a: 10.0.1.0/24 → Internet Gateway
    Public Subnet AZ-b: 10.0.2.0/24 → Internet Gateway
    Private Subnet AZ-a: 10.0.10.0/24 → NAT Gateway
    Private Subnet AZ-b: 10.0.20.0/24 → NAT Gateway

# Auto Scaling Group configuration
AutoScalingGroup:
  MinSize: 2          # minimum instances (for HA)
  DesiredCapacity: 3  # normal operation
  MaxSize: 20         # maximum for peak load

# Scaling policies:
# 1. Target tracking (simplest):
#    Keep CPU at 70% → auto-scale
# 2. Step scaling: CPU 70-80% → add 1, 80-90% → add 2
# 3. Scheduled: add instances before known peak (8am weekdays)
# 4. Predictive scaling: ML-based, adds before load hits

# Use with: Application Load Balancer for traffic distribution
# Health checks: ALB health check → replace unhealthy instances