AWS Interview Preparation — S3, SQS & EC2

Target profile: Senior Java / Spring Boot / Full Stack developer
AWS experience represented: Amazon S3, Amazon SQS, Amazon EC2
Project use case: S3 for file storage/read/write, SQS for asynchronous file-processing messages containing S3 paths, and EC2 for application/server operations.

1. How I Used AWS in My Project

Interview answer

In our project, we mainly used Amazon S3 for storing files and Amazon SQS for asynchronous communication.

When a user uploaded a file, the application stored the file in S3 and generated the S3 object key/path. Instead of processing the file synchronously during the API request, we published the S3 path and relevant metadata to an SQS queue.

A consumer service read the message from SQS, downloaded the file from S3, processed it, and updated the application/database.

For EC2, my involvement was primarily operational. I logged into EC2 instances to verify deployments, inspect logs, check application status, restart services when required, and troubleshoot production issues.

Architecture

flowchart LR
    U[User] --> API[Spring Boot API]
    API --> S3[(Amazon S3)]
    S3 --> API
    API --> Q[Amazon SQS]
    Q --> C[Consumer / Worker]
    C --> S3
    C --> DB[(Database)]
    EC2[Amazon EC2] -. Hosts application / services .-> API
    EC2 -. Hosts consumer / worker .-> C

2. Amazon S3 Interview Questions

Q1. What is Amazon S3?

Answer

Amazon S3 is an object storage service used to store and retrieve files and other unstructured data.

An S3 object consists primarily of:

Object data
Object key
Metadata

Objects are stored inside buckets.

Typical project examples include:

CSV files
PDFs
Images
Reports
Application-generated documents
Backup files

Q2. Why did you use S3 instead of storing files in the database?

Answer

We used S3 because it is designed for scalable object storage.

Storing large binary files directly in the database can increase database size, affect backup/restore operations, and consume database resources.

We stored the actual file in S3 and maintained metadata such as:

File ID
File name
S3 bucket
S3 object key
File status
Upload timestamp

in the database.

flowchart LR
    API[Application] --> S3[(S3: Actual File)]
    API --> DB[(DB: File Metadata)]

    DB --> M1[File ID]
    DB --> M2[Bucket]
    DB --> M3[Object Key]
    DB --> M4[Status]

Q3. What is an S3 bucket?

Answer

A bucket is a logical container for objects in S3.

For example:

customer-files
  ├── uploads/
  │   ├── 2026/
  │   │   ├── report.csv
  │   │   └── invoice.pdf
  │
  └── processed/
      └── result.csv

Q4. What is an S3 object key?

Answer

An object key uniquely identifies an object within a bucket.

For example:

Bucket:
customer-files

Object Key:
uploads/2026/report.csv

The complete logical location can be represented as:

s3://customer-files/uploads/2026/report.csv

Q5. How did your Spring Boot application upload files to S3?

Answer

The application received the file through the API and used the AWS SDK for Java to upload it to S3.

After a successful upload, we retained the bucket and object key. That information was then used for subsequent file retrieval and for publishing the processing message to SQS.

A simplified flow is:

sequenceDiagram
    participant U as User
    participant API as Spring Boot
    participant S3 as S3
    participant Q as SQS

    U->>API: Upload file
    API->>S3: Put object
    S3-->>API: Upload success
    API->>Q: Send bucket/object key
    Q-->>API: Message accepted
    API-->>U: Request accepted

Q6. How do you read a file from S3?

Answer

The application uses the AWS SDK to request the object using its bucket and object key.

Conceptually:

bucket = customer-files
key    = uploads/2026/report.csv

        ↓

S3 GetObject

        ↓

InputStream / file content

The consumer can then process the stream without necessarily creating an unnecessary intermediate copy.

Q7. How do you secure an S3 bucket?

Answer

We should avoid making application buckets public.

Access should be controlled using:

IAM permissions
IAM roles
Bucket policies where required
Encryption
Block Public Access settings
Least-privilege permissions

For example, an application role may be allowed to read and write only to a specific bucket/prefix rather than having unrestricted access to all S3 resources.

Q8. What is an S3 pre-signed URL?

Answer

A pre-signed URL provides temporary access to a specific S3 object without making the bucket or object publicly accessible.

It is useful when:

A browser needs to download a private file.
A client needs temporary upload access.
We don’t want to expose AWS credentials to the client.

The URL has an expiration time.

Q9. What is S3 versioning?

Answer

S3 Versioning keeps multiple versions of an object.

If a file with the same key is uploaded again, S3 can retain the previous version rather than permanently overwriting it.

It is useful for:

Accidental deletion recovery
File history
Recovery from accidental overwrites

Q10. What are S3 lifecycle policies?

Answer

Lifecycle policies automatically transition or delete objects based on rules.

For example:

New files
   ↓
S3 Standard
   ↓ after configured period
Infrequent Access / other storage class
   ↓
Archive
   ↓
Delete after retention period

This can reduce storage cost and automate retention.

Q11. What are S3 storage classes?

Answer

Common storage classes include:

S3 Standard — frequently accessed data
S3 Standard-IA — infrequently accessed data
S3 One Zone-IA — infrequently accessed, non-critical/re-creatable data
S3 Glacier Instant Retrieval
S3 Glacier Flexible Retrieval
S3 Glacier Deep Archive

The choice depends on access frequency, retrieval requirements, durability requirements, and cost.

Q12. What is S3 consistency?

Answer

Amazon S3 provides strong read-after-write consistency for object PUTs and DELETEs. After a successful write, subsequent reads can immediately reflect the latest object state.

This simplifies application design compared with older consistency models.

3. Amazon SQS Interview Questions

Q13. Why did you use SQS?

Answer

We used SQS to decouple file upload from file processing.

The API did not have to wait for potentially expensive processing. It uploaded the file to S3 and placed the file location into SQS.

The consumer processed the file asynchronously.

Benefits:

Loose coupling
Better response time
Retry capability
Failure isolation
Horizontal scaling of consumers

Q14. Why didn’t you put the actual file into SQS?

Answer

SQS is intended for messages rather than large file storage, and an SQS message has a maximum size of 256 KB.

Therefore, we stored the actual file in S3 and sent only metadata such as the S3 bucket and object key through SQS.

flowchart LR
    F[Large File] --> S3[(S3)]
    K[Bucket + Object Key] --> Q[SQS]
    Q --> C[Consumer]
    C --> S3

Q15. What did your SQS message look like?

Answer

A message could contain information such as:

{
  "fileId": 1054,
  "bucket": "customer-files",
  "objectKey": "uploads/2026/report.csv"
}

The exact payload depends on the application’s contract.

Q16. Explain the complete S3 + SQS processing flow.

Answer

sequenceDiagram
    participant Client
    participant API as Spring Boot API
    participant S3 as Amazon S3
    participant Q as Amazon SQS
    participant Worker as File Consumer
    participant DB as Database

    Client->>API: Upload file
    API->>S3: Store file
    S3-->>API: Success
    API->>Q: Send file metadata
    Q-->>API: Message accepted
    API-->>Client: Accepted

    Worker->>Q: Receive message
    Q-->>Worker: File metadata
    Worker->>S3: GetObject
    S3-->>Worker: File content
    Worker->>Worker: Process file
    Worker->>DB: Update status
    Worker->>Q: Delete message

Q17. What happens if processing fails?

Answer

SQS uses a visibility timeout.

After the consumer receives a message, the message becomes temporarily invisible to other consumers.

If processing succeeds, the consumer deletes the message.

If processing fails and the message is not deleted, it becomes visible again after the visibility timeout and can be retried.

For repeatedly failing messages, we can configure a Dead Letter Queue (DLQ).

Q18. What is Visibility Timeout?

Answer

Visibility Timeout is the period during which a received SQS message is hidden from other consumers.

Example:

Message available
      ↓
Consumer receives message
      ↓
Message becomes invisible
      ↓
Processing
      ↓
Success → Delete message

Failure → Timeout expires → Message visible again

The timeout should be long enough for normal processing.

For long-running processing, the consumer can extend the visibility timeout when appropriate.

Q19. What is a Dead Letter Queue?

Answer

A DLQ is a separate queue used to isolate messages that cannot be successfully processed after repeated attempts.

Example:

Main Queue
    ↓
Attempt 1
    ↓
Attempt 2
    ↓
Attempt 3
    ↓
DLQ

This allows the team to investigate problematic messages without continuously retrying them in the main queue.

Q20. What is SQS Long Polling?

Answer

With short polling, the consumer repeatedly asks SQS whether messages are available.

With long polling, the request can wait for messages for a configured period.

Long polling can:

Reduce empty responses
Reduce unnecessary API calls
Reduce cost
Improve efficiency

Q21. Standard SQS vs FIFO SQS?

Standard	FIFO
Very high throughput	Ordering-focused
At-least-once delivery	Exactly-once processing support
Ordering is not guaranteed	Message order is preserved within FIFO constraints
Suitable for independent processing	Suitable when order matters

Interview answer

If our file-processing messages were independent and ordering was not required, Standard SQS was appropriate.

If processing required strict ordering, FIFO would be considered.

Q22. Does SQS guarantee exactly-once processing?

Answer

A Standard SQS queue provides at-least-once delivery, so duplicate delivery is possible.

Therefore, consumers should ideally be idempotent.

For example, before processing a file, we can use a unique file ID or processing ID to determine whether that operation has already been completed.

Q23. What is idempotency and why is it important with SQS?

Answer

An operation is idempotent when performing it multiple times produces the same final result as performing it once.

For example:

Message:
fileId = 1054

First delivery:
Process file → SUCCESS

Duplicate delivery:
Check fileId/status → Already processed
Skip duplicate processing

This is important because Standard SQS can deliver a message more than once.

Q24. How would you scale SQS consumers?

Answer

We can run multiple consumer instances.

For example:

flowchart LR
    Q[SQS Queue] --> C1[Consumer 1]
    Q --> C2[Consumer 2]
    Q --> C3[Consumer 3]
    C1 --> S3[(S3)]
    C2 --> S3
    C3 --> S3

Each consumer can process different messages.

In a production architecture, EC2 Auto Scaling, ECS, EKS, or another compute platform can be used to scale consumers based on workload.

Q25. What happens if the consumer crashes?

Answer

If the consumer crashes before deleting the message, the visibility timeout eventually expires and the message becomes available again.

Another consumer can process it.

This is one of the reliability benefits of SQS.

Q26. What is a poison message?

Answer

A poison message is a message that repeatedly fails processing due to invalid data, corrupt input, unsupported format, or a persistent application problem.

A DLQ helps isolate such messages.

4. EC2 Interview Questions

Q27. What is Amazon EC2?

Answer

Amazon EC2 provides virtual compute instances in AWS.

We can use EC2 to run:

Spring Boot applications
Background workers
Web servers
Other backend processes

Q28. What was your hands-on experience with EC2?

Strong and honest answer

My main hands-on responsibility with EC2 was application-level operations rather than infrastructure provisioning.

I logged into instances to:

Check application status
Review logs
Troubleshoot issues
Verify deployments
Restart services
Check CPU, memory, and disk usage
Validate application health

Infrastructure provisioning and some AWS administration activities were handled by the DevOps/cloud team.

Q29. How do you connect to an EC2 Linux instance?

Answer

Typically through SSH using a key pair:

ssh -i my-key.pem ec2-user@<public-ip>

The exact username depends on the AMI.

Q30. How do you troubleshoot a Spring Boot application on EC2?

Answer

I would follow a structured approach:

Check whether the process is running.
Check application logs.
Check the health endpoint.
Check CPU and memory.
Check disk space.
Check network connectivity.
Verify configuration/environment variables.
Check dependent services such as S3, SQS, and database.
Restart the application only after understanding the issue where possible.

flowchart TD
    A[Application Issue] --> B{Process Running?}
    B -->|No| C[Check Startup Logs]
    B -->|Yes| D[Check Application Logs]
    D --> E[Check Health Endpoint]
    E --> F[Check CPU / Memory / Disk]
    F --> G[Check DB / S3 / SQS Dependencies]
    G --> H[Fix and Validate]

Q31. How do you check CPU, memory, and disk on Linux?

Answer

Typical commands include:

top
free -m
df -h
ps -ef | grep java

Q32. How do you check whether a Spring Boot application is healthy?

Answer

If Spring Boot Actuator is enabled:

curl http://localhost:8080/actuator/health

A successful response indicates that the application is responding, although dependency-specific health should also be checked.

5. AWS IAM & Security Questions — Commonly Asked

Q33. What is IAM?

Answer

IAM stands for Identity and Access Management.

It controls who or what can access AWS resources and what actions they can perform.

Core concepts include:

Users
Groups
Roles
Policies

Q34. What is an IAM Role?

Answer

An IAM role provides temporary permissions that can be assumed by an AWS service, application, or trusted identity.

For an application running on EC2, an instance profile/IAM role is preferable to storing AWS access keys in configuration files.

Q35. Why should you avoid hardcoding AWS access keys?

Answer

Hardcoding credentials creates security risks.

Credentials can accidentally appear in:

Git repositories
Logs
Docker images
Configuration files

A better approach is to use IAM roles for AWS workloads and appropriate secret-management mechanisms when credentials are genuinely required.

Q36. What is least privilege?

Answer

Least privilege means giving an identity only the permissions required to perform its job.

For example, if a service only needs to read objects from:

s3://customer-files/uploads/

it should not automatically receive unrestricted S3 administrator permissions.

6. AWS Reliability & Architecture Questions

Q37. What happens if S3 upload succeeds but SQS publishing fails?

Answer

This is an important distributed-system failure scenario.

We could end up with:

S3 upload → SUCCESS
SQS send  → FAILURE

The file exists, but no processing message exists.

I would design for this explicitly using mechanisms such as:

Retry with backoff
Persisting processing status in the database
Reconciliation/retry jobs
An event-driven design using S3 events where appropriate
Transactional/outbox-style patterns for reliable application workflows

The exact solution depends on business requirements.

Q38. What happens if SQS message is published but database update fails?

Answer

The message may be retried depending on when it is acknowledged/deleted.

The consumer should make processing idempotent and maintain a clear processing state.

For example:

RECEIVED
   ↓
PROCESSING
   ↓
SUCCESS

If processing fails:

PROCESSING
   ↓
FAILED / RETRY

The design should prevent duplicate processing from producing incorrect business results.

Q39. How would you handle duplicate SQS messages?

Answer

I would make the consumer idempotent.

For example, use a unique fileId or processing ID.

Before performing the business operation:

Check processing status

Already SUCCESS?
      ↓
    Skip

Not processed?
      ↓
Process
      ↓
Mark SUCCESS

Q40. How would you monitor this architecture?

Answer

I would monitor:

S3

Upload failures
Access errors
Object lifecycle/retention
Storage usage

SQS

Queue depth
Messages delayed
Age of oldest message
DLQ message count
Consumer failures

EC2

CPU
Memory
Disk
Network
Application health
Application logs

For AWS-native monitoring, CloudWatch is an important component.

7. AWS Questions Commonly Asked for Senior Developers

Q41. What is CloudWatch?

Answer

Amazon CloudWatch provides monitoring and observability for AWS resources and applications.

It can collect:

Metrics
Logs
Alarms
Events

For an SQS-based system, CloudWatch metrics can help identify increasing queue depth or processing problems.

Q42. What is the difference between SQS and SNS?

Answer

SQS is primarily a queue used for asynchronous processing.

SNS is primarily a publish/subscribe messaging service used to fan out notifications to multiple subscribers.

Example:

flowchart LR
    P[Producer] --> SNS[SNS Topic]
    SNS --> Q1[SQS Queue 1]
    SNS --> Q2[SQS Queue 2]
    SNS --> E[Other Subscriber]

A common architecture is SNS for fan-out and SQS for durable asynchronous consumption.

Q43. S3 vs EBS?

Answer

S3	EBS
Object storage	Block storage
Accessed through APIs	Attached to EC2
Good for files/objects	Good for server disks
Highly scalable object storage	Persistent block device
Common for application files	Common for EC2 operating/application storage

Q44. S3 vs EFS?

Answer

S3 is object storage.

EFS is a managed network file system that can be mounted by compute resources.

Use S3 when the application works with objects/files through APIs.

Use EFS when applications need a shared file-system-like interface.

Q45. What is Auto Scaling?

Answer

Auto Scaling allows compute capacity to increase or decrease according to workload.

For example:

Low traffic
   ↓
2 EC2 instances

High traffic
   ↓
4 EC2 instances

Very high traffic
   ↓
6 EC2 instances

This improves availability and allows the system to respond to changing load.

Q46. What is an Elastic Load Balancer?

Answer

A load balancer distributes incoming traffic across multiple targets such as EC2 instances.

flowchart LR
    U[Users] --> ALB[Application Load Balancer]
    ALB --> E1[EC2 #1]
    ALB --> E2[EC2 #2]
    ALB --> E3[EC2 #3]

This improves availability and supports horizontal scaling.

Q47. What is a Security Group?

Answer

A Security Group acts as a virtual firewall for AWS resources such as EC2.

It controls inbound and outbound traffic using rules.

For example:

Internet
   ↓
ALB : 443
   ↓
EC2 : 8080

The EC2 security group should allow only the required traffic rather than exposing unnecessary ports.

Q48. What is a VPC?

Answer

A VPC is a logically isolated network in AWS.

It contains components such as:

Subnets
Route tables
Internet gateways
NAT gateways
Security groups
Network ACLs

For a production architecture, EC2 instances can be placed in private subnets while public-facing traffic enters through a load balancer.

8. Scenario-Based Senior Interview Questions

Q49. Queue depth keeps increasing. What would you investigate?

Answer

I would investigate both producer and consumer sides.

Producer

Are messages being generated faster than expected?
Has traffic increased?
Are duplicate messages being generated?

Consumer

Are consumers running?
Are consumers failing?
Is processing slower than normal?
Is S3 access slow?
Is the database slow?
Is visibility timeout configured correctly?

Infrastructure

CPU/memory
Network
Number of consumers
EC2 health

Then I would consider scaling consumers horizontally.

Q50. Messages are going to the DLQ. How would you troubleshoot?

Answer

I would:

Inspect the DLQ message.
Identify the exception/error.
Check whether the S3 object exists.
Verify the object key.
Check IAM permissions.
Check file format/content.
Check database/dependency failures.
Determine whether the issue is transient or permanent.
Fix the root cause.
Replay valid messages safely.

Q51. S3 file exists but the consumer says “file not found.” What would you check?

Answer

I would verify:

Bucket name
Object key
Region/configuration
IAM permissions
URL/path encoding
Whether the object was moved/deleted
Whether the application is using the expected AWS account/environment

I would also compare the exact object key from the SQS message with the key visible in S3.

Q52. The application works locally but cannot access S3 on EC2. What would you check?

Answer

I would check:

IAM role attached to EC2.
IAM permissions.
Bucket policy.
AWS region configuration.
Network configuration.
Credentials/provider configuration.
Application configuration.
CloudTrail/CloudWatch logs where applicable.

A common improvement is to use an EC2 IAM role instead of embedding credentials.

Q53. File processing is taking 10 minutes, but visibility timeout is 2 minutes. What can happen?

Answer

The message may become visible again while the first consumer is still processing it.

Another consumer could receive the same message, resulting in duplicate processing.

The solution is to configure an appropriate visibility timeout and/or extend the visibility timeout while processing, together with idempotent consumer logic.

Q54. How would you design this system for high availability?

Answer

I would avoid relying on a single EC2 instance.

A production architecture could use:

flowchart TB
    U[Users] --> ALB[Application Load Balancer]

    ALB --> E1[EC2 / App Instance 1]
    ALB --> E2[EC2 / App Instance 2]

    E1 --> S3[(S3)]
    E2 --> S3

    E1 --> Q[SQS]
    E2 --> Q

    Q --> W1[Worker 1]
    Q --> W2[Worker 2]
    Q --> W3[Worker 3]

    W1 --> S3
    W2 --> S3
    W3 --> S3

    W1 --> DB[(Database)]
    W2 --> DB
    W3 --> DB

The exact infrastructure depends on the organization’s AWS architecture and DevOps setup.

9. Important AWS Concepts to Know Before the Interview

For a senior Java developer who lists AWS on the resume, I would be prepared to explain these concepts at least at a practical level:

S3 bucket and object
Object key
S3 security
S3 versioning
S3 lifecycle policies
S3 storage classes
Pre-signed URLs
SQS Standard vs FIFO
Visibility timeout
Long polling
DLQ
At-least-once delivery
Idempotent consumers
Message retry
SQS scaling
IAM
IAM roles
Least privilege
CloudWatch
EC2
SSH
Security Groups
VPC basics
Load Balancer
Auto Scaling
S3 vs EBS
S3 vs EFS
SQS vs SNS
Failure scenarios between S3, SQS, database, and consumer

10. Rapid-Fire AWS Interview Questions

Use these for last-minute revision.

S3

What is S3?
Object storage.

What is a bucket?
Logical container for S3 objects.

What is an object key?
Unique identifier/path of an object within a bucket.

Can S3 store unlimited file size?
S3 supports very large objects, but individual object size has a service limit; multipart upload is used for large objects.

How do you secure S3?
IAM, bucket policies where required, Block Public Access, encryption, and least privilege.

What is versioning?
Maintains multiple object versions.

What is lifecycle management?
Automates object transitions/deletion based on rules.

What is a pre-signed URL?
Temporary access URL for a private S3 object.

SQS

Why SQS?
Asynchronous decoupling and reliable message processing.

Maximum SQS message size?
256 KB.

Can you put a large file into SQS?
No; store it in S3 and send its reference.

What is visibility timeout?
Time a received message remains hidden from other consumers.

What is DLQ?
Queue for repeatedly failed messages.

Can SQS deliver duplicates?
Yes, Standard SQS provides at-least-once delivery.

How do you handle duplicates?
Idempotent processing.

What is long polling?
Waiting for messages rather than repeatedly making empty receive calls.

EC2

What is EC2?
Virtual compute instance.

How do you access Linux EC2?
Usually SSH.

How do you check application health?
Actuator health endpoint or application/process checks.

How do you troubleshoot high CPU?
Check CPU-consuming processes, application logs, thread behavior, traffic, and resource metrics.

IAM

What is IAM?
AWS identity and access management.

What is an IAM role?
An identity with permissions that can be assumed by trusted entities such as AWS services or workloads.

Why IAM role instead of access keys on EC2?
Avoids embedding long-lived credentials in the application/server.

11. Best 60-Second Interview Explanation

If the interviewer says:

“Tell me about your AWS experience.”

Use this:

“My primary hands-on AWS experience is with S3, SQS, and EC2. We used S3 as object storage for files. When a file was uploaded, our Spring Boot application stored it in S3 and maintained the bucket and object key as metadata. We then published that file reference to SQS rather than sending the actual file through the queue.

A consumer service read the SQS message, retrieved the file from S3, processed it, and updated the database. This gave us asynchronous processing and decoupled the API from potentially long-running file processing.

We used SQS visibility timeout, retries, and DLQ concepts to handle failures, and the consumer needed to be idempotent because Standard SQS provides at-least-once delivery.

For EC2, my involvement was mainly operational. I logged into instances to check application logs, verify deployments, monitor the application, troubleshoot issues, and restart services when required. The cloud/DevOps team handled the deeper infrastructure provisioning and networking.

From a security perspective, I understand IAM roles, least-privilege access, private S3 buckets, encryption, and avoiding hardcoded AWS credentials.“

12. What NOT to Say in the Interview

Avoid saying:

“I only know how to login to EC2.”

Instead say:

“My EC2 experience was primarily application operations rather than infrastructure provisioning. I used EC2 for deployment verification, log analysis, application troubleshooting, health checks, and service management.”

Avoid saying:

“SQS stores the file path.”

Better:

“We published a message containing the S3 bucket/object key and related processing metadata.”

Avoid saying:

“SQS guarantees exactly once.”

Better:

“Standard SQS provides at-least-once delivery, so our consumer needs idempotency.”

Avoid saying:

“We put files in SQS.”

Better:

“We stored the file in S3 and sent its reference through SQS.”

13. Interviewer Follow-Up Trap Questions

These are especially useful for senior-level preparation.

Trap 1

Interviewer: “If SQS guarantees delivery, why do you need a DLQ?”

Answer:
SQS provides reliable delivery semantics, but the consumer can repeatedly fail to process a particular message. A DLQ isolates those messages after the configured number of receive attempts so that they don’t continuously retry in the main queue.

Trap 2

Interviewer: “If you delete an SQS message after receiving it, is processing guaranteed?”

Answer:
No. The application should delete the message only after successful processing. If it deletes the message before processing completes and then crashes, the work could be lost.

Trap 3

Interviewer: “What if your application processes the file successfully but crashes before deleting the SQS message?”

Answer:
The message may be delivered again. Therefore, the processing operation must be idempotent, for example by tracking a unique file/processing ID and checking whether it has already completed.

Trap 4

Interviewer: “Why not store the complete S3 URL in SQS?”

Answer:
We can store a URL if that is part of the contract, but bucket and object key are usually a cleaner internal representation because the consumer can construct the S3 request using the AWS SDK and IAM authorization.

Trap 5

Interviewer: “Why not make the S3 bucket public?”

Answer:
There is generally no reason to expose private application files publicly. Access should be controlled using IAM and, where appropriate, temporary pre-signed URLs.

14. Final Interview Preparation Checklist

Before the interview, make sure you can explain these without memorizing definitions:

15. One-Line Architecture Summary

S3 stores the files, SQS decouples and queues the processing request, the consumer processes the S3 object asynchronously, the database stores business/processing metadata, and EC2 provides compute for the application and/or workers.

This is the core architecture you should be able to explain confidently in the interview.