Katkat
Back

Design secure multi-tier cloud infrastructure

AmazonSoftware Engineer · Technical Screen
HardSoftware EngineerTechnical ScreenSystem Design

Last updated

This question evaluates cloud systems design competencies including multi-tier network architecture, IP addressing and capacity planning, security controls, centralized server management, shared storage trade-offs, and identity and access integration within a production-scale virtual private cloud.

Design and deploy a multi-tier VPC-based architecture for a large-scale application. Address: (

  1. Multi-layer segmentation (web/app/db) across multiple Availability Zones with subnets, route tables, NAT/bastion access, and security groups vs. network ACLs; (
  2. IP planning for at least 2,000 servers: choose VPC and subnet CIDR ranges, account for per-subnet reserved IPs, keep headroom for growth, distribute across at least three AZs, show calculations, and present one feasible plan; (
  3. Centralized management for Linux and Windows (patching, configuration, inventory, remote sessions): compare AWS Systems Manager, AD/Group Policy, and tools like Ansible/Salt; (
  4. Shared storage for concurrent access: compare NFS, Amazon EFS, SMB/FSx, and object-storage gateways, discussing consistency/locking, throughput/IOPS scaling, latency, and cost; (
  5. Single sign-on for administrators to "log in once" to servers and consoles using SSO (SAML/OIDC), MFA, short-lived credentials (e.g., SSM Session Manager/Kerberos), RBAC, auditing, and break-glass procedures.