Reviewed by Aditya Kumar · Last reviewed 2026-03-24
Architectural logic: EC2 = compute; IAM roles = identity without long-lived keys. Why roles matter: Embedded access keys are a top breach vector; roles use instance metadata for temporary credentials that rotate automatically. Flow: Attach role at launch → app uses default...
Red Flag: Mentioning storing AWS keys in config files or env vars. Pro-Move: 'Every EC2 gets an instance profile; we use permission boundaries to limit role escalation—zero keys in code.'
This easy-level Cloud/Tools question appears frequently in data engineering interviews at companies like Chryselys. While less common, it tests deeper understanding that distinguishes strong candidates. Mastering the underlying concepts (etl) will help you answer variations of this question confidently.
Start by clearly defining the core concept being asked about. Interviewers want to see that you understand the fundamentals before diving into implementation details. Structure your answer with a definition, then explain the practical application with a concise example.
Architectural logic: EC2 = compute; IAM roles = identity without long-lived keys. Why roles matter: Embedded access keys are a top breach vector; roles use instance metadata for temporary credentials that rotate automatically. Flow: Attach role at launch → app uses default credential chain (boto3, SDK) → no keys in code. Policies define S3, Secrets Manager, etc. Scalability: One role can serve many instances; policies scale via JSON. Cost: No extra cost for roles. Security: Principle of least privilege; no root; CloudTrail for audit. Example: ETL host role with s3:GetObject, s3:PutObject on specific bucket—attach at launch, app works without config.
Red Flag: Mentioning storing AWS keys in config files or env vars. Pro-Move: 'Every EC2 gets an instance profile; we use permission boundaries to limit role escalation—zero keys in code.'
Some links below are affiliate links. If you buy through them we may earn a small commission at no extra cost to you — it helps keep DataEngPrep free.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.