Amazon Security Engineer Interview Questions (2026)

1. 1Online Assessment (SDE OA)60 minMedium

   Two timed coding problems plus a workplace-simulation and logic section; the main gate for freshers and India volume hiring.

2. 2Phone screen45 minMedium

   One coding problem plus 1-2 Leadership Principle STAR questions with an SDE.

3. 3Coding loop round60 minMedium

   DSA problem to working code, followed by assigned-LP behavioral questions in STAR format.

4. 4System design loop round60 minHard

   Design an Amazon-scale service with capacity math, plus LPs; low-level/OOD design substitutes for junior candidates.

5. 5Hiring Manager round45 minMedium

   Team fit, project deep dives, and Deliver Results/Bias for Action stories with the manager you would report to.

6. 6Bar Raiser60 minHard

   An interviewer from outside the team stress-tests LP stories and overall bar with the hardest cross-examination of the loop; holds veto.

1. Q1

   For the Amazon Technical Phone Screen: Security Fundamentals round, during secure code review for a AWS/retail/logistics-style multi-account platforms API, you find user-controlled URLs passed to an internal fetcher. How would you assess and fix SSRF risk?

   FoundationalTechnical Phone Screen: Security FundamentalsApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: A strong candidate would first identify the potential for Server-Side Request Forgery (SSRF) and its implications, such as accessing internal AWS metadata, services, or other network resources. Assessment involves analyzing the fetcher's capabilities (protocols, redirects, headers), target environment, and existing controls. The primary fix is strict input validation and allowlisting of permitted domains/IPs, combined with URL parsing to prevent bypasses. Additionally, implementing network segmentation (e.g., VPC endpoints, security groups) and using IMDSv2 for AWS metadata access would be crucial defense-in-depth measures.

2. Q2

   A service uses JWTs for API authorization. What validation mistakes would you look for, and how would you test them? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

   IntermediateTechnical Phone Screen: Security FundamentalsApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: A strong candidate would identify common JWT validation flaws such as incorrect signature verification (e.g., 'none' algorithm allowed, weak keys, or algorithm confusion attacks), improper audience/issuer validation, and insufficient expiration/nbf (not before) checks. They would also consider replay attacks if JWTs are used as session tokens. Testing would involve manipulating JWTs to exploit these flaws, using tools like Burp Suite or custom scripts, and observing API responses for unauthorized access or unexpected behavior.

3. Q3

   How would you review a pull request that adds dynamic database queries for injection risks across SQL, NoSQL, and search backends? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

   IntermediateTechnical Phone Screen: Security FundamentalsApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: When reviewing a PR with dynamic database queries, I would first identify all user-controlled inputs and trace their flow to query construction. For SQL, I'd look for parameterized queries (e.g., prepared statements) and ORM usage, ensuring no direct string concatenation. For NoSQL (e.g., DynamoDB, MongoDB), I'd verify API-level parameter binding and projection/filter expression sanitization. For search backends (e.g., OpenSearch/Elasticsearch), I'd check for query DSL escaping, template injection prevention, and proper use of search templates. Finally, I'd assess the overall architecture for defense-in-depth, including WAF rules and least privilege database access.

4. Q4

   A frontend team asks whether CSP is enough to address stored XSS. How would you respond and what code changes would you request? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

   AdvancedTechnical Phone Screen: Security FundamentalsApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: CSP alone is not sufficient to fully address stored XSS, as it's a client-side control and XSS is fundamentally a server-side input validation and output encoding problem. While a strong CSP can mitigate the impact of some XSS vectors (e.g., preventing inline scripts or restricting script sources), it cannot prevent the injection of malicious content into the DOM if the application fails to properly sanitize user input and encode output. A comprehensive defense requires robust server-side input validation, context-aware output encoding (HTML, URL, JavaScript), and potentially client-side sanitization libraries for user-generated content, alongside a strict CSP. The requested code changes would focus on server-side input sanitization and context-aware output encoding, with CSP as a strong defense-in-depth layer.

5. Q5

   Explain how you would evaluate OAuth redirect handling and consent flows for account takeover risk. Frame your answer as you would in the Amazon Phone screen

   AdvancedTechnical Phone Screen: Security FundamentalsApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: I would start by analyzing the redirect URI validation, ensuring strict allow-listing and exact matching, especially for sensitive clients. Next, I'd examine the state parameter's implementation, verifying it's cryptographically random, bound to the user's session, and validated upon callback to prevent CSRF and authorization code interception. For consent, I'd assess the clarity and granularity of permissions requested, ensuring users understand the access being granted and that the application adheres to the principle of least privilege. Finally, I'd look for any potential for open redirect vulnerabilities or misconfigurations in client registration that could be exploited.

6. Q6

   For the Amazon AWS IAM & Cloud Security round, design an API rate-limiting strategy for AWS/retail/logistics-style multi-account platforms that distinguishes abusive automation from legitimate high-volume customers

   IntermediateAWS IAM & Cloud SecurityApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: A strong strategy involves a multi-layered approach using AWS WAF for initial rate-limiting based on IP, geographic, and header-based rules, combined with AWS API Gateway's built-in throttling for per-API key or per-account limits. For distinguishing legitimate high-volume users, implement adaptive rate-limiting using AWS Lambda and Amazon Kinesis/CloudWatch logs to analyze request patterns, user agents, and historical behavior. Leverage IAM roles and policies to define granular permissions and enforce least privilege, while also considering dedicated API keys for known partners with higher, pre-approved quotas. Finally, integrate with AWS Shield Advanced for DDoS protection and anomaly detection.

7. Q7

   A deserialization bug is reported in a dependency used by EKS clusters, Lambda functions, EC2 fleets, and distributed service teams. How do you determine exploitability and remediation priority? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

   IntermediateAWS IAM & Cloud SecurityApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: To determine exploitability, first identify the specific dependency, its version, and the deserialization mechanism (e.g., Java, Python, .NET). Analyze the application's usage of the dependency: what data is deserialized, from where (trusted/untrusted sources), and what classes are available in the classpath during deserialization. Look for known gadgets or custom gadget chains that could lead to Remote Code Execution (RCE) or other impacts. Remediation priority is then assessed by combining exploitability (ease and impact of RCE, DoS, data exfiltration) with the blast radius across EKS, Lambda, EC2, and other services, considering data sensitivity and business criticality.

8. Q8

   What secure coding standards would you enforce for secrets handling in CI/CD pipelines and application configuration? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

   AdvancedAWS IAM & Cloud SecurityApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: A strong answer would emphasize a 'never hardcode, never commit' principle, advocating for dedicated secrets management services like AWS Secrets Manager or Parameter Store (SecureString). It should detail the use of IAM roles and policies for granular access control, particularly for CI/CD pipelines and applications, leveraging least privilege. Key aspects include automated secret rotation, encryption at rest and in transit, and integration with CI/CD tools to inject secrets securely at runtime, avoiding their presence in build artifacts or logs. Furthermore, it should cover secure configuration management practices, ensuring secrets are externalized and not part of application code deployments.

9. Q9

   How would you prevent authorization bypass in an endpoint that acts on behalf of both users and services? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

   AdvancedAWS IAM & Cloud SecurityApplication SecurityAmazon-specific

   Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

   How to answer: A strong answer would emphasize a multi-layered approach, starting with robust authentication (IAM roles for services, Cognito/SSO for users) and fine-grained authorization policies (ABAC/RBAC). It would detail how to differentiate between user and service principals within the endpoint, ensuring distinct authorization paths. Key elements include context-aware authorization checks based on principal type, resource ownership, and requested action, leveraging AWS services like IAM Policy Conditions and AWS WAF. Finally, it would touch upon secure coding practices, regular security audits, and least privilege principles for both user and service identities.

10. Q10

    A bug bounty report claims IDOR in a multi-tenant object API. Walk through reproduction, impact analysis, and mitigation. Frame your answer as you would in the Amazon Loop interview

    SeniorAWS IAM & Cloud SecurityApplication SecurityAmazon-specific

    Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

    How to answer: The candidate should first describe reproducing the IDOR by identifying a multi-tenant resource, obtaining its ID, and attempting to access it with a different user's session. Impact analysis involves assessing data confidentiality, integrity, and availability, considering the type of data exposed and potential for unauthorized modification or deletion. Mitigation strategies should focus on robust authorization checks at the API gateway or application layer, ensuring every request for a resource validates the requesting user's ownership or explicit permissions for that specific resource ID. Additional layers like attribute-based access control (ABAC) or tenant-scoped IDs can further enhance security.

11. Q11

    For the Amazon Threat Modeling, AppSec & Secure Code Review round, how would you design secure file upload handling, including content validation, malware scanning, storage, and retrieval?

    IntermediateThreat Modeling, AppSec & Secure Code ReviewApplication SecurityAmazon-specific

    Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

    How to answer: A strong design for secure file upload handling would involve initial client-side validation for basic checks, followed by robust server-side validation including file type (magic bytes), size, and content sanity checks. Integrate with a malware scanning service (e.g., ClamAV, or AWS GuardDuty for S3) before storing files in an immutable, versioned object storage like S3 with restricted access policies (least privilege). For retrieval, implement signed URLs with short expiry times and enforce strict authorization checks, potentially serving content through a CDN with WAF protection.

12. Q12

    What application logs are useful for detecting abuse without leaking sensitive data or credentials? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

    AdvancedThreat Modeling, AppSec & Secure Code ReviewApplication SecurityAmazon-specific

    Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

    How to answer: A strong answer will focus on logs that provide behavioral insights without containing PII or credentials. Key logs include AWS WAF logs for web traffic patterns, CloudFront access logs for CDN usage and geographic anomalies, and ELB/ALB access logs for load balancer requests, status codes, and source IPs. Application-specific custom logs should capture user actions, API calls, and transaction IDs, ensuring sensitive data is scrubbed or tokenized. CloudTrail logs are crucial for detecting unauthorized API calls and configuration changes, indicating potential abuse of AWS resources.

13. Q13

    Explain how you would embed SAST, DAST, dependency scanning, and manual review into a developer workflow without causing alert fatigue. Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

    AdvancedThreat Modeling, AppSec & Secure Code ReviewApplication SecurityAmazon-specific

    Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

    How to answer: A strong answer would propose a multi-stage, automated security pipeline integrated into CI/CD, leveraging AWS services for scale and event-driven processing. It would emphasize shifting left with SAST and dependency scanning at code commit/PR, followed by DAST in pre-production environments. Key to avoiding fatigue is intelligent alert prioritization, de-duplication, and context-aware routing to development teams, coupled with a feedback loop for false positive reduction and developer education. Manual review should be reserved for high-risk changes or critical findings, triggered by automation thresholds.

14. Q14

    A team wants to ship a feature behind a flag before completing all security work. How would you evaluate the risk and guardrails? Assume the environment is Amazon's AWS, retail, logistics, Prime, devices, and large-scale distributed services

    SeniorThreat Modeling, AppSec & Secure Code ReviewApplication SecurityAmazon-specific

    Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

    How to answer: A strong candidate would first emphasize that shipping features with incomplete security work is generally discouraged and requires a strong justification. They would then outline a risk assessment process, considering the feature's blast radius, data sensitivity, and potential impact. Key guardrails would include robust feature flag management (e.g., granular access, auditability, kill switch), temporary compensating controls (e.g., WAF rules, enhanced monitoring), and a clear, time-bound plan for completing the remaining security work. Finally, they would discuss the importance of executive approval and a 'security debt' tracking mechanism.

15. Q15

    How would you assess memory-safety risk in a service that uses native extensions or performance-critical code? Frame your answer as you would in the Amazon Loop interview

    SeniorThreat Modeling, AppSec & Secure Code ReviewApplication SecurityAmazon-specific

    Context: AWS, retail, logistics, Prime, devices, and large-scale distributed services

    How to answer: To assess memory-safety risk in services with native extensions, I would start by identifying the specific native components and their programming languages (e.g., C/C++, Rust). I'd then analyze the build process for compiler flags (e.g., ASan, UBSan) and review dependency trees for known vulnerabilities in native libraries. Static analysis tools (e.g., Coverity, Clang Static Analyzer) and dynamic analysis/fuzzing (e.g., AFL++, libFuzzer) would be employed to detect common memory errors like buffer overflows, use-after-free, and integer overflows. Finally, I'd evaluate the service's isolation mechanisms (e.g., sandboxing, privilege separation) and incident response history related to memory corruption.

Practice these with instant AI feedback in a live mock interview → Start a Amazon Security Engineer mock

Prepare 8-12 STAR stories mapped to Leadership Principles; expect a Bar Raiser; quantify impact

Other roles at Amazon

Security Engineer interviews at other companies