Cloud Engineer interview question · Most asked
How do you eliminate long-lived credentials in a cloud environment?
Summary
People sign in through SSO with MFA (IAM Identity Center, Entra ID, Cloud Identity) and get temporary credentials; CI/CD uses OIDC federation to roles; workloads use roles, managed identities or attached service accounts. Then remove IAM users and keys, and block their creation with guardrails.
Longer Answer
Google Cloud has an organisation policy to disable service-account key creation; AWS SCPs can deny iam:CreateUser/iam:CreateAccessKey except for break-glass. Keep a monitored break-glass path.
Key Points
- SSO + MFA for people.
- OIDC for CI/CD.
- Roles / managed identities for workloads.
- Block key creation with guardrails.
Deep dive: Cloud Engineering in Production: The Key on GitHub
Explanation
What interviewers look for
Covers people, pipelines and workloads, plus prevention.
More most-asked Cloud Engineer questions
- What do Multi-AZ deployments and read replicas give you for managed databases?
- How is an AWS IAM request evaluated when several policies apply?
- What are regions and availability zones, and how do you use them for resilience?
- How do you keep object storage buckets from being exposed publicly?
- How do you approach cloud cost optimisation?
- Explain RTO and RPO and the four disaster recovery strategies.
- How would you design a multi-account (landing zone) structure?
- What security services and settings belong in every cloud account from day one?