Cloud Engineer interview question · Most asked
How would you design a multi-account (landing zone) structure?
Summary
Use AWS Organizations (Control Tower) with OUs for security (log archive, audit), infrastructure (network, shared services), production and non-production workloads, and sandboxes; one account per environment per workload or team; SSO with permission sets; SCP guardrails; central logging and security tooling with delegated administrators; account vending through code. Azure: management groups and subscriptions; Google Cloud: folders and projects.
Longer Answer
Accounts give the strongest blast-radius and billing boundaries. Keep the management account empty of workloads.
Key Points
- OUs by function and environment.
- Central security and log accounts.
- SSO and guardrails.
- Account vending as code.
Deep dive: Cloud Engineering in Production: A Landing Zone for a Regulated Start-up
Explanation
What interviewers look for
Isolation, central governance, self-service.
More most-asked Cloud Engineer questions
- What do Multi-AZ deployments and read replicas give you for managed databases?
- Explain RTO and RPO and the four disaster recovery strategies.
- What are regions and availability zones, and how do you use them for resilience?
- How do you eliminate long-lived credentials in a cloud environment?
- How do you keep object storage buckets from being exposed publicly?
- How do you approach cloud cost optimisation?
- How is an AWS IAM request evaluated when several policies apply?
- What security services and settings belong in every cloud account from day one?