Python for Cloud Computing Interview Questions and Answers With Code

Key takeaways

• Know one provider SDK well. For AWS that is boto3: clients versus resources, sessions, pagination and waiters.
• Credentials are a favourite topic. The right answer is IAM roles or short-lived credentials, never keys in code.
• Handle errors explicitly (ClientError), use retries with backoff and keep scripts idempotent.
• Use Python for glue and automation. Declarative tools such as Terraform are usually better for creating infrastructure.
• Be ready to read and fix a short script during the interview.

Which Python libraries are used for cloud work?

For AWS, boto3 (the SDK) and botocore (its core). For Azure, the Azure SDK for Python and the azure-identity package. For Google Cloud, the client libraries such as google-cloud-storage. For SSH-based tasks, Paramiko. For infrastructure as code, Pulumi supports Python, and the AWS CDK can be written in Python. See the AWS documentation, Microsoft Learn and Google Cloud documentation.

What is boto3 and how does it work?

boto3 is the AWS SDK for Python. It turns AWS API calls into Python calls. A client is a low-level interface that maps one to one to API operations and returns dictionaries. A resource is a higher-level, object-oriented interface that exists for some services. Many teams now prefer clients for consistency.

import boto3
s3 = boto3.client("s3")
resp = s3.list_buckets()
for b in resp["Buckets"]:
 print(b["Name"])

How do you handle credentials safely?

Never hard-code access keys or commit them to Git. boto3 looks for credentials in a chain: parameters, environment variables, the shared credentials file, then roles. On EC2, ECS or Lambda it uses the attached IAM role, which gives short-lived credentials automatically. Locally, use named profiles or AWS IAM Identity Center sign-in. Store application secrets in AWS Secrets Manager or Parameter Store and grant least privilege. If a key leaks, deactivate and rotate it at once.

How do you handle pagination?

Many list calls return partial results. Use a paginator rather than assuming one call returns everything.

paginator = s3.get_paginator("list_objects_v2")
for page in paginator.paginate(Bucket="my-bucket"):
 for obj in page.get("Contents", []):
 print(obj["Key"])

How do you handle errors?

from botocore.exceptions import ClientError
try:
 s3.head_object(Bucket="my-bucket", Key="a.txt")
except ClientError as e:
 code = e.response["Error"]["Code"]
 if code == "404":
 print("not found")
 else:
 raise

Catch specific errors, log the request ID, re-raise what you cannot handle and never use a bare except.

What are retries and waiters?

boto3 retries throttled or transient errors by default, and you can configure the mode and attempts with botocore.config.Config. Waiters poll until a state is reached, for example ec2.get_waiter("instance_running").wait(InstanceIds=[id]). Both save you from writing sleep loops.

What does a Lambda function in Python look like?

import json
def lambda_handler(event, context):
 name = event.get("name", "world")
 return {"statusCode": 200, "body": json.dumps({"hello": name})}

Know the handler signature, that the execution role controls permissions, that environment variables hold configuration, and that cold starts, timeouts and memory settings affect behaviour. Reuse clients by creating them outside the handler.

How do you start and stop EC2 instances with Python?

ec2 = boto3.client("ec2")
ec2.stop_instances(InstanceIds=["i-0123456789abcdef0"])

Better answer: filter by tag so a schedule stops only non-production instances, and log what you stopped. Add a dry-run mode.

How do you authenticate with Azure and Google Cloud?

Azure: DefaultAzureCredential from azure-identity tries environment variables, managed identity and developer sign-in in order, so the same code works locally and in Azure. Google Cloud: Application Default Credentials use a service account attached to the resource or gcloud auth application-default login locally. The principle is the same on every cloud: prefer attached identities over key files.

How do you make scripts idempotent?

Check state before changing it, or use calls that are safe to repeat. Create a bucket only if it does not exist; tag resources rather than recreating them; return clean results on repeat runs. Idempotent scripts are safe to rerun after a failure.

How do you test cloud code without touching real resources?

Use unit tests with mocked clients, such as the moto library for AWS or unittest.mock, and keep a small number of integration tests in a sandbox account. Separate pure logic from SDK calls so most code needs no mocking.

When should you use Python and when Terraform?

Terraform (or CloudFormation, Bicep) describes desired infrastructure and tracks state. Python is better for logic, glue, reports, remediation and event-driven functions. A reasonable answer: Terraform for creating the environment, Python for operating on it.

Other questions to practise

• How do you manage dependencies and virtual environments for a deployable function (venv, requirements, Lambda layers)?
• How do you log structured output and where does it go (CloudWatch Logs, Azure Monitor)?
• How would you find unencrypted S3 buckets or untagged resources and report them?
• How do you upload a large file reliably (multipart, upload_file managed transfer)?
• How do you use async or threads to call many APIs, and what are the rate limits?

Security points interviewers like

• Least privilege IAM policies for the script's role.
• No secrets in code, logs or environment dumps.
• Input validation on events that trigger your functions.
• Pinned dependencies and regular updates.

Next steps

Practise with a real account in a free tier or sandbox. WebAsha offers Python programming training and AWS training. For related prep, see serverless computing interview questions.

Related reading

• How to Automate Cloud Networking Using Terraform, Ansible, and Python | DevNetOps Guide 2026
• Securing the Future: Runtime Protection for Serverless Applications in 2026