AWS, Azure & GCP · Cloud across providers
What cloud best practices should every team follow?
Short answer
Use infrastructure as code, least privilege, multiple AZs, encryption, centralised logging, tagging and automated backups. Review cost and reliability regularly, and keep environments reproducible.
Best practices are the defaults you want before a team ships. They reduce the chance that a routine change becomes an incident and make the estate understandable to people who did not build it.
The baseline
- Identity: federation, MFA, least privilege and short-lived credentials
- Network: private by default, segmented subnets and restricted egress
- Data: encryption at rest and in transit, key management and tested backups
- Reliability: multi-AZ production, health checks and a rollback path
- Operations: centralised logs, metrics, traces, alerts and runbooks
- Delivery: infrastructure as code, reviewed changes and automated pipelines
- Cost: tagging, budgets and a named owner for each service
Start with a landing zone
A landing zone sets up accounts or subscriptions, identity, networking, logging, guardrails and cost controls before workloads arrive. It gives every team the same secure starting point and avoids rebuilding the same baseline in each project.
Keep the baseline small enough to follow. A long list of controls that nobody enforces is worse than a short list that is automated. Add practices as the team and the workload mature.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What belongs in a landing zone?
- 2How do you keep best practices from slowing delivery?
- 3Which controls would you automate first?
- 4How should practices differ between prototypes and production?
Say it in the interview
The baseline I want on every team is least privilege, private networking, encryption, multi-AZ production, centralised observability, infrastructure as code, tagging and tested backups. I put the shared parts in a landing zone so teams start from a secure, reproducible account instead of rebuilding it each time. I keep the list short and automated, and I scale controls with the criticality of the workload.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live AWS, Azure & GCP mock interview and get scored feedback on depth, clarity and confidence.