Design a cloud VM service like Amazon EC2

How the interviewer opens it

“Design a control plane that creates, stops, and terminates virtual machines across availability zones. The service must recover from partial failures without resource leaks.”

The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.

What to clarify first

• Scale and request mix
• Latency
• VM lifecycle
• Placement and capacity
• Tenant quotas
• Correctness and retention
• Infrastructure command contract
• Infrastructure discovery and health
• Recovery deadline and capacity
• Scope boundaries

The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.

Scope of a strong answer

What interviewers ask about

Operation completion

Acceptance precedes physical completion. A client retry or controller failure must not lose the request or create another VM.

Zone and host capacity

Host reports become stale while concurrent requests consume capacity. Tenant quotas and physical capacity need separate guarantees.

Overlapping infrastructure commands

Old commands can finish after newer requests. Database order alone cannot prevent an old command from recreating a resource.

Recovery after controller failures

Unknown outcomes can leave resources behind. A fixed cleanup deadline requires bounded work, complete resource discovery, and reserved recovery capacity.

Common mistakes

• The API treats VM creation as one synchronous call.
• The queue is the only record of an accepted request.
• The service releases capacity after a timeout without proof that compute is absent.
• The design assumes a worker lease blocks stale infrastructure commands.
• The design promises ten-minute cleanup without limits on backlog, retry delay, and recovery throughput.
• The service places a VM on another host while its original host may still run it.

The bar by level

Senior (L5/E5)

Handles overlapping requests and unknown outcomes with durable resource intents and receiver generations. Separates quotas from host capacity. Produces a bounded cleanup plan with explicit throughput and retry delays.

Staff (L6+/E6+)

Defines invariants across database failover, stale workers, and host partitions. Closes the resource set before terminal commands. Proves the recovery deadline from admission limits, audit rates, stage capacity, and retry schedules. Identifies which guarantees depend on infrastructure contracts.