AWS Certified Cloud Practitioner (CLF-C02) · glossary

AWS Cloud Practitioner glossary

#ABCDEFGHIKLMNOPQRSTUVWZAcronyms

#

7 Rs

AWS's seven migration strategies: retire, retain, rehost, relocate, repurchase, replatform and refactor. Lesson: Seven ways to handle each app

A

Accelerated computing

EC2 instance family with GPUs or other hardware accelerators, for machine learning, graphics and similar heavy math. Lesson: Instance families: pick the shape

Access key ID

The public half of an access key pair; it identifies which key is making a programmatic request. Lesson: Access keys

Access keys

Long-term credentials (key ID plus secret key) that let programs call AWS through the CLI, SDKs or APIs. Lesson: Access keys

Action

The part of a policy statement naming which API operations are allowed or denied, such as s3:GetObject. Lesson: Reading a policy

Agility

The ability to try ideas quickly and cheaply, spinning resources up and down in minutes with nothing bought up front. Lesson: Scalability, elasticity and agility

Alarms

CloudWatch rules that notify or take action when a metric crosses a threshold you set. Lesson: Amazon CloudWatch: how is it doing

Amazon API Gateway

A managed service to create, publish, secure and monitor APIs, often as the front door for Lambda functions. Lesson: More front doors: CloudFront, Global Accelerator, API Gateway

Amazon AppStream 2.0

Streams individual desktop applications from AWS to a web browser; now also called Amazon WorkSpaces Applications. Lesson: End-user computing, frontends and IoT

Amazon Athena

A serverless service that runs standard SQL queries directly on data stored in Amazon S3, billed per query. Lesson: Collect, prepare, query

Amazon Aurora

AWS's cloud-built relational database, compatible with MySQL and PostgreSQL, storing six copies of data across three AZs. Lesson: Relational: Amazon RDS and Amazon Aurora

Amazon CloudFront

AWS's content delivery network: caches content at edge locations so users get it with low latency. Lesson: Why edge locations help

Amazon CloudWatch

Monitoring service for metrics, logs and alarms that shows how resources and applications are performing. Lesson: Amazon CloudWatch: how is it doing

Amazon Cognito

Adds user sign-up, sign-in and access control to web and mobile apps for an app's customers. Lesson: Cross-account roles and customer logins

Amazon Comprehend

A natural language processing service that finds sentiment, key phrases, entities and topics in text. Lesson: Ready-made AI services

Amazon Connect

A cloud contact center service for phone and chat customer service, paid for as you use it. Lesson: Business applications: Amazon SES and Amazon Connect

Amazon Detective

Helps investigate security findings by linking log data into visual timelines to find the root cause. Lesson: Inspector, Macie and Detective

Amazon DocumentDB

A managed document database for JSON data, compatible with MongoDB applications. Lesson: The whole picker

Amazon DynamoDB

A serverless NoSQL key-value and document database with millisecond performance at any scale. Lesson: NoSQL: Amazon DynamoDB

Amazon EBS

Amazon Elastic Block Store: persistent block storage volumes for EC2 instances in one Availability Zone. Lesson: Block storage: Amazon EBS and instance store

Amazon EC2

Amazon Elastic Compute Cloud: resizable virtual servers (instances) in the cloud, where you manage the operating system up. Lesson: Amazon EC2: you manage the most

Amazon EC2 Auto Scaling

Automatically adds or removes EC2 instances to match demand and replaces unhealthy ones. Lesson: Auto scaling = elasticity

Amazon ECR

Amazon Elastic Container Registry: a managed registry for storing and sharing container images. Lesson: Containers: ECS, EKS and ECR

Amazon ECS

Amazon Elastic Container Service: AWS's own fully managed container orchestration service. Lesson: Containers: ECS, EKS and ECR

Amazon EFS

Amazon Elastic File System: a serverless, elastic shared file system for Linux using NFS, usable across AZs. Lesson: File storage: Amazon EFS and Amazon FSx

Amazon EKS

Amazon Elastic Kubernetes Service: runs Kubernetes, the open-source container orchestrator, as a managed service. Lesson: Containers: ECS, EKS and ECR

Amazon ElastiCache

A managed in-memory data store and cache (Valkey, Memcached, Redis OSS) for very fast reads. Lesson: Memory-based: Amazon ElastiCache

Amazon EMR

A managed platform for big data frameworks such as Apache Spark and Hadoop. Lesson: Collect, prepare, query

Amazon EventBridge

A serverless event bus that routes events from AWS services, apps and SaaS tools to targets by rules or schedules. Lesson: Messages, queues and events

Amazon FSx

Managed file systems built on popular platforms, such as Windows File Server, NetApp ONTAP and OpenZFS. Lesson: File storage: Amazon EFS and Amazon FSx

Amazon GuardDuty

Intelligent threat detection that analyzes logs and activity with machine learning and threat intelligence. Lesson: Amazon GuardDuty: sniff out threats

Amazon Inspector

Automatically scans EC2 instances, container images and Lambda functions for vulnerabilities and network exposure. Lesson: Inspector, Macie and Detective

Amazon Kinesis

Services for collecting, processing and analyzing streaming data in real time. Lesson: Collect, prepare, query

Amazon Lex

Builds conversational chatbots that understand voice and text. Lesson: Ready-made AI services

Amazon Lightsail

Simple virtual servers, storage and networking bundled at a predictable monthly price. Lesson: Shortcuts: Lightsail, Elastic Beanstalk, Batch

Amazon Machine Image (AMI)

A template with the operating system and software used to launch an EC2 instance. Lesson: Virtual servers you control

Amazon Macie

Uses machine learning to discover sensitive data, such as personal information, in Amazon S3. Lesson: Inspector, Macie and Detective

Amazon Neptune

A managed graph database for highly connected data, such as recommendations and social links. Lesson: The whole picker

Amazon OpenSearch Service

A managed service for search, log analytics and real-time application monitoring. Lesson: Store, search, show

Amazon Polly

Turns text into lifelike speech. Lesson: Ready-made AI services

Amazon Q

AWS's generative AI assistant that answers questions from business data and helps developers build on AWS. Lesson: Amazon SageMaker AI and Amazon Q

Amazon Quick Sight

AWS's business intelligence service for interactive dashboards and reports. Lesson: Store, search, show

Amazon RDS

Amazon Relational Database Service: managed relational databases such as MySQL, PostgreSQL, Oracle and SQL Server. Lesson: Picking the right R

Amazon Redshift

AWS's data warehouse for fast SQL analytics over large amounts of historical data. Lesson: The whole picker

Amazon Rekognition

Analyzes images and video to detect objects, faces, text and unsafe content. Lesson: Ready-made AI services

Amazon Route 53

AWS's highly available DNS service, with domain registration, health checks and routing policies. Lesson: Amazon Route 53

Amazon S3

Amazon Simple Storage Service: object storage in buckets with very high durability and practically unlimited space. Lesson: Object storage: Amazon S3

Amazon SageMaker AI

The AWS service for building, training and deploying your own machine learning models. Lesson: Amazon SageMaker AI and Amazon Q

Amazon SES

Amazon Simple Email Service: sends and receives email at scale, such as receipts and newsletters. Lesson: Business applications: Amazon SES and Amazon Connect

Amazon SNS

Amazon Simple Notification Service: publishes a message to a topic and pushes it to every subscriber. Lesson: Messages, queues and events

Amazon SQS

Amazon Simple Queue Service: a managed message queue that holds messages until a worker processes them. Lesson: Messages, queues and events

Amazon Textract

Extracts printed and handwritten text, forms and tables from scanned documents. Lesson: Ready-made AI services

Amazon Transcribe

Converts speech in audio or video into text. Lesson: Ready-made AI services

Amazon Translate

Translates text between languages. Lesson: Ready-made AI services

Amazon VPC

Amazon Virtual Private Cloud: your own logically isolated network inside an AWS Region. Lesson: Your own private network: VPC and subnets

Amazon Web Services (AWS)

Amazon's cloud platform, offering on-demand compute, storage, databases and many other services over the internet. Lesson: Renting the kennel instead of building one

Amazon WorkSpaces

Managed virtual desktops (Windows or Linux) that users reach from their own devices. Lesson: End-user computing, frontends and IoT

Amazon WorkSpaces Secure Browser

Gives users safe browser access to internal websites and SaaS apps without leaving data on their device. Lesson: End-user computing, frontends and IoT

API

Application programming interface: a defined way for programs to talk to a service. Every AWS action is an API call. Lesson: Console, CLI, SDKs and APIs

Application Load Balancer

A load balancer for web (HTTP/HTTPS) traffic that can route requests by URL path or host. Lesson: Load balancers spread the work

Artifact Agreements

The part of AWS Artifact where you review and accept agreements with AWS, such as the Business Associate Addendum (BAA). Lesson: AWS Artifact: the paperwork drawer

Artifact Reports

The part of AWS Artifact with on-demand downloads of AWS audit and compliance reports. Lesson: AWS Artifact: the paperwork drawer

Artificial intelligence (AI)

Software that performs tasks that usually need human thinking, such as understanding speech or recognizing images. Lesson: AI, ML and three layers of help

Automation

Letting scripts, templates and services do repeatable work instead of people, for fewer errors and lower cost. Lesson: Automation is a cost saver

Availability Zones (AZs)

One or more separate data centers in a Region with independent power and networking, linked by fast private links. Lesson: Availability Zones

Awareness and training

A shared control: AWS trains its own staff, and each customer trains its own staff. Lesson: Some controls belong to both

AWS Amplify

Tools and hosting to build, deploy and host full-stack web and mobile app frontends. Lesson: End-user computing, frontends and IoT

AWS Application Discovery Service

Collects data about on-premises servers, their use and dependencies to plan a migration. Lesson: Resources for the migration journey

AWS Application Migration Service

Rehosts (lifts and shifts) servers into AWS with little downtime. Lesson: Resources for the migration journey

AWS Artifact

Self-service portal for AWS compliance reports and agreements. Lesson: AWS Artifact: the paperwork drawer

AWS Auto Scaling

Scales multiple resource types, such as EC2 groups, ECS services and DynamoDB tables, to match demand. Lesson: Auto scaling = elasticity

AWS Backup

Centrally manages and automates backups across many AWS services with backup plans. Lesson: AWS Backup: one place for every backup

AWS Batch

Runs large numbers of batch computing jobs, choosing and scaling the compute for you. Lesson: Shortcuts: Lightsail, Elastic Beanstalk, Batch

AWS Billing and Cost Management

The console area for bills, payments, budgets, cost reports and billing preferences. Lesson: The Cost and Usage Report and billing support

AWS blogs

AWS's official blogs announcing new features and walking through real examples. Lesson: Documentation, whitepapers and blogs

AWS Budgets

Sets cost or usage limits and alerts you when actual or forecasted amounts cross them. Lesson: Before, during, after

AWS Business Support+

AWS's recommended minimum Support plan for production: 24/7 engineer access and all Trusted Advisor checks. Lesson: Four plans, one ladder

AWS Certificate Manager (ACM)

Provides, manages and renews TLS certificates for encrypting data in transit. Lesson: Who holds the keys

AWS CLI

AWS Command Line Interface: a tool to manage AWS services with typed commands and scripts. Lesson: Console, CLI, SDKs and APIs

AWS Client VPN

A managed VPN that lets individual users connect securely to AWS and on-premises networks. Lesson: VPN or Direct Connect?

AWS Cloud Adoption Framework (AWS CAF)

AWS guidance for planning a cloud move, organized into six perspectives with four business outcomes. Lesson: A plan for the whole company, not just IT

AWS CloudFormation

Infrastructure as code service that builds and updates resources from templates, the same way every time. Lesson: Infrastructure as code

AWS CloudHSM

Dedicated, single-tenant hardware security modules in AWS for keys that you fully control. Lesson: Who holds the keys

AWS CloudTrail

Records API calls and account activity: who did what, when and from where. Lesson: AWS CloudTrail: who did what

AWS CodeBuild

A managed build service that compiles code, runs tests and produces deployable packages. Lesson: Developer tools: CodeBuild, CodePipeline, X-Ray

AWS CodePipeline

Automates release pipelines (source, build, test, deploy) for continuous delivery. Lesson: Developer tools: CodeBuild, CodePipeline, X-Ray

AWS Compute Optimizer

Analyzes usage and recommends better-sized or better-fitting compute resources. Lesson: Rightsizing compute

AWS Config

Records resource configurations over time and checks them against rules for compliance. Lesson: AWS Config: what did it look like

AWS Control Tower

Sets up and governs a multi-account AWS environment (a landing zone) on AWS Organizations, with guardrails (controls) and central logging. Lesson: Guardrails for every account: SCPs and Control Tower

AWS Cost and Usage Report (CUR)

The most detailed AWS billing data, line items by hour or day, delivered to an S3 bucket. Lesson: The Cost and Usage Report and billing support

AWS Cost Explorer

Charts and filters past AWS costs and usage and forecasts future spending. Lesson: Before, during, after

AWS Direct Connect

A dedicated private network connection from your premises to AWS with consistent performance. Lesson: VPN or Direct Connect?

AWS Directory Service

Managed Microsoft Active Directory and directory options in AWS. Lesson: Federated identity

AWS DMS

AWS Database Migration Service: moves databases to AWS with continuous replication while the source keeps running. Lesson: Database replication keeps the shop open

AWS documentation

Official user guides, references and tutorials for every AWS service at docs.aws.amazon.com. Lesson: Documentation, whitepapers and blogs

AWS Elastic Beanstalk

Upload app code and AWS provisions servers, load balancing, scaling and monitoring, while you keep access. Lesson: Tools for operating what you built

AWS Elastic Disaster Recovery

Replicates servers to AWS so they can be recovered quickly after a disaster. Lesson: When to use multiple Regions

AWS Enterprise Support

Support plan for business-critical workloads, adding a designated TAM and Well-Architected reviews. Lesson: Four plans, one ladder

AWS Fargate

Serverless compute for containers: run ECS or EKS tasks without managing servers. Lesson: Serverless: Fargate and Lambda

AWS Firewall Manager

Centrally applies firewall rules, such as AWS WAF and security group policies, across accounts in an organization. Lesson: AWS Firewall Manager: one rulebook for every account

AWS Global Accelerator

Gives static IP addresses and routes users over the AWS global network to the best healthy endpoint. Lesson: More front doors: CloudFront, Global Accelerator, API Gateway

AWS Glue

Serverless data integration: discovers, prepares and catalogs data with ETL jobs. Lesson: Collect, prepare, query

AWS Health API

Programmatic access to AWS Health events about your resources; requires a paid Support plan. Lesson: Trusted Advisor, Health Dashboard and Health API

AWS Health Dashboard

Shows the status of AWS services and events, such as maintenance, affecting your own resources. Lesson: Trusted Advisor, Health Dashboard and Health API

AWS IAM Identity Center

The recommended single sign-on for workforce access to multiple AWS accounts and apps. Lesson: AWS IAM Identity Center

AWS IoT Core

Securely connects IoT devices to the cloud and routes their messages. Lesson: End-user computing, frontends and IoT

AWS KMS

AWS Key Management Service: creates and controls encryption keys used across AWS services. Lesson: Who holds the keys

AWS Knowledge Center

AWS articles answering the questions customers most often ask AWS Support. Lesson: Where AWS security information lives

AWS Lambda

Serverless functions that run code in response to events, billed by requests and run time. Lesson: AWS Lambda: you bring code and data

AWS License Manager

Tracks and manages software licenses, including BYOL, across AWS and on premises. Lesson: Licenses: bring your own, or included

AWS Local Zones

AWS infrastructure placed near large cities to run selected services with very low latency. Lesson: Edge locations, Local Zones and Outposts

AWS managed database

A database service where AWS handles hardware, patching, backups and availability, such as RDS or DynamoDB. Lesson: Run it yourself, or let AWS run it?

AWS managed policies

Ready-made IAM policies that AWS writes and updates for common jobs. Lesson: Managed, custom and inline policies

AWS Management Console

The web-based interface for using and managing AWS services. Lesson: Console, CLI, SDKs and APIs

AWS Marketplace

A catalog of third-party software, data and services that run on AWS, billed through your AWS account. Lesson: Third-party tools from AWS Marketplace

AWS Migration Hub

One place to track migration progress; closed to new customers, succeeded by AWS Transform. Lesson: Resources for the migration journey

AWS Organizations

Manages many AWS accounts centrally, with consolidated billing and service control policies. Lesson: AWS Firewall Manager: one rulebook for every account

AWS Outposts

AWS-built hardware installed in your own building to run AWS services on premises. Lesson: Edge locations, Local Zones and Outposts

AWS Partner Network (APN)

The global community of companies, such as ISVs and system integrators, that build on and with AWS. Lesson: The AWS Partner Network

AWS Prescriptive Guidance

AWS-tested strategies, guides and patterns for migrating and modernizing workloads. Lesson: Resources for the migration journey

AWS Pricing Calculator

A free tool to estimate the cost of an AWS design before you build it. Lesson: Before, during, after

AWS PrivateLink

Private connectivity from a VPC to AWS or partner services without using the public internet. Lesson: Peering, Transit Gateway and endpoints

AWS Professional Services

AWS's own team of experts who work with customers on large projects such as migrations. Lesson: Experts from AWS

AWS re:Post

AWS's community question-and-answer site, answered by AWS experts and other customers. Lesson: Prescriptive Guidance, Knowledge Center and re:Post

AWS Region

A separate geographic area of AWS infrastructure containing multiple Availability Zones. Lesson: Regions

AWS SCT

AWS Schema Conversion Tool: converts a database's schema and code from one engine to another. Lesson: AWS DMS and AWS SCT

AWS SDKs

Software development kits that let applications call AWS services in languages like Python, Java or JavaScript. Lesson: Console, CLI, SDKs and APIs

AWS Secrets Manager

Stores secrets encrypted and can rotate them automatically, such as database passwords. Lesson: Storing secrets: Secrets Manager vs Parameter Store

AWS Security Blog

AWS's blog with posts on security features, best practices and how-tos. Lesson: Where AWS security information lives

AWS Security Center

AWS's security and compliance hub on its website, with best practices and security bulletins. Lesson: Where AWS security information lives

AWS Security Hub

Collects security findings from AWS and partner tools in one place and checks against best-practice standards. Lesson: AWS Security Hub: one dashboard

AWS Service Catalog

Lets teams launch approved, preconfigured products from a central catalog. Lesson: Tools for operating what you built

AWS Services in Scope

AWS's published list of which services each compliance program covers. Lesson: Requirements vary by place, industry and service

AWS shared responsibility model

How security work divides: AWS secures the cloud itself; customers secure what they put in and configure. Lesson: Security OF the cloud vs security IN the cloud

AWS Shield

Managed protection against distributed denial of service (DDoS) attacks. Lesson: AWS Shield: stop the flood

AWS Site-to-Site VPN

Encrypted tunnels over the internet between your network and your VPC. Lesson: VPN or Direct Connect?

AWS solutions architects

AWS technical experts who help customers design solutions that follow best practices. Lesson: Experts from AWS

AWS Step Functions

Coordinates multiple services into visual, step-by-step workflows. Lesson: Messages, queues and events

AWS Storage Gateway

Hybrid storage that gives on-premises apps access to AWS storage with a fast local cache. Lesson: AWS Storage Gateway: a cache in the warehouse

AWS Support

AWS's customer enablement service, from free Basic Support to paid plans with engineers and TAMs. Lesson: Customer enablement: AWS Support

AWS Support Center

The console area for opening and tracking support cases with AWS. Lesson: AWS Support Center

AWS Support plans

The tiers of AWS help: Basic, Business Support+, Enterprise Support and Unified Operations. Lesson: Four plans, one ladder

AWS Systems Manager

Tools to view and manage servers at scale: patching, running commands, inventory and more. Lesson: Storing secrets: Secrets Manager vs Parameter Store

AWS Systems Manager Parameter Store

Stores configuration values and secrets as encrypted parameters, without built-in automatic rotation. Lesson: Storing secrets: Secrets Manager vs Parameter Store

AWS Transit Gateway

A central hub that connects many VPCs and on-premises networks. Lesson: Peering, Transit Gateway and endpoints

AWS Trust and Safety

The AWS team that handles reports of abuse coming from AWS resources, such as spam or attacks. Lesson: The AWS Trust and Safety team

AWS Trusted Advisor

Checks your account against best practices for cost, performance, security, fault tolerance and limits. Lesson: AWS Trusted Advisor

AWS Unified Operations

AWS's top Support plan for mission-critical workloads, adding 24/7 workload monitoring and incident engineers. Lesson: Four plans, one ladder

AWS WAF

A web application firewall that filters HTTP and HTTPS requests using rules you choose. Lesson: AWS WAF: filter the web requests

AWS Well-Architected Framework

AWS's best practices and design principles for cloud workloads, organized into six pillars. Lesson: Best practices, written down

AWS Well-Architected Tool

A free console tool to review a workload against the Well-Architected Framework and list risks. Lesson: Best practices, written down

AWS whitepapers

In-depth guides written by AWS and partners on architecture, security, cost and more. Lesson: Documentation, whitepapers and blogs

AWS X-Ray

Traces requests through an application's services to find slow or failing steps. Lesson: Developer tools: CodeBuild, CodePipeline, X-Ray

AWS-generated tags

Cost allocation tags that AWS creates, starting with aws:, such as aws:createdBy. Lesson: Cost allocation tags

B

Backup plan

An AWS Backup policy that sets when backups run and how long they are kept. Lesson: AWS Backup: one place for every backup

Basic Support

The free Support plan for every account: customer service, docs, re:Post, core Trusted Advisor checks. Lesson: Four plans, one ladder

Block storage

Storage that acts like a server's hard drive, split into blocks; EBS and instance store are examples. Lesson: Block storage: Amazon EBS and instance store

Bring Your Own License (BYOL)

Reusing software licenses you already own on AWS, where the license terms allow it. Lesson: Licenses: bring your own, or included

Buckets

Containers that hold objects in Amazon S3; each bucket name is globally unique. Lesson: Object storage: Amazon S3

Business continuity

Keeping the business running through a major disruption, often using resources in another Region. Lesson: When to use multiple Regions

Business intelligence (BI)

Tools that turn data into dashboards and reports for decision makers. Lesson: Store, search, show

Business perspective

AWS CAF perspective making sure cloud investments speed up business outcomes; owned by business leaders. Lesson: The business-side perspectives

C

Cache

A fast copy of frequently used data kept close to where it is needed. Lesson: AWS Storage Gateway: a cache in the warehouse

Cached file systems

Hybrid storage that keeps frequently used data in a local cache while the full data set lives in AWS. Lesson: AWS Storage Gateway: a cache in the warehouse

Capital expenditure (CapEx)

Money spent up front on assets such as servers and buildings. Lesson: Fixed costs vs variable costs

CI/CD

Continuous integration and continuous delivery: automatically building, testing and releasing code changes. Lesson: Developer tools: CodeBuild, CodePipeline, X-Ray

CIDR block

Classless Inter-Domain Routing notation for an IP address range, such as 10.0.0.0/16. Lesson: Your own private network: VPC and subnets

CLF-C02

The current exam code for AWS Certified Cloud Practitioner. Lesson: The exam at a glance

Cloud

Deployment model where all of an application's parts run in the cloud. Lesson: Cloud, hybrid, on-premises

Cloud computing

On-demand delivery of IT resources over the internet with pay-as-you-go pricing. Lesson: Renting the kennel instead of building one

CloudWatch Logs

Collects and stores log files from applications, systems and AWS services in one place. Lesson: Amazon CloudWatch: how is it doing

Compliance

Meeting the laws, regulations and standards that apply to a business. Lesson: Compliance in the cloud

Compute optimized

EC2 instance family with fast processors for compute-heavy work like batch processing and gaming servers. Lesson: Instance families: pick the shape

Condition

Optional part of a policy statement that limits when it applies, such as only from certain IP addresses. Lesson: Reading a policy

Config rules

AWS Config checks that flag resources not matching your desired settings. Lesson: AWS Config: what did it look like

Configuration management

A shared control: AWS configures its infrastructure; customers configure their OS, databases and apps. Lesson: Some controls belong to both

Consolidated billing

AWS Organizations feature giving one bill for all accounts, with combined usage for volume pricing. Lesson: Consolidated billing in AWS Organizations

Container

A package of an application and everything it needs, so it runs the same way anywhere. Lesson: Containers: ECS, EKS and ECR

Content delivery network (CDN)

A network of servers that cache content near users for faster delivery. Lesson: Why edge locations help

Convertible RIs

Reserved Instances with a smaller discount that can be exchanged for another family, OS or tenancy. Lesson: Reserved Instance flexibility

Cost allocation tags

Activated tags that let you group and track AWS costs by label in billing reports. Lesson: Cost allocation tags

Cost optimization

Well-Architected pillar about delivering business value at the lowest price point. Lesson: Cost optimization: value at the lowest price

Cross-account IAM role

A role that trusted users in another AWS account can assume for temporary access. Lesson: Cross-account roles and customer logins

Customer managed policies

IAM policies you write yourself and can attach to many users, groups or roles. Lesson: Managed, custom and inline policies

D

Data sovereignty

Rules that data must be stored and processed within a particular country or region. Lesson: Regions

Data transfer

Moving data into, out of or within AWS; inbound is generally free, outbound and cross-Region cost money. Lesson: Data in, data out

Data warehouse

A database built for analyzing large amounts of historical data, such as Amazon Redshift. Lesson: The whole picker

Database replication

Keeping a copy of a database continuously in sync with the original, used to migrate with minimal downtime. Lesson: Database replication keeps the shop open

DDoS

Distributed denial of service: flooding a target with traffic from many machines to knock it offline. Lesson: AWS Shield: stop the flood

Dedicated Hosts

Physical servers dedicated to you, with socket and core visibility for per-core licenses. Lesson: Dedicated Hosts, Dedicated Instances, Capacity Reservations

Dedicated Instances

EC2 instances on hardware dedicated to your account, without host-level control. Lesson: Dedicated Hosts, Dedicated Instances, Capacity Reservations

Defense in layers

Securing every layer, from the edge to the data, so one failed control isn't fatal. Lesson: Layers, not one tool

Deployment models

Ways to run IT: all in the cloud, hybrid (cloud plus on-premises), or on-premises. Lesson: Cloud, hybrid, on-premises

Disaster recovery

Plans and resources to restore systems after a major failure, often in another Region. Lesson: When to use multiple Regions

DNS

Domain Name System: translates names like shop.kibbleco.example into IP addresses. Lesson: Amazon Route 53

Domain registration

Buying and managing a domain name, such as kibbleco.example; Route 53 offers it. Lesson: Amazon Route 53

E

EC2-hosted database

A database you install and run yourself on EC2, managing patching, backups and failover. Lesson: Run it yourself, or let AWS run it?

Economies of scale

Lower cost per unit from buying at huge volume; AWS passes some savings to customers. Lesson: Economies of scale

Edge locations

AWS sites in many cities, outside Regions, that serve cached content and DNS answers near users. Lesson: Edge locations, Local Zones and Outposts

Effect

The part of a policy statement that says Allow or Deny. Lesson: Reading a policy

Elastic Load Balancing (ELB)

Spreads incoming traffic across healthy targets, often in multiple Availability Zones. Lesson: Load balancers spread the work

Elasticity

Capacity that grows and shrinks automatically with demand, in both directions. Lesson: Scalability, elasticity and agility

Encryption at rest

Encrypting stored data, such as disks, databases and S3 objects. Lesson: At rest and in transit

Encryption in transit

Encrypting data while it moves across a network, usually with TLS. Lesson: At rest and in transit

Entitlement

Tracking which software licenses you own and who may use them. Lesson: AWS Marketplace: buy, govern, track

Ephemeral ports

Temporary high-numbered ports (such as 1024-65535) that clients use to receive replies. Lesson: Network ACLs: a gate at each subnet

ESG

Environmental, social and governance: measures of a company's sustainability and responsibility. Lesson: The four business outcomes

Event history

CloudTrail's free view of the last 90 days of management events in an account. Lesson: AWS CloudTrail: who did what

Expiration

A lifecycle action that deletes objects after a set age. Lesson: Lifecycle policies do the moving

Extract, transform, load (ETL)

Pulling data from sources, cleaning and reshaping it, and loading it where it can be analyzed. Lesson: Collect, prepare, query

F

Federation

Letting users sign in with an existing identity provider instead of separate AWS users. Lesson: Federated identity

File storage

Shared folders that many servers can read and write at once, such as EFS or FSx. Lesson: File storage: Amazon EFS and Amazon FSx

Findings

Security issues or threats reported by services like GuardDuty, Inspector or Macie. Lesson: Amazon GuardDuty: sniff out threats

Fixed cost

A cost that stays the same no matter how much you use. Lesson: Fixed costs vs variable costs

G

Gateway Load Balancer

A load balancer for deploying and scaling third-party network appliances such as firewalls. Lesson: Load balancers spread the work

GDPR

General Data Protection Regulation: the European Union's law protecting personal data. Lesson: Requirements vary by place, industry and service

General purpose

EC2 instance family with balanced CPU, memory and networking for common workloads. Lesson: Instance families: pick the shape

Generative AI

AI that creates new content, such as text, answers, images or code. Lesson: Amazon SageMaker AI and Amazon Q

Global infrastructure

AWS's worldwide Regions, Availability Zones and edge locations. Lesson: Speed of deployment and global reach

Global reach

Serving users around the world by deploying in AWS locations near them. Lesson: Speed of deployment and global reach

Governance

How a company sets and enforces its rules for decisions, changes, access and logging. Lesson: Compliance in the cloud

Governance perspective

AWS CAF perspective that runs the cloud program and manages risk, cost and benefits. Lesson: The business-side perspectives

Graph database

A database for data defined by relationships, such as Amazon Neptune. Lesson: The whole picker

Guest operating system

The operating system running inside a virtual server, which the customer manages on EC2. Lesson: Amazon EC2: you manage the most

H

Hardware security module (HSM)

A tamper-resistant device that creates and protects encryption keys. Lesson: Who holds the keys

Health checks

Regular tests that a target or endpoint is working, so traffic goes only to healthy ones. Lesson: Load balancers spread the work

High availability

A system keeps working when a part fails, because it runs in more than one place. Lesson: High availability

HIPAA

US Health Insurance Portability and Accountability Act, which protects health information. Lesson: Requirements vary by place, industry and service

Hybrid

Deployment model mixing on-premises systems with cloud resources that work together. Lesson: Cloud, hybrid, on-premises

I

IAM

AWS Identity and Access Management: controls who can sign in and what they can do in an account. Lesson: Who's who in IAM

IAM Access Analyzer

Finds resources shared outside your account and unused access. Lesson: Access reports

IAM credential report

A list of every IAM user with the status of passwords, MFA and access keys. Lesson: Access reports

IAM group

A collection of IAM users that share the same permissions. Lesson: Who's who in IAM

IAM role

An identity with permissions but no long-term credentials; whoever assumes it gets temporary credentials. Lesson: Who's who in IAM

IAM user

An identity for one person or application with long-term credentials. Lesson: Who's who in IAM

Identity provider (IdP)

A service that manages user identities and vouches for them to other systems. Lesson: Federated identity

In-memory

Data kept in fast memory rather than on disk, for microsecond reads. Lesson: Memory-based: Amazon ElastiCache

Increased operational efficiency

AWS CAF outcome: lower costs, more automation and more productive staff. Lesson: The four business outcomes

Increased revenue

AWS CAF outcome: new products and customers, launched faster. Lesson: The four business outcomes

Independent software vendors (ISVs)

Companies that build and sell software, often running on AWS and sold in AWS Marketplace. Lesson: The AWS Partner Network

Infrastructure as a service (IaaS)

Cloud model renting basic computing, storage and networking, where you manage the OS and up. Lesson: Amazon EC2: you manage the most

Infrastructure as code (IaC)

Defining infrastructure in text templates so it can be built repeatably and reviewed. Lesson: Infrastructure as code

Inherited controls

Controls customers take over fully from AWS, such as physical and environmental protections. Lesson: Inherited controls

Inline policies

Policies embedded in a single IAM identity and deleted along with it. Lesson: Managed, custom and inline policies

Instance store

Temporary block storage on the EC2 host; data is lost when the instance stops or terminates. Lesson: Block storage: Amazon EBS and instance store

Instance types

EC2 combinations of CPU, memory, storage and networking, grouped into families. Lesson: Instance families: pick the shape

Instances

Virtual servers running in Amazon EC2. Lesson: Virtual servers you control

Internet gateway

Connects a VPC to the internet; subnets routing to it are public. Lesson: Route tables and gateways

K

Key-value

A data model storing items as a unique key paired with its value. Lesson: NoSQL: Amazon DynamoDB

Kubernetes

Popular open-source software for running and managing containers at scale. Lesson: Containers: ECS, EKS and ECR

L

Landing zone

A ready-made, well-architected multi-account AWS setup with baseline security, logging and guardrails, as set up by AWS Control Tower. Lesson: Guardrails for every account: SCPs and Control Tower

Last accessed information

IAM data showing which services an identity actually used, to trim unused permissions. Lesson: Access reports

Latency

The delay between a request and its response, often driven by distance. Lesson: Regions

License included

Software licenses built into the hourly price, with AWS handling them. Lesson: Licenses: bring your own, or included

Lifecycle policy

S3 rules that move objects to cheaper classes or delete them as they age. Lesson: Lifecycle policies do the moving

M

Machine learning (ML)

Building models that learn patterns from data instead of following hand-written rules. Lesson: AI, ML and three layers of help

Memory optimized

EC2 instance family with large memory for in-memory databases and real-time analytics. Lesson: Instance families: pick the shape

Metrics

Measurements over time, such as CPU use or request counts, collected by CloudWatch. Lesson: Amazon CloudWatch: how is it doing

Migration Evaluator

Builds a business case with projected AWS costs for a planned migration. Lesson: Resources for the migration journey

Model

In machine learning, what a system learns from example data and then uses to make predictions. Lesson: AI, ML and three layers of help

Multi-AZ

Running a resource, such as an RDS database, with a standby copy in another Availability Zone. Lesson: High availability with multiple AZs

Multi-factor authentication (MFA)

Signing in with a second proof, such as a code or security key, besides the password. Lesson: Protecting the root user

Multiple choice

Exam question type with one correct answer out of four options. Lesson: Pacing and question types

Multiple response

Exam question type with two or more correct answers out of five or more options. Lesson: Pacing and question types

N

NAT gateway

Lets resources in private subnets start outbound internet connections while blocking inbound ones. Lesson: Route tables and gateways

Network ACL

A stateless subnet-level firewall with numbered allow and deny rules. Lesson: Network ACLs: a gate at each subnet

Network Load Balancer

A very high-performance load balancer for TCP and UDP traffic. Lesson: Load balancers spread the work

Network reachability

Whether a resource can actually be reached from a network, such as the internet, on a given port. Lesson: Amazon Inspector checks the roads

NoSQL

Non-relational databases with flexible data models, such as key-value or document. Lesson: NoSQL: Amazon DynamoDB

O

Object storage

Storage that keeps each file as an object with metadata in a flat container, like Amazon S3. Lesson: Object storage: Amazon S3

On-Demand Capacity Reservations

Reserve EC2 capacity in one AZ for any duration, paid whether used or not. Lesson: Dedicated Hosts, Dedicated Instances, Capacity Reservations

On-Demand Instances

EC2 instances paid by the second or hour with no commitment. Lesson: Four ways to pay for the same server

On-premises

Running IT in your own data center or building. Lesson: Cloud, hybrid, on-premises

OpenID Connect (OIDC)

A standard identity layer used for federated sign-in. Lesson: Federated identity

Operational excellence

Well-Architected pillar about running, monitoring and improving operations, for example operations as code. Lesson: Operational excellence: run it and improve it

Operational expenditure (OpEx)

Ongoing spending on services as you use them. Lesson: Fixed costs vs variable costs

Operations perspective

AWS CAF perspective making sure cloud services run at the level the business needs. Lesson: The technical perspectives

Organizational units (OUs)

Folders in AWS Organizations that group member accounts, such as Production and Test, so policies can be applied to the whole group. Lesson: Guardrails for every account: SCPs and Control Tower

P

Passkeys and security keys

Phishing-resistant MFA devices, built into phones and laptops or as hardware keys. Lesson: Passwords, password policies and MFA

Password policy

Rules for IAM user passwords, such as length, character types, expiry and reuse. Lesson: Passwords, password policies and MFA

Patch management

A shared control: AWS patches its infrastructure; customers patch their guest OS and apps. Lesson: Some controls belong to both

Pay-as-you-go pricing

Paying only for the resources you use, for as long as you use them. Lesson: Renting the kennel instead of building one

PCI DSS

Payment Card Industry Data Security Standard: security rules for handling card payments. Lesson: Requirements vary by place, industry and service

People perspective

AWS CAF perspective covering culture, training, staffing and change. Lesson: The business-side perspectives

Performance efficiency

Well-Architected pillar about using resources efficiently as demand and technology change. Lesson: Performance efficiency: the right resource for the job

Permission sets

IAM Identity Center templates of permissions; assigned to users or groups for an account, they become IAM roles in that account. Lesson: AWS IAM Identity Center

Perspectives

The six groups of capabilities in the AWS CAF: business, people, governance, platform, security, operations. Lesson: A plan for the whole company, not just IT

Pillars

The six focus areas of the AWS Well-Architected Framework. Lesson: Best practices, written down

Platform as a service (PaaS)

Cloud model where the provider runs the platform and you bring apps and data. Lesson: Amazon RDS: AWS takes the OS and engine

Platform perspective

AWS CAF perspective for building a scalable cloud platform and modernizing workloads. Lesson: The technical perspectives

Policy

A JSON document that allows or denies actions on resources. Lesson: Who's who in IAM

Principle of least privilege

Granting only the permissions needed for a task, for only as long as needed. Lesson: Least privilege

Private marketplace

A curated AWS Marketplace catalog limiting staff to approved products. Lesson: AWS Marketplace: buy, govern, track

Private subnet

A subnet with no route to an internet gateway, used for app servers and databases. Lesson: Your own private network: VPC and subnets

Public subnet

A subnet whose route table sends internet traffic to an internet gateway. Lesson: Your own private network: VPC and subnets

Q

Queue

A buffer that holds messages until a worker is ready to process them. Lesson: Messages, queues and events

R

Reduced business risk

AWS CAF outcome: better reliability, security and recovery. Lesson: The four business outcomes

Refactor

Migration strategy that re-architects an app with cloud-native features. Lesson: Seven ways to handle each app

Regional RI

A Reserved Instance whose discount applies in any AZ of its Region, without reserving capacity. Lesson: Reserved Instance flexibility

Rehost

Lift and shift: move servers to AWS as they are. Lesson: Seven ways to handle each app

Relational database

A database storing data in linked tables of rows and columns, queried with SQL. Lesson: Relational: Amazon RDS and Amazon Aurora

Reliability

Well-Architected pillar about working correctly and recovering quickly from failures. Lesson: Reliability: work correctly, recover quickly

Relocate

Migration strategy that moves a whole virtualized environment to the cloud without app changes. Lesson: Seven ways to handle each app

Replatform

Migration strategy with small optimizations, such as moving a database to a managed service. Lesson: Seven ways to handle each app

Repurchase

Migration strategy that replaces an app with a different product, often SaaS. Lesson: Seven ways to handle each app

Reserved Instances (RIs)

A 1- or 3-year commitment to an EC2 configuration in exchange for a big discount. Lesson: Four ways to pay for the same server

Resource

The part of a policy statement naming which AWS resources it applies to, usually by ARN. Lesson: Reading a policy

Retain

Migration strategy that keeps an app where it is for now. Lesson: Seven ways to handle each app

Retire

Migration strategy that switches off apps nobody needs. Lesson: Seven ways to handle each app

Retrieval fees

Charges for reading data back from infrequent-access and archive storage classes. Lesson: Paying for storage tiers

Rightsizing

Matching resource size and type to what a workload actually needs, and rechecking over time. Lesson: Rightsizing

Root user

The identity created with an AWS account, with complete, unrestricted access. Lesson: The master key

Root user protection

Securing the root user: strong password, MFA, no access keys, used only for root-only tasks. Lesson: Protecting the root user

Route table

Rules that decide where network traffic from a subnet is sent. Lesson: Route tables and gateways

Routing policies

Route 53 rules for choosing DNS answers, such as weighted, latency, failover or geolocation. Lesson: Amazon Route 53

S

S3 Glacier

Amazon S3 archive storage classes: Instant Retrieval, Flexible Retrieval and Deep Archive. Lesson: The storage-class ladder

S3 Intelligent-Tiering

S3 class that moves objects between access tiers automatically when access patterns change. Lesson: The storage-class ladder

S3 One Zone-IA

Infrequent-access S3 class storing data in one AZ, for data you can re-create. Lesson: The storage-class ladder

S3 Standard

The default S3 class for frequently accessed data. Lesson: The storage-class ladder

S3 Standard-IA

S3 class for infrequently accessed data with millisecond reads and a retrieval fee. Lesson: The storage-class ladder

S3 storage class

An S3 option that trades storage price against access speed, cost and resilience. Lesson: The storage-class ladder

SAML 2.0

Security Assertion Markup Language 2.0, a standard for federated single sign-on. Lesson: Federated identity

Savings Plans

A 1- or 3-year commitment to a steady amount of compute spend per hour for lower prices. Lesson: Four ways to pay for the same server

Scalability

The ability of a system to grow to handle more work. Lesson: Scalability, elasticity and agility

Scale in

Removing resources when demand falls. Lesson: Auto scaling = elasticity

Scale out

Adding more resources, such as instances, when demand rises. Lesson: Auto scaling = elasticity

Schema

The structure of a database: its tables, columns and relationships. Lesson: AWS DMS and AWS SCT

Secret access key

The private half of an access key pair; it must be kept secret. Lesson: Access keys

Security group

A stateful virtual firewall for an instance, with allow rules only. Lesson: Security groups: a guard at each instance

Security in the cloud

The customer's side of shared responsibility: data, access, configuration and guest OS. Lesson: Security OF the cloud vs security IN the cloud

Security of the cloud

AWS's side of shared responsibility: facilities, hardware, network and virtualization. Lesson: Security OF the cloud vs security IN the cloud

Security perspective

AWS CAF perspective for confidentiality, integrity and availability of data and workloads. Lesson: The technical perspectives

Security pillar

Well-Architected pillar about protecting data, systems and assets. Lesson: Security: protect data, systems and assets

Serverless

Running code or services without provisioning or managing servers, paying only for use. Lesson: Serverless: Fargate and Lambda

Service control policy (SCP)

An AWS Organizations guardrail that caps the maximum permissions in member accounts, even for admins and root; it grants nothing by itself. Lesson: Guardrails for every account: SCPs and Control Tower

Service Quotas

Shows and manages limits on AWS resources per account and Region. Lesson: Tools for operating what you built

Shared controls

Controls both AWS and the customer carry out in their own layers. Lesson: Some controls belong to both

Shield Advanced

Paid DDoS protection with a response team and cost protection. Lesson: AWS Shield: stop the flood

Shield Standard

Free, automatic DDoS protection for every AWS customer. Lesson: AWS Shield: stop the flood

Snapshots

Point-in-time backups of EBS volumes, stored in Amazon S3. Lesson: Block storage: Amazon EBS and instance store

Software as a service (SaaS)

Complete applications delivered over the internet, run by the provider. Lesson: AWS Lambda: you bring code and data

Speed of deployment

Getting resources running in minutes instead of waiting weeks for hardware. Lesson: Speed of deployment and global reach

Spot Instances

Spare EC2 capacity at the deepest discount, which AWS can reclaim with short notice. Lesson: Four ways to pay for the same server

SQL

Structured Query Language: the standard language for querying relational databases. Lesson: Relational: Amazon RDS and Amazon Aurora

Standard RIs

Reserved Instances with the biggest discount, limited changes, and resale on the RI Marketplace. Lesson: Reserved Instance flexibility

Stateful

Remembers connections, so replies to allowed traffic are allowed automatically. Lesson: Security groups: a guard at each instance

Stateless

Checks each packet on its own, so return traffic needs its own rule. Lesson: Network ACLs: a gate at each subnet

Storage optimized

EC2 instance family with fast local storage for heavy read and write workloads. Lesson: Instance families: pick the shape

Subnets

Ranges of IP addresses inside a VPC, each in one Availability Zone. Lesson: Your own private network: VPC and subnets

Sustainability

Well-Architected pillar about reducing the environmental impact of cloud workloads. Lesson: Sustainability: less impact on the planet

System integrators (SIs)

Partners that help customers plan, migrate, build and manage workloads. Lesson: The AWS Partner Network

T

Technical Account Manager (TAM)

A named AWS technical contact who guides Enterprise Support and Unified Operations customers proactively. Lesson: What a TAM does, and how fast help comes

TLS

Transport Layer Security: the protocol that encrypts data in transit, as in HTTPS. Lesson: At rest and in transit

Topic

An SNS channel that pushes each published message to all its subscribers. Lesson: Messages, queues and events

Total cost of ownership (TCO)

The full cost of running something over its life, including hardware, power, space and staff. Lesson: What the closet really costs

TOTP

Time-based one-time password: a short code that changes about every 30 seconds, used for MFA. Lesson: Passwords, password policies and MFA

Trail

A CloudTrail configuration that keeps event logs long term in an S3 bucket. Lesson: AWS CloudTrail: who did what

Transition

A lifecycle action that moves objects to a cheaper storage class after a set age. Lesson: Lifecycle policies do the moving

U

User-defined tags

Tags you create, such as project=shop, which must be activated for cost allocation. Lesson: Cost allocation tags

V

Value proposition of the AWS Cloud

Why businesses choose AWS: variable costs, scale, agility, global reach and no data centers to run. Lesson: Six reasons companies move

Variable cost

A cost that rises and falls with how much you use. Lesson: Fixed costs vs variable costs

Virtual authenticator apps

Phone or computer apps that generate MFA codes. Lesson: Passwords, password policies and MFA

Virtual private gateway

The AWS side of a Site-to-Site VPN connection to a VPC. Lesson: Route tables and gateways

VPC endpoints

Private connections from a VPC to AWS services, such as S3, without the internet. Lesson: Peering, Transit Gateway and endpoints

VPC peering

A private connection between two VPCs. Lesson: Peering, Transit Gateway and endpoints

W

Web application firewall

A firewall that inspects web requests and blocks attacks like SQL injection. Lesson: AWS WAF: filter the web requests

Z

Zonal RI

A Reserved Instance tied to one AZ that also reserves capacity there. Lesson: Reserved Instance flexibility

Acronyms

AWS and Amazon Web Services are trademarks of Amazon.com, Inc. or its affiliates. Ranger Gamez is not affiliated with or endorsed by Amazon. The practice questions are written to the published exam objectives; they are not real exam questions.