Glossary

Key terms and acronyms from the tutorials, each explained in a sentence or two.

Terms starting withA

ABAC (Attribute-based access control): An access control approach that grants permissions by matching attributes, such as tags on a user or role and on a resource, instead of listing each resource. In AWS, ABAC uses tags in IAM policy conditions, so new resources with the right tags are covered without editing the policy.; Tutorial: AWS Identity and Access Management (IAM) Source: IAM User Guide: ABAC(opens in a new tab)
ACL (Access control list): A list attached to a resource that names who may access it and what they may do. VPC subnets have network ACLs; Amazon S3 buckets also support ACLs, but new buckets disable them in favor of policies.; Source: NIST glossary: access control list(opens in a new tab)
AMI (Amazon Machine Image): A template for launching EC2 instances: the operating system, software, and settings to copy onto the new instance's volumes, plus who may launch it. AMIs come from AWS, AWS Marketplace, or the community, or you create your own from an instance.; Tutorial: Amazon EC2 Source: Amazon EC2 User Guide: Amazon Machine Images(opens in a new tab)
Apache Parquet: An open-source columnar file format for analytics that stores compressed columns along with the schema. Querying Parquet files with Amazon Athena scans less data than CSV or JSON, so it is faster and cheaper.; Also written: Parquet; Tutorial: Amazon Athena Source: Apache Parquet: Overview(opens in a new tab)
API (Application programming interface): A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.; Tutorial: Amazon API Gateway Source: AWS: What is an API?(opens in a new tab)
ARN (Amazon Resource Name): The unique identifier of an AWS resource, in the form arn:partition:service:region:account-id:resource. IAM policies use ARNs to name the resources they allow or deny.; Tutorial: AWS Identity and Access Management (IAM) Source: IAM User Guide: Amazon Resource Names (ARNs)(opens in a new tab)
At-least-once delivery: Every message is delivered, but occasionally more than once. Amazon SQS standard queues work this way, so consumers should be idempotent.; Also written: at-least-once; Tutorial: Amazon SQS Source: Amazon SQS Developer Guide: At-least-once delivery(opens in a new tab)
AWS Region: A separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.; Also written: Region; Source: AWS Regions and Availability Zones: AWS Regions(opens in a new tab)
AZ (Availability Zone): An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.; Source: AWS Regions and Availability Zones: Availability Zones(opens in a new tab)

Terms starting withB

Bastion host: A hardened server in a public subnet that administrators connect to first, and from there to instances in private subnets. Session Manager in AWS Systems Manager can replace it without any open inbound ports.; Also written: bastion; Tutorial: Amazon VPC Source: NIST glossary: bastion host(opens in a new tab)
BGP (Border Gateway Protocol): The routing protocol that networks use to tell each other which IP address ranges they can reach. AWS Direct Connect and AWS Site-to-Site VPN use BGP to exchange routes between your network and AWS.; Tutorial: AWS Direct Connect Source: RFC 4271: A Border Gateway Protocol 4 (BGP-4)(opens in a new tab)
Blue/green deployment: Releasing a new version (green) alongside the running one (blue), then moving traffic to green once it is ready. Rolling back is quick: move the traffic back to blue.; Also written: blue/green; Source: AWS whitepaper: Blue/Green Deployments on AWS(opens in a new tab)

Terms starting withC

CA (Certificate authority): A trusted organization or service that issues digital certificates, vouching that a public key belongs to a named domain or organization. Browsers trust certificates signed by well-known CAs; AWS Private CA issues certificates for internal use.; Tutorial: AWS Certificate Manager (ACM) Source: NIST glossary: Certificate Authority (CA)(opens in a new tab)
CDC (Change data capture): Capturing each insert, update, and delete in a source database as it happens, so that another system can be kept in step. AWS DMS uses CDC to keep replicating changes after the initial full load.; Tutorial: AWS Database Migration Service Source: AWS DMS User Guide: Creating tasks for ongoing replication(opens in a new tab)
CDN (Content delivery network): A network of servers in many locations that caches content close to users, so that pages, images, and video load faster and the origin server handles less traffic. Amazon CloudFront is the AWS CDN.; Tutorial: Amazon CloudFront Source: AWS: What is a CDN?(opens in a new tab)
CI/CD (Continuous integration and continuous delivery): Practices in which every code change is built and tested automatically (continuous integration) and kept ready to release, often deploying it automatically through a pipeline (continuous delivery or deployment).; Also written: continuous integration, continuous delivery; Source: AWS whitepaper: Practicing Continuous Integration and Continuous Delivery on AWS(opens in a new tab)
CIDR (Classless Inter-Domain Routing): A notation for a range of IP addresses: an address, a slash, and the number of fixed leading bits, such as 10.0.0.0/16 for 65,536 addresses. VPCs and subnets are defined by CIDR blocks; the smaller the number after the slash, the larger the range.; Also written: CIDR block; Tutorial: Amazon VPC Source: RFC 4632: Classless Inter-domain Routing (CIDR)(opens in a new tab)
CNAME (Canonical name record): A DNS record that makes one domain name an alias of another, such as www.example.com pointing to example.com. A CNAME cannot be used for the zone apex (example.com itself); Route 53 alias records cover that case.; Also written: CNAME record; Tutorial: Amazon Route 53 Source: RFC 1034: Domain names - concepts and facilities(opens in a new tab)
Cold start: The extra delay when AWS Lambda must create a new execution environment, load the code, and run its initialization before handling a request. Later requests reuse the environment and are faster; provisioned concurrency avoids cold starts.; Tutorial: AWS Lambda Source: AWS Lambda Developer Guide: Execution environment lifecycle(opens in a new tab)
Columnar storage: Storing data column by column instead of row by row, so that analytical queries read only the columns they need, and similar values compress well. Amazon Redshift and the Parquet and ORC file formats store data this way.; Also written: columnar format, columnar; Tutorial: Amazon Redshift Source: Amazon Redshift Database Developer Guide: Columnar storage(opens in a new tab)
CSPM (Cloud security posture management): Continuously checking cloud resources against security best practices and standards, and reporting misconfigurations, such as a public S3 bucket. AWS Security Hub CSPM runs these checks across AWS accounts.; Tutorial: AWS Security Hub Source: AWS Security Hub User Guide: Introduction to AWS Security Hub CSPM(opens in a new tab)
Customer managed key: A KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.; Tutorial: AWS Key Management Service (KMS) Source: AWS KMS Developer Guide: AWS KMS keys(opens in a new tab)

Terms starting withD

Data lake: A central store for large amounts of structured and unstructured data kept in its original form, usually in Amazon S3, which many tools can analyze. AWS Lake Formation helps build and secure one.; Tutorial: AWS Lake Formation Source: AWS: What is a data lake?(opens in a new tab)
Data warehouse: A database designed for analytics, holding cleaned, structured data from many sources, so that reports and queries across years of history run fast. Amazon Redshift is the AWS data warehouse.; Tutorial: Amazon Redshift Source: AWS: What is a data warehouse?(opens in a new tab)
DDoS (Distributed denial of service): An attack that floods an application or network with traffic from many sources at once, to make it unavailable to real users. AWS Shield Standard protects every AWS customer from common network-layer DDoS attacks at no extra cost.; Tutorial: AWS Shield Source: NIST glossary: distributed denial of service (DDoS)(opens in a new tab)
Decoupling: Designing components so that they do not depend directly on each other being available, for example by passing work through a queue. A slow or failed component then does not stop the others, and each can scale on its own.; Also written: loose coupling, loosely coupled, decoupled; Tutorial: Application integration services: choosing the right one Source: AWS Well-Architected Reliability Pillar: Implement loosely coupled dependencies(opens in a new tab)
DLQ (Dead-letter queue): A queue that receives messages that could not be processed after a set number of attempts, so they stop blocking other messages and can be inspected later. Amazon SQS, Amazon SNS, AWS Lambda, and Amazon EventBridge can send failed messages to one.; Tutorial: Amazon SQS Source: Amazon SQS Developer Guide: Using dead-letter queues(opens in a new tab)
DNS (Domain Name System): The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.; Tutorial: Amazon Route 53 Source: RFC 1034: Domain names - concepts and facilities(opens in a new tab)
DR (Disaster recovery): Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.; Source: AWS whitepaper: Disaster recovery options in the cloud(opens in a new tab)

Terms starting withE

Edge location: An AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.; Tutorial: Amazon CloudFront Source: Amazon CloudFront Developer Guide: How CloudFront delivers content(opens in a new tab)
Encryption at rest: Encrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.; Also written: data at rest; Tutorial: AWS Key Management Service (KMS) Source: AWS Well-Architected Security Pillar: Protecting data at rest(opens in a new tab)
Encryption in transit: Encrypting data while it moves across a network, usually with TLS, so that it cannot be read or changed on the way.; Also written: data in transit; Tutorial: AWS Certificate Manager (ACM) Source: AWS Well-Architected Security Pillar: Protecting data in transit(opens in a new tab)
ENI (Elastic network interface): A virtual network card in a VPC subnet, with private IP addresses, security groups, and a MAC address. EC2 instances, Lambda functions connected to a VPC, and interface endpoints all connect through network interfaces.; Tutorial: Amazon VPC Source: Amazon EC2 User Guide: Elastic network interfaces(opens in a new tab)
Envelope encryption: Encrypting data with a data key, then encrypting that data key with another key, such as a KMS key, and storing the encrypted data key with the data. Large data never has to be sent to AWS KMS, only the small data key.; Tutorial: AWS Key Management Service (KMS) Source: AWS KMS Developer Guide: AWS KMS cryptography essentials(opens in a new tab)
ETL (Extract, transform, and load): Copying data from sources, cleaning and reshaping it, and loading it into a target such as a data warehouse. AWS Glue is the AWS serverless ETL service.; Tutorial: AWS Glue Source: AWS: What is ETL?(opens in a new tab)
Event-driven architecture: A design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.; Also written: event-driven; Tutorial: Amazon EventBridge Source: AWS: Event-driven architecture(opens in a new tab)
Eventual consistency: A read may briefly return older data after a write, but all copies catch up shortly afterwards. DynamoDB reads are eventually consistent by default and cost half as much as strongly consistent reads.; Also written: eventually consistent; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Read consistency(opens in a new tab)
Exactly-once processing: Each message is delivered and processed once, with no duplicates. Amazon SQS FIFO queues remove duplicate messages sent within a 5-minute deduplication interval.; Also written: exactly-once; Tutorial: Amazon SQS Source: Amazon SQS Developer Guide: Exactly-once processing(opens in a new tab)
Exponential backoff: Waiting longer after each failed attempt before retrying, such as 1, 2, then 4 seconds, usually with some randomness (jitter), so that retries do not overload a struggling service. The AWS SDKs retry this way.; Also written: backoff with jitter; Source: AWS Builders' Library: Timeouts, retries, and backoff with jitter(opens in a new tab)

Terms starting withF

Failover: Switching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.; Also written: fail over; Tutorial: Amazon Route 53 Source: Amazon Route 53 Developer Guide: Configuring DNS failover(opens in a new tab)
Fan-out: Sending one message or event to many receivers at once so that each can process it in parallel, such as an Amazon SNS topic delivering to several SQS queues.; Also written: fan out, fanout; Tutorial: Amazon SNS Source: Amazon SNS Developer Guide: Fanout to Amazon SQS queues(opens in a new tab)
Fault tolerance: The ability of a system to keep working without interruption when a component fails, because enough redundant capacity is already running. It goes further than high availability, which may allow a short failover.; Also written: fault-tolerant, fault tolerant; Source: AWS Well-Architected Reliability Pillar: Design your workload to withstand component failures(opens in a new tab)
FIFO (First in, first out): Processing items in the order they arrived. Amazon SQS FIFO queues keep messages in order within a message group and remove duplicates.; Tutorial: Amazon SQS Source: Amazon SQS Developer Guide: Amazon SQS FIFO queues(opens in a new tab)
FIPS (Federal Information Processing Standards): US government standards for computer systems. FIPS 140-3, and the earlier FIPS 140-2, set security requirements for cryptographic modules, such as the hardware security modules behind AWS KMS and AWS CloudHSM.; Also written: FIPS 140-3, FIPS 140-2; Tutorial: AWS CloudHSM Source: NIST: FIPS 140-3, Security Requirements for Cryptographic Modules(opens in a new tab)

Terms starting withG

GPU (Graphics processing unit): A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.; Tutorial: Amazon EC2 Source: AWS: What is a GPU?(opens in a new tab)
GSI (Global secondary index): A DynamoDB index with a different partition key, and optionally a sort key, from its table, so that items can be queried by other attributes. It can be added at any time, and its reads are only eventually consistent.; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Global secondary indexes(opens in a new tab)

Terms starting withH

HA (High availability): The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.; Also written: highly available; Source: AWS Well-Architected Reliability Pillar: Availability(opens in a new tab)
HDD (Hard disk drive): Storage on spinning magnetic disks: cheaper per gigabyte and good at large sequential reads and writes, but slow at small random ones. Amazon EBS st1 and sc1 volumes are HDD-backed.; Tutorial: Amazon EBS Source: Amazon EBS User Guide: Amazon EBS volume types(opens in a new tab)
Health check: A regular test, such as a request to a web page, that a load balancer, an Auto Scaling group, or Route 53 makes to see whether a resource is working. Unhealthy resources stop receiving traffic or are replaced.; Tutorial: Elastic Load Balancing Source: Elastic Load Balancing: Health checks for target groups(opens in a new tab)
HIPAA (Health Insurance Portability and Accountability Act): A US law that protects health information. AWS customers can process protected health information on HIPAA-eligible services after accepting a Business Associate Addendum (BAA) with AWS, which is available in AWS Artifact.; Tutorial: AWS Artifact Source: AWS: HIPAA Compliance(opens in a new tab)
HPC (High performance computing): Using many powerful computers together on large problems, such as simulations, genomics, or weather forecasting, often with fast networking between them. On AWS it uses EC2 instances with Elastic Fabric Adapter, AWS Batch, and AWS ParallelCluster.; Also written: high-performance computing; Tutorial: AWS Batch Source: AWS: What is high-performance computing?(opens in a new tab)
HSM (Hardware security module): A tamper-resistant hardware device that creates and stores cryptographic keys and uses them without ever exposing them. AWS KMS uses HSMs internally; AWS CloudHSM gives you dedicated HSMs that you control.; Tutorial: AWS CloudHSM Source: NIST glossary: Hardware Security Module (HSM)(opens in a new tab)
HTTP (Hypertext Transfer Protocol): The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.; Source: RFC 9110: HTTP Semantics(opens in a new tab)
HTTPS (HTTP Secure): HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.; Source: RFC 9110: HTTP Semantics(opens in a new tab)

Terms starting withI

IaC (Infrastructure as code): Defining infrastructure, such as networks, servers, and permissions, in text files that are versioned and deployed automatically, instead of setting it up by hand. AWS CloudFormation and the AWS CDK are AWS tools for it.; Tutorial: AWS CloudFormation Source: AWS whitepaper: Introduction to DevOps on AWS, Infrastructure as code(opens in a new tab)
Idempotency: An operation is idempotent when repeating it has the same effect as doing it once, such as setting a value rather than adding to it. It makes retries safe; many AWS APIs accept a client token for this.; Also written: idempotent; Source: Amazon EC2 API: Ensuring idempotency(opens in a new tab)
Identity federation: Letting people sign in to AWS with an identity from another provider, such as a company directory, instead of creating IAM users for them. They receive temporary credentials through an IAM role.; Also written: federated identity, federated user; Tutorial: AWS Identity and Access Management (IAM) Source: AWS: Identity federation(opens in a new tab)
IDS (Intrusion detection system): A system that watches network traffic or servers for signs of attack or misuse and raises alerts. It detects; an intrusion prevention system (IPS) also blocks.; Tutorial: AWS Network Firewall Source: NIST glossary: intrusion detection system (IDS)(opens in a new tab)
IOPS (Input/output operations per second): How many read and write operations a storage volume can handle each second. It matters for databases that make many small random reads and writes; throughput, in MB per second, matters for large sequential ones.; Tutorial: Amazon EBS Source: Amazon EBS User Guide: I/O characteristics and monitoring(opens in a new tab)
IP (Internet Protocol): The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.; Tutorial: Amazon VPC Source: RFC 791: Internet Protocol(opens in a new tab)
IPS (Intrusion prevention system): A system that inspects traffic for attacks and blocks matching traffic automatically, rather than only raising alerts. AWS Network Firewall can act as an IPS with Suricata-compatible rules.; Tutorial: AWS Network Firewall Source: NIST glossary: intrusion prevention system (IPS)(opens in a new tab)

Terms starting withJ

JSON (JavaScript Object Notation): A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.; Source: RFC 8259: The JavaScript Object Notation (JSON) Data Interchange Format(opens in a new tab)
JWT (JSON Web Token): A compact, signed token that carries claims as JSON, such as who the user is and when the token expires. Amazon Cognito issues JWTs, and Amazon API Gateway can check them before passing a request to the backend.; Tutorial: Amazon Cognito Source: RFC 7519: JSON Web Token (JWT)(opens in a new tab)

Terms starting withL

Latency: The time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.; Source: AWS: What is latency?(opens in a new tab)
Lazy loading: A caching strategy that adds data to the cache only when it is requested and missing, reading it from the database then. Only requested data is cached, but the first read is slower and cached data can become out of date.; Also written: cache-aside; Tutorial: Amazon ElastiCache Source: ElastiCache User Guide: Caching strategies(opens in a new tab)
LDAP (Lightweight Directory Access Protocol): A protocol for reading and updating a directory, such as the users and groups in Microsoft Active Directory. Applications use it to look up and authenticate users.; Tutorial: AWS Directory Service Source: RFC 4511: Lightweight Directory Access Protocol (LDAP): The Protocol(opens in a new tab)
Least privilege: Giving each person or system only the permissions it needs for its task, and no more. In IAM, this means starting with no access and allowing specific actions on specific resources.; Also written: principle of least privilege, least-privilege; Tutorial: AWS Identity and Access Management (IAM) Source: NIST glossary: least privilege(opens in a new tab)
LSI (Local secondary index): A DynamoDB index with the same partition key as its table but a different sort key. It must be created with the table, shares the table's capacity, and supports strongly consistent reads.; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Local secondary indexes(opens in a new tab)

Terms starting withM

MFA (Multi-factor authentication): Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.; Tutorial: AWS Identity and Access Management (IAM) Source: NIST glossary: multi-factor authentication(opens in a new tab)
Microservices: An application built as small, independent services, each owning one business function and its data, that communicate over APIs or events. Each service can be changed, deployed, and scaled on its own.; Also written: microservice; Source: AWS: What are microservices?(opens in a new tab)
ML (Machine learning): Software that learns patterns from example data to make predictions or decisions, instead of following rules written by hand. A model is first trained on data, then used to make predictions on new data, which is called inference.; Tutorial: Machine learning services: choosing the right one Source: AWS: What is machine learning?(opens in a new tab)
Multi-AZ: Running standby or extra copies of a resource in other Availability Zones so that it survives the loss of one. An Amazon RDS Multi-AZ deployment keeps one or two standby copies and fails over to one automatically.; Tutorial: Amazon RDS Source: Amazon RDS User Guide: Multi-AZ deployments(opens in a new tab)
Multi-site active/active: A disaster recovery strategy that runs the full workload in two or more Regions at once, all serving traffic. It recovers fastest, with almost no downtime, and costs the most.; Also written: active-active, active/active; Source: AWS whitepaper: Disaster recovery options in the cloud(opens in a new tab)

Terms starting withN

NAT (Network address translation): Rewriting the IP addresses in packets as they pass through a device, most often so that many private addresses can share one public address to reach the internet.; Tutorial: Amazon VPC Source: RFC 3022: Traditional IP Network Address Translator (Traditional NAT)(opens in a new tab)
NAT gateway: A managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.; Tutorial: Amazon VPC Source: Amazon VPC User Guide: NAT gateways(opens in a new tab)
Network ACL: A stateless firewall for a subnet, with numbered allow and deny rules checked in order. Because it is stateless, return traffic needs its own rule, usually for a range of ephemeral ports.; Also written: NACL, network access control list; Tutorial: Amazon VPC Source: Amazon VPC User Guide: Network access control lists(opens in a new tab)
NFS (Network File System): A protocol for sharing files over a network, used mostly by Linux and Unix systems. Amazon EFS, Amazon FSx for OpenZFS, and Amazon FSx for NetApp ONTAP provide NFS file systems.; Tutorial: Amazon EFS Source: RFC 7530: Network File System (NFS) Version 4 Protocol(opens in a new tab)
NoSQL: Databases that store data in models other than relational tables, such as key-value, document, wide-column, or graph, usually to scale out easily or to handle data whose shape varies. Amazon DynamoDB is a NoSQL database.; Also written: non-relational; Tutorial: Amazon DynamoDB Source: AWS: What is a NoSQL database?(opens in a new tab)

Terms starting withO

OAC (Origin access control): The recommended way to let a CloudFront distribution read from a private S3 bucket: CloudFront signs its requests, and the bucket policy allows only that distribution. It replaces the older origin access identity (OAI).; Tutorial: Amazon CloudFront Source: Amazon CloudFront Developer Guide: Restrict access to an Amazon S3 origin(opens in a new tab)
OIDC (OpenID Connect): A sign-in standard built on OAuth 2.0 that lets an application learn who a user is from a trusted identity provider, through a signed ID token. IAM accepts OIDC providers, so that, for example, a GitHub Actions workflow can assume an IAM role.; Tutorial: AWS Identity and Access Management (IAM) Source: OpenID Foundation: OpenID Connect Core 1.0(opens in a new tab)
OLAP (Online analytical processing): Analyzing large amounts of data with complex queries that summarize many rows, such as sales by country and month. Data warehouses such as Amazon Redshift are built for OLAP.; Tutorial: Amazon Redshift Source: AWS: What is OLAP?(opens in a new tab)
OLTP (Online transaction processing): Handling many small, fast transactions that each read or write a few rows, such as placing orders or updating an account. Relational databases such as Amazon RDS and Amazon Aurora are built for OLTP.; Tutorial: Amazon RDS Source: AWS: OLTP vs OLAP(opens in a new tab)
On-premises: In data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.; Also written: on-prem, on premises; Source: AWS: What is hybrid cloud?(opens in a new tab)
OU (Organizational unit): A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.; Tutorial: AWS Organizations Source: AWS Organizations User Guide: Managing organizational units (OUs)(opens in a new tab)

Terms starting withP

Partition key: The attribute that DynamoDB hashes to decide which partition stores an item. A primary key is a partition key alone, or a partition key with a sort key; keys with many distinct values spread the load evenly.; Also written: hash key; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Core components(opens in a new tab)
PCI DSS (Payment Card Industry Data Security Standard): The security standard for organizations that store, process, or send payment card data. AWS is assessed as a PCI DSS Level 1 service provider, but each customer is still responsible for the compliance of what it builds.; Also written: PCI; Tutorial: AWS Artifact Source: AWS: PCI compliance(opens in a new tab)
PII (Personally identifiable information): Information that can identify a person, alone or combined with other data, such as a name, email address, or passport number. Amazon Macie finds PII in Amazon S3.; Tutorial: Amazon Macie Source: NIST glossary: personally identifiable information(opens in a new tab)
Pilot light: A disaster recovery strategy that keeps data replicated and core infrastructure ready in a second Region, with most servers switched off until a disaster. It costs less than warm standby but takes longer to recover.; Source: AWS whitepaper: Disaster recovery options in the cloud(opens in a new tab)
PITR (Point-in-time recovery): Restoring a database to its state at a chosen moment within a retention period, using continuous backups. Amazon RDS, Amazon Aurora, Amazon DynamoDB, and AWS Backup support it.; Tutorial: AWS Backup Source: AWS Backup Developer Guide: Continuous backups and point-in-time recovery(opens in a new tab)
Presigned URL: A URL that lets anyone who has it download or upload one specific S3 object for a limited time, using the permissions of the identity that created it.; Also written: pre-signed URL; Tutorial: Amazon S3 Source: Amazon S3 User Guide: Download and upload objects with presigned URLs(opens in a new tab)
Principal: A person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.; Tutorial: AWS Identity and Access Management (IAM) Source: IAM User Guide: How IAM works(opens in a new tab)
Publish/subscribe: A messaging pattern in which senders publish messages to a topic without knowing who receives them, and every subscriber to the topic gets a copy. Amazon SNS works this way.; Also written: pub/sub, publish-subscribe; Tutorial: Amazon SNS Source: AWS: What is pub/sub messaging?(opens in a new tab)

Terms starting withR

RBAC (Role-based access control): Granting permissions to roles, such as administrator or developer, and giving people the roles they need, instead of granting permissions to each person. IAM roles and IAM Identity Center permission sets follow this model.; Tutorial: AWS Identity and Access Management (IAM) Source: NIST glossary: role-based access control (RBAC)(opens in a new tab)
RCP (Resource control policy): An AWS Organizations policy that sets the maximum permissions on resources in member accounts, such as S3 buckets and KMS keys, whoever requests access. Like an SCP, it grants nothing by itself.; Tutorial: AWS Organizations Source: AWS Organizations User Guide: Resource control policies (RCPs)(opens in a new tab)
RCU (Read capacity unit): The unit of read throughput in DynamoDB: one strongly consistent read per second of an item up to 4 KB, or two eventually consistent reads.; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Read and write operations(opens in a new tab)
Read replica: A read-only copy of a database that is updated asynchronously from the primary. It takes read traffic off the primary, can be in another Region, and can be promoted to a standalone database.; Tutorial: Amazon RDS Source: Amazon RDS User Guide: Working with DB instance read replicas(opens in a new tab)
Resource-based policy: A permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.; Also written: resource-based policies; Tutorial: AWS Identity and Access Management (IAM) Source: IAM User Guide: Identity-based and resource-based policies(opens in a new tab)
REST (Representational state transfer): A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.; Also written: RESTful; Tutorial: Amazon API Gateway Source: Roy Fielding's dissertation, chapter 5: Representational State Transfer(opens in a new tab)
RI (Reserved Instance): A billing discount for committing to an instance type in a Region or Availability Zone for one or three years. It is not an instance: running instances that match are billed at the lower rate. AWS now recommends Savings Plans instead.; Tutorial: Amazon EC2 Source: Amazon EC2 User Guide: Reserved Instances overview(opens in a new tab)
RPO (Recovery point objective): The most data, measured in time, that a workload can afford to lose in a disaster. With an RPO of one hour, data must be restorable to no more than an hour before the failure.; Tutorial: AWS Backup Source: AWS whitepaper: Business continuity plan (RPO and RTO)(opens in a new tab)
RTO (Recovery time objective): The longest acceptable time between a disruption and the workload being available again.; Tutorial: AWS Backup Source: AWS whitepaper: Business continuity plan (RPO and RTO)(opens in a new tab)

Terms starting withS

SAML (Security Assertion Markup Language): An XML-based standard for passing sign-in information from an identity provider, such as Microsoft Entra ID or Okta, to a service. AWS accepts SAML 2.0 for single sign-on, directly in IAM or through IAM Identity Center.; Also written: SAML 2.0; Tutorial: AWS IAM Identity Center Source: IAM User Guide: SAML 2.0 federation(opens in a new tab)
SCP (Service control policy): An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.; Tutorial: AWS Organizations Source: AWS Organizations User Guide: Service control policies (SCPs)(opens in a new tab)
SDK (Software development kit): A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.; Source: AWS: What is an SDK?(opens in a new tab)
Security group: A stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.; Tutorial: Amazon VPC Source: Amazon VPC User Guide: Security groups(opens in a new tab)
SFTP (SSH File Transfer Protocol): A protocol for transferring files over an SSH connection, which encrypts both commands and data. AWS Transfer Family provides managed SFTP servers that store files in Amazon S3 or Amazon EFS.; Tutorial: AWS Transfer Family Source: AWS Transfer Family User Guide: What is AWS Transfer Family?(opens in a new tab)
Shared responsibility model: How security duties are split: AWS secures the cloud itself (facilities, hardware, and the software that runs its services), and customers secure what they put in it, such as data, access, and configuration. Customers manage more on EC2 than on a managed service such as Lambda.; Source: AWS: Shared Responsibility Model(opens in a new tab)
SLA (Service level agreement): A provider's commitment to a level of service, such as a monthly uptime percentage, and what customers receive if it is missed, usually service credits.; Source: AWS Service Level Agreements(opens in a new tab)
SMB (Server Message Block): The file-sharing protocol used by Windows. Amazon FSx for Windows File Server and Amazon FSx for NetApp ONTAP provide SMB shares, and Amazon S3 File Gateway can present S3 buckets as SMB shares.; Tutorial: Amazon FSx Source: Microsoft Learn: SMB file sharing overview(opens in a new tab)
Sort key: The optional second part of a DynamoDB primary key. It orders the items that share a partition key, so that queries can select a range, such as all orders after a date.; Also written: range key; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Core components(opens in a new tab)
SQL (Structured Query Language): The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.; Tutorial: Database services: choosing the right one Source: AWS: What is SQL?(opens in a new tab)
SQL injection: An attack that slips SQL code into form fields or parameters so that an application runs it against its database, for example to read or delete data. Parameterized queries prevent it, and AWS WAF can block common patterns.; Tutorial: AWS WAF Source: OWASP: SQL Injection(opens in a new tab)
SSD (Solid state drive): Storage on flash memory with no moving parts, fast at small random reads and writes (high IOPS). Amazon EBS gp3, gp2, io2, and io1 volumes are SSD-backed.; Tutorial: Amazon EBS Source: Amazon EBS User Guide: Amazon EBS volume types(opens in a new tab)
SSE (Server-side encryption): Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.; Tutorial: Amazon S3 Source: Amazon S3 User Guide: Protecting data with server-side encryption(opens in a new tab)
SSH (Secure Shell): A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.; Tutorial: Amazon EC2 Source: RFC 4251: The Secure Shell (SSH) Protocol Architecture(opens in a new tab)
SSO (Single sign-on): Signing in once to reach many applications or accounts without signing in to each again. AWS IAM Identity Center provides single sign-on to AWS accounts and applications.; Tutorial: AWS IAM Identity Center Source: NIST glossary: Single Sign-On(opens in a new tab)
Stateful: Keeping track of earlier requests or connections. A stateful firewall, such as a security group, remembers allowed connections and lets their return traffic back in automatically.; Tutorial: Amazon VPC Source: Amazon VPC User Guide: Security groups(opens in a new tab)
Stateless: Keeping no memory of earlier requests, so that each one is handled on its own. Any copy of a stateless web server can handle any request, which makes scaling easy; a stateless firewall, such as a network ACL, needs a rule for return traffic too.; Source: AWS Well-Architected Reliability Pillar: Make systems stateless where possible(opens in a new tab)
Sticky sessions: A load balancer setting that sends a client's requests to the same target for a period, tracked with a cookie. It suits applications that keep session data on the server, but it can spread load unevenly.; Also written: sticky session, session affinity; Tutorial: Elastic Load Balancing Source: Elastic Load Balancing: Edit target group attributes (sticky sessions)(opens in a new tab)
Strong consistency: A read always reflects every write that succeeded before it. Amazon S3 is strongly consistent for object reads after writes and deletes; DynamoDB offers strongly consistent reads on request for tables and local secondary indexes.; Also written: strongly consistent; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Read consistency(opens in a new tab)
Subnet: A range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.; Also written: public subnet, private subnet; Tutorial: Amazon VPC Source: Amazon VPC User Guide: Subnets(opens in a new tab)

Terms starting withT

TCP (Transmission Control Protocol): The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.; Source: RFC 9293: Transmission Control Protocol (TCP)(opens in a new tab)
Throttling: Limiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.; Also written: throttled; Tutorial: Amazon API Gateway Source: Amazon API Gateway Developer Guide: Throttle requests to your REST APIs(opens in a new tab)
TLS (Transport Layer Security): The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.; Also written: SSL/TLS, SSL; Tutorial: AWS Certificate Manager (ACM) Source: RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3(opens in a new tab)
TTL (Time to live): How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.; Source: ElastiCache User Guide: Caching strategies(opens in a new tab)

Terms starting withU

UDP (User Datagram Protocol): A transport protocol that sends packets without setting up a connection or resending lost ones, trading reliability for low latency. DNS, video calls, and games often use it; Network Load Balancer and AWS Global Accelerator support UDP.; Source: RFC 768: User Datagram Protocol(opens in a new tab)

Terms starting withV

VM (Virtual machine): A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.; Tutorial: Amazon EC2 Source: NIST glossary: Virtual Machine (VM)(opens in a new tab)
VPC endpoint: A private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.; Also written: gateway endpoint, interface endpoint; Tutorial: AWS PrivateLink Source: Amazon VPC: AWS PrivateLink concepts(opens in a new tab)
VPN (Virtual private network): An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.; Tutorial: AWS Site-to-Site VPN Source: NIST glossary: virtual private network (VPN)(opens in a new tab)

Terms starting withW

Warm standby: A disaster recovery strategy that runs a smaller but working copy of the workload in a second Region, scaled up to full size after a disaster. It recovers faster than pilot light and costs more.; Source: AWS whitepaper: Disaster recovery options in the cloud(opens in a new tab)
WCU (Write capacity unit): The unit of write throughput in DynamoDB: one write per second of an item up to 1 KB. A transactional write uses two.; Tutorial: Amazon DynamoDB Source: DynamoDB Developer Guide: Read and write operations(opens in a new tab)
WORM (Write once, read many): A storage model in which data can be written once and then cannot be changed or deleted for a set period, often to meet record-keeping rules. Amazon S3 Object Lock and AWS Backup Vault Lock provide it.; Tutorial: Amazon S3 Source: Amazon S3 User Guide: Locking objects with Object Lock(opens in a new tab)
Write-through: A caching strategy that writes data to the cache every time it is written to the database, so the cache stays current. Writes take longer, and data that is never read still takes up cache space.; Tutorial: Amazon ElastiCache Source: ElastiCache User Guide: Caching strategies(opens in a new tab)

Terms starting withX

XSS (Cross-site scripting): An attack that injects malicious script into a web page so that it runs in other users' browsers, where it can steal their session or data. AWS WAF has rules that match common XSS patterns in requests.; Tutorial: AWS WAF Source: OWASP: Cross Site Scripting (XSS)(opens in a new tab)