ACA CCO key terms

A geographic area where a cloud provider operates one or more isolated data center groups. You choose a region to place resources close to users and to meet data residency requirements.

A physically separate data center cluster within a region, with independent power and network. Deploying across multiple zones protects an application from a single-site failure.

A logically isolated network you define in the cloud, with your own IP address range, subnets, routing, and gateways. Resources inside it communicate privately and control inbound and outbound traffic.

The ability to add or remove computing capacity automatically as demand changes. It differs from scalability because resources shrink again when load drops, reducing cost.

The ability of a system to handle growing workload by adding resources, either vertically by enlarging a single machine or horizontally by adding more machines.

A division of duties where the provider secures the physical infrastructure and platform, while the customer secures data, identities, configurations, and access rules. Knowing the split determines what you must configure yourself.

A virtual machine running in the cloud with its own CPU, memory, disk, and network configuration. You select a type and image, then start, stop, or replace it as needed.

A predefined hardware profile specifying CPU cores, memory, and sometimes local storage or accelerated hardware. Choosing the right family balances performance against cost for a workload.

A template containing an operating system and optional preinstalled software used to create instances. Custom images let you standardize configuration and launch identical servers repeatedly.

A stateful virtual firewall attached to instances that permits or denies traffic by protocol, port, and source or destination. Only explicitly allowed traffic passes; return traffic is automatically permitted.

A public IP address you reserve in an account and can remap between instances. It keeps a stable endpoint when you replace or fail over a server.

A managed service that distributes incoming requests across multiple backend servers and health-checks them. It improves availability and lets you scale capacity without changing the client-facing address.

A range of IP addresses carved from a VPC, placed in one availability zone. Instances and other resources are launched into a subnet, which determines their network segment.

A set of rules that decides where network traffic from a subnet or gateway is forwarded. Each entry pairs a destination address range with a next hop such as a gateway or interface.

A managed service that lets instances in a private subnet reach the internet for outbound traffic without exposing them to inbound connections from outside.

A stateless, subnet-level filter that allows or denies traffic by ordered rules. Because it is stateless, both request and response directions must be permitted explicitly.

A distributed set of edge servers that cache content close to users to reduce latency and origin load. You configure caching rules and refresh cached objects when content changes.

A service that stores unstructured data as objects inside containers, addressed by key and accessed over HTTP. It suits backups, media, and static assets rather than running databases.

A named container in object storage that holds objects and defines their access policy and region. Names must be globally unique within the service.

Virtual disk volumes attached to an instance that provide low-latency read and write access, like a local hard drive. Volumes persist independently of the instance lifecycle.

A point-in-time copy of a disk volume stored durably and usable to restore or clone data. Snapshots support backup, rollback, and creating new volumes in other zones.

An automated policy that transitions stored objects to cheaper tiers or deletes them after a set age. It reduces storage cost without manual cleanup.

A managed database offering that handles provisioning, patching, backup, and failover for a familiar SQL engine. You focus on schema and queries while the provider runs the infrastructure.

A read-only copy of a database kept synchronized from the primary instance. It offloads read traffic and can be promoted during a failover.

An identity service for creating users, groups, and roles and granting them permissions through policies. It controls who can call which cloud APIs and on which resources.

A structured document that states which actions are allowed or denied on which resources, optionally under conditions. Policies are attached to identities or resources to grant permissions.

An identity with permissions that trusted entities can assume temporarily instead of holding long-term credentials. It is commonly used by services and cross-account access.

A credential pair used to sign programmatic API requests. Because it grants long-lived access, it should be rotated, scoped narrowly, and never embedded in public code.

A login requirement combining a password with a second proof such as a one-time code or hardware token. It reduces the impact of stolen passwords.

A service that collects metrics, events, and logs from cloud resources and raises alarms when thresholds are crossed. It provides visibility into health and performance.

A numeric time-series measurement such as CPU utilization or network throughput reported by a resource. Metrics are the raw data that dashboards and alarms evaluate.

A rule that watches a metric against a threshold over a period and triggers notifications or automated actions when the condition is met.

A service that adjusts the number of running instances based on schedules or metric thresholds. It maintains capacity during peaks and removes idle capacity to control cost.

A periodic probe that tests whether a backend server responds correctly. Failing servers are removed from load balancing rotation until they recover.

Managing cloud resources through versioned template or configuration files rather than manual console clicks. It makes deployments repeatable, reviewable, and recoverable.

A design approach that keeps a service running despite component failure, typically by redundant instances across zones, health checks, and automatic failover.

The duration a cached object or DNS record remains valid before it must be refreshed from the source. Short values improve freshness; long values reduce origin traffic.

The source server that holds the authoritative content a CDN caches and serves on its behalf. When the cache misses, the edge fetches the object from here.