ACA CCP key terms

A geographic area where a cloud provider operates one or more isolated data center clusters. You choose a region to place resources close to users and to satisfy data residency requirements.

A physically separate data center cluster within a region, with independent power, cooling, and network. Deploying across multiple zones protects workloads from single-facility failures.

The ability to automatically add or remove computing resources as demand changes, so capacity tracks workload needs instead of being fixed in advance.

The capacity of a system to handle growing load by adding resources, either vertically by enlarging a single node or horizontally by adding more nodes.

A billing model where you pay only for resources consumed, measured by time, capacity, or requests, with no long-term upfront commitment required.

Infrastructure as a Service delivers virtualized compute, storage, and networking that customers configure and manage themselves, including the operating system and applications.

Platform as a Service supplies a managed runtime and middleware so developers deploy code without provisioning servers or patching the underlying operating system.

Software as a Service provides a complete application over the internet, managed by the provider, with users simply signing in rather than operating any infrastructure.

A model where the provider allocates and scales compute automatically per request or event, and customers are billed only for execution time and invocations, not idle capacity.

A logically isolated network you define in the cloud, with your own IP address range, subnets, route tables, and gateways controlling traffic flow.

A subnet created inside a VPC that binds to a single availability zone and provides the IP range from which cloud resources receive private addresses.

A virtual machine in Alibaba Cloud with selectable CPU, memory, image, disk, and network configuration, used to run applications and services.

A template containing an operating system and optional preinstalled software used to create ECS instances consistently and repeatedly.

Alibaba Cloud's highly durable object storage for unstructured data such as images, videos, and backups, accessed over HTTP through buckets and keys.

A container in object storage that holds objects, defines the namespace and region, and carries settings such as access permissions and lifecycle policies.

A managed service that distributes incoming traffic across multiple backend servers, improving availability and enabling horizontal scaling of applications.

A service that automatically adjusts the number of ECS instances based on rules or schedules, adding capacity under load and removing it when demand falls.

A logical collection of ECS instances managed together by Auto Scaling, sharing configuration, minimum and maximum size, and scaling rules.

A managed relational database service that handles provisioning, backup, patching, and failover so teams run databases without administering servers directly.

Periodic probes that test whether a backend server responds correctly; unhealthy servers are removed from rotation until they recover.

A stateful virtual firewall attached to instances that permits or denies inbound and outbound traffic by protocol, port, and source or destination address.

Alibaba Cloud's identity and permission service for creating users, groups, and roles and granting them fine-grained policies over cloud resources.

A JSON document that specifies which actions are allowed or denied on which resources, attached to RAM users, groups, or roles.

An identity assumed temporarily by a trusted entity, such as an ECS instance or another account, granting permissions without sharing long-term access keys.

A long-term credential pair of an identifier and secret used by applications and command-line tools to authenticate API requests; it must be stored and rotated securely.

A temporary credential issued by Security Token Service with a limited lifetime and scoped permissions, reducing risk compared with permanent access keys.

A security principle of granting only the permissions needed to perform a task, and no more, to limit the impact of mistakes or compromised credentials.

Requiring two or more independent proofs of identity, such as a password plus a one-time code, before granting access to an account or console.

A protection service that detects and scrubs volumetric and application-layer attack traffic before it reaches your workloads, preserving availability during attacks.

A filter that inspects HTTP and HTTPS requests and blocks malicious patterns such as injection or cross-site scripting before they reach the application.

Protecting stored data by encrypting it on disk so that physical media or unauthorized storage access does not expose readable content.

A managed service for creating, storing, and rotating cryptographic keys and controlling their use, so applications encrypt data without handling raw key material.

Designing a system so that components are redundant and failures are tolerated automatically, keeping the service reachable despite individual component outages.

A plan and set of mechanisms for restoring services after a major failure, characterized by recovery time and recovery point objectives.

A point-in-time copy of a disk or volume used to restore data or create new disks, forming a building block for backup and recovery plans.

Collecting metrics and logs from resources and triggering notifications when thresholds are crossed, so operators detect and respond to problems quickly.

A set of rules inside a VPC that determines where network traffic is directed based on destination IP ranges, including to gateways or peer connections.