Alibaba ACA Cloud Computing flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Region vs Zone

A region is a geographic area; zones are isolated datacenters within it connected by low-latency private links. Cross-region traffic does not use those private backbones by default.

Shared Responsibility Model

Alibaba Cloud secures physical facilities, hypervisor, and managed-service infrastructure; customers secure guest OS, applications, data, and identity configuration.

Pay-As-You-Go billing

Billing model charging per second or hour with no upfront commitment, suited to spiky or temporary workloads; unit price is higher than subscription.

Root account limits

The Alibaba Cloud root account holds full privileges and cannot be restricted by RAM policies, so operational work should use RAM users or roles.

ECS instance families

General purpose (g-series) balances CPU and memory; compute optimized (c-series) favors CPU; memory optimized (r-series) favors RAM for caches and databases.

Security group statefulness

Security groups are stateful virtual firewalls on ENIs: return traffic for allowed connections is automatically permitted, and rules are allow-only with default deny inbound.

ECS metadata service

An internal endpoint at 100.100.100.200 that returns instance attributes such as instance ID, region, and attached RAM role credentials to code running on the instance.

Auto Scaling group

A logical group with Min, Max, and Desired capacity plus scaling rules that add or remove ECS instances based on schedules or CloudMonitor metrics.

Stop-and-Resize

Operation that stops an ECS instance to change its instance family or vCPU/memory size; the instance keeps its disks and IP configuration.

OSS storage classes

Standard, Infrequent Access, Archive, and Cold Archive. Colder classes cost less to store but have higher retrieval latency and minimum storage durations.

OSS bucket naming

Bucket names are globally unique across all Alibaba Cloud accounts, must be lowercase, and a bucket is fixed to the region chosen at creation.

OSS multipart upload

Splits a large object into parts uploaded in parallel and then combined, enabling resumable transfers; required above 5 GB and recommended above 100 MB.

OSS signed URL

A time-limited URL generated with a signature that grants temporary access to a private object without exposing credentials or changing bucket ACL.

CDN cache purge

Operation that invalidates cached objects at edge nodes so subsequent requests fetch fresh content from the origin server.

OSS lifecycle rule

Policy that automatically transitions objects between storage classes or deletes them based on object age or creation date.

VPC and VSwitch

A VPC is an isolated network with a user-defined CIDR block; each VSwitch is a subnet bound to exactly one Availability Zone.

VPC peering transitivity

VPC peering connects two VPCs one-to-one and is non-transitive: if A peers with B and B with C, A cannot reach C through B.

Cloud Enterprise Network

CEN connects VPCs and on-premises networks through a central hub with transitive routing, unlike one-to-one VPC peering.

NAT Gateway

Managed service giving private ECS outbound internet access via SNAT and inbound port forwarding via DNAT; it requires an attached EIP.

SLB listener and health check

A listener defines protocol and port on the load balancer; health checks probe backends and stop routing traffic to servers that fail checks.

Elastic IP address

A standalone public IPv4 address that can be detached from one resource and reattached to another without changing the address.

Anti-DDoS Basic

Free DDoS mitigation included with Alibaba Cloud public IPs; larger attacks require Anti-DDoS Pro or Premium scrubbing services.

WAF layer

Web Application Firewall inspects HTTP/HTTPS traffic at layer 7, blocking SQL injection, XSS, and malicious bots in front of SLB, ECS, or CDN.

ActionTrail

Audit service recording API-level operations across the account, capturing who performed an action, when, and from which source IP.

KMS envelope encryption

Key Management Service protects data keys with customer master keys; OSS and ECS disk encryption can use KMS-managed CMKs.

RAM policy structure

JSON document with Effect (Allow or Deny), Action, Resource, and Condition; an explicit Deny always overrides any Allow.

RAM role and STS

A role is assumed by trusted entities to obtain temporary STS credentials with a configurable lifetime, avoiding long-term AccessKey storage.

Instance RAM role

Role attached to an ECS instance so applications fetch temporary STS credentials from the metadata service instead of embedding AccessKeys.

AccessKey rotation

Practice of creating a new AccessKey pair, updating applications, then disabling and deleting the old key; the Secret is shown only at creation.

Qwen model family

Alibaba's large language models covering text, vision-language, and code tasks in multiple parameter sizes, served through Model Studio (DashScope) APIs.

PAI-EAS

Elastic Algorithm Service on Platform for AI deploys trained models as autoscaling HTTP or gRPC inference endpoints, supporting custom containers and built-in formats.

RAG with DashVector

Retrieval-augmented generation pairs Qwen with a vector store such as DashVector to ground answers in private documents and reduce hallucination.