VPOL key terms

A logically isolated section of a public cloud where an organization launches resources in a network it defines itself, controlling address ranges, subnets, routing, and gateways.

A contiguous range of IP addresses carved out of a larger network, used to segment workloads by function, zone, or trust level and to control routing boundaries.

A set of rules that determines where network traffic from a subnet or gateway is directed, typically matching destination address ranges to next-hop targets.

A stateful virtual firewall attached to individual resources that permits only explicitly allowed inbound and outbound traffic, evaluated as an allow list rather than a deny list.

A stateless, subnet-level filter with ordered allow and deny rules applied to traffic entering or leaving a subnet, serving as a coarse second layer of network control.

A component that distributes incoming requests across multiple backend targets, improving availability and scalability while optionally performing health checks and TLS termination.

An automated mechanism that adds or removes compute capacity based on demand signals or schedules, maintaining performance during spikes while reducing cost during idle periods.

The ability of a system to acquire and release resources automatically as workload changes, matching capacity to demand closely rather than provisioning for peak permanently.

Increasing capacity by adding more instances of a component rather than making a single instance larger, which usually requires the workload to be stateless or partitioned.

Increasing capacity by giving a single instance more CPU, memory, or storage, which is simpler to implement but bounded by hardware limits and often requires downtime.

A service that keeps no client-specific session data between requests, so any instance can handle any request, simplifying scaling, failover, and rolling deployments.

A storage model that keeps data as discrete objects in flat namespaces, addressed by key and accessed over HTTP APIs, suited to unstructured content and large-scale durability.

Storage presented as fixed-size volumes attached to a compute instance and formatted with a filesystem, offering low-latency random access for databases and operating systems.

A point-in-time copy of a storage volume or database used for backup and restoration, typically stored incrementally and independent of the source resource's lifecycle.

A geographically distributed set of edge servers that caches content close to users to reduce latency and origin load, often paired with TLS and origin shielding.

The time a cached copy remains valid before it must be revalidated or refetched from the origin, balancing freshness of content against origin load and latency.

The delay between a request and the start of a response, influenced by physical distance, network hops, queuing, and processing time, and a primary driver of user experience.

An isolated data center or group of data centers within a region, with independent power and networking, used to spread workloads so a single failure does not cause an outage.

A geographic area containing multiple isolated availability zones, chosen to satisfy latency, residency, and service-availability requirements for a deployment.

The property of a system that continues operating correctly despite the failure of one or more components, usually achieved through redundancy and automatic failover without interruption.

A design goal that minimizes downtime by eliminating single points of failure and enabling rapid recovery, typically expressed as a percentage of uptime per period.

The maximum acceptable amount of data loss measured in time, which sets how frequently backups or replication must occur to meet business continuity requirements.

The maximum acceptable duration to restore a service after a disruption, driving decisions about standby capacity, automation, and runbook maturity.

The set of plans, infrastructure, and procedures for restoring services and data after a major disruption, validated through regular testing rather than assumed to work.

The framework of policies, roles, and identities that determines who or what may perform which actions on which resources, forming the core of cloud access control.

The principle of granting only the permissions required to perform a task, for no longer than necessary, reducing the blast radius of mistakes and compromised credentials.

An access model that assigns permissions to roles and then assigns users or services to those roles, simplifying administration and audit compared with per-user permissions.

An authentication requirement combining two or more independent evidence types, such as a password plus a device-generated code, to reduce risk from stolen credentials.

Protecting stored data by encrypting it on disk or in a storage service, so that physical media theft or unauthorized snapshots do not expose readable content.

Protecting data while it moves between systems using protocols such as TLS, preventing interception or tampering on untrusted networks including the public internet.

A managed service for creating, storing, rotating, and auditing cryptographic keys, allowing encryption to be integrated without building custom key infrastructure.

An append-only record of actions taken in an environment, capturing who did what, when, and from where, used for investigation, compliance evidence, and anomaly detection.

A published set of controls and requirements, such as a security standard or privacy regulation, against which an organization's systems and processes are assessed and documented.

The requirement or practice of keeping data within specified geographic or legal boundaries, influencing region selection, replication design, and vendor due diligence.

A contractual commitment defining expected service levels, such as uptime and response times, along with remedies or credits when those targets are not met.

An internal, measurable target for a reliability or performance metric that operational teams manage against, usually stricter than the externally promised agreement.

The amount of unreliability permitted by an objective over a period, used to balance release velocity against stability work and to trigger reliability investment when exhausted.

Managing infrastructure through versioned machine-readable definition files rather than manual console changes, enabling review, repeatability, and automated provisioning.

A practice in which servers or containers are replaced rather than modified in place, eliminating configuration drift and making deployments predictable and reversible.

A lightweight, isolated runtime package bundling an application with its dependencies, sharing the host kernel and starting quickly compared with full virtual machines.

A control plane that schedules containers across a cluster, restarts failed instances, and manages service discovery, scaling, and rolling updates automatically.

An automated sequence that builds, tests, and deploys changes, giving fast feedback and repeatable releases while reducing manual error and deployment risk.

The ability to understand a system's internal state from its outputs, primarily metrics, logs, and traces, supporting diagnosis of failures that were not anticipated.

A technique that follows a single request across multiple services by propagating a shared identifier, revealing where latency and errors originate in a complex system.

The desensitization that occurs when monitoring generates too many low-value alerts, causing responders to miss or ignore signals that genuinely require action.

A documented procedure describing how to perform a recurring operational task or respond to a specific alert, reducing reliance on individual memory during incidents.

A blameless retrospective after an outage that reconstructs the timeline, identifies contributing causes, and assigns follow-up actions to prevent recurrence.

The division of security duties between a cloud provider and its customer, where the provider secures the underlying platform and the customer secures its own configuration and data.

The full lifetime cost of a solution, including acquisition, migration, operations, staffing, and exit costs, used to compare cloud and on-premises options fairly.

A capacity or spend commitment made in advance for a defined term in exchange for a lower unit price, appropriate for workloads with predictable, steady demand.

The degree to which dependence on proprietary services, formats, or APIs makes migrating away costly, a key risk weighed in architecture and procurement decisions.

The ease with which workloads, data, and configurations can move between environments or providers, supported by open formats, containers, and abstraction layers.

A structured set of design pillars and review questions, covering areas such as reliability, security, cost, and performance, used to evaluate and improve architectures systematically.

Forecasting future resource demand and provisioning to meet it within budget and performance targets, informed by historical trends, growth assumptions, and load testing.

A periodic probe that tests whether a resource is functioning, used by load balancers and orchestrators to route traffic away from unhealthy instances automatically.