AWS Cloud Practitioner key terms

A separate geographic area, such as us-east-1, that contains multiple isolated data centers. Customers pick regions to place workloads near users, satisfy data-residency rules, and improve resilience.

One or more discrete data centers within a region, with independent power, cooling, and networking. Zones are physically separated but linked by low-latency connections so you can design for failure.

The ability to add capacity automatically when demand rises and remove it when demand falls, so the workload keeps pace with traffic and you pay only for what is used.

Designing a system to keep running with minimal downtime when a component fails, usually by running redundant copies across separate Availability Zones and routing traffic away from failures.

A set of design pillars - operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability - used to review workloads. The Well-Architected Tool runs these reviews at no charge.

A logically isolated virtual network you define with IP ranges, subnets, route tables, and gateways. It controls how your AWS resources communicate with each other and with the internet.

A service that provides resizable virtual servers in the cloud. You choose processor, memory, storage, and networking, and pay per second or hour depending on the purchase option selected.

A template containing an operating system and preinstalled software used to launch EC2 instances. Images can be copied between regions and shared with other accounts.

A service that adds or removes capacity automatically based on demand or a schedule. It keeps performance steady during spikes and shrinks resources during quiet periods to limit spend.

A managed service that spreads incoming traffic across multiple targets in one or more Availability Zones, health-checks them, and stops sending requests to targets that fail.

A serverless compute service that runs your code in response to events, scales automatically with load, and bills only for the time and memory each request consumes.

Object storage that keeps files as objects inside buckets, with very high durability, versioning, access controls, and lifecycle rules that move data between cost tiers automatically.

A managed relational database service for engines such as MySQL, PostgreSQL, and SQL Server. AWS handles provisioning, backups, patching, and Multi-AZ failover so you focus on data and schema.

A managed NoSQL key-value and document database that handles very high request rates at single-digit millisecond latency and requires no server provisioning or patching.

A content delivery network that caches content at worldwide edge sites, cutting latency for users and reducing load on origins such as S3 buckets or load balancers.

A highly available DNS service that resolves domain names to addresses, supports routing policies such as latency, geolocation, and failover, and also handles domain registration.

A managed message queue that decouples producers from consumers, storing messages durably until they are processed, with standard and first-in-first-out queue options.

A monitoring service that collects metrics, logs, and events from AWS resources and applications, displays dashboards, raises alarms, and can trigger automated responses.

A small AWS site outside the main regions used to cache content and terminate connections closer to end users, reducing round-trip time for global audiences.

The division of duties between AWS and the customer: AWS secures the cloud itself, including facilities, hardware, and the hypervisor, while customers secure what they place in it, such as data, identities, and configuration.

The identity created with an AWS account that has unrestricted access to every resource and billing detail. Best practice is to protect it with multi-factor authentication and avoid daily use.

An identity inside an AWS account with long-term credentials that represents a person or application. Users receive permissions only through the policies attached to them or their groups.

An identity that hands temporary credentials to whoever assumes it, including people, applications, or AWS services. Roles avoid stored long-term keys and are the preferred way to delegate access.

A JSON document stating which actions are allowed or denied on which resources and under what conditions. Policies are attached to users, groups, roles, or resources.

Requiring a second proof of identity, such as a code from a hardware key or authenticator app, alongside a password, so stolen credentials alone cannot grant access.

A stateful virtual firewall attached to resources such as EC2 instances that allows only the inbound and outbound traffic its rules permit. Response traffic is automatically allowed back out.

A stateless firewall at the subnet boundary that evaluates numbered allow and deny rules in order, separately for inbound and outbound traffic, filtering whole subnets at once.

A web application firewall that inspects HTTP requests and allows or blocks them using rules based on IP addresses, headers, request rates, and known attack patterns like SQL injection.

A managed service defending workloads against distributed denial-of-service attacks. The Standard tier is automatic and free; Advanced adds deeper detection, response experts, and cost protection.

A managed service for creating and controlling encryption keys used across AWS services. Access to each key is governed by identity policies and key policies you define.

A service that records API activity in an account, capturing who made each call, when, and from where, then delivering logs for auditing, investigation, and troubleshooting.

A service for grouping many AWS accounts into a hierarchy, applying service control policies as guardrails, and combining charges under a single paying account.

The complete cost of running a system, including hardware, facilities, power, staffing, and maintenance. Comparing on-premises totals with cloud pricing supports migration and budgeting decisions.

A commitment to a specific instance family in one region for a one- or three-year term in exchange for a substantial discount, available in standard or convertible varieties.

Spare compute capacity sold at steep discounts that can be reclaimed with short notice when demand returns, making it suitable for flexible, interruption-tolerant batch workloads.

A commitment to a fixed hourly spend for one or three years in return for lower compute prices, applied automatically to eligible usage across instance families and regions.

Published allowances, some always available and some limited to the first twelve months, that let new customers experiment with services such as EC2, S3, and Lambda at no charge.

An AWS Organizations feature that gathers charges from many member accounts into one bill, aggregates usage toward volume discounts, and lets the payer account review every charge.

An online tool that inspects an account against best practices for cost, security, fault tolerance, performance, and service limits, listing findings by severity with recommended fixes.

Tiered support offerings from Basic through Developer, Business, and Enterprise levels, differing in response-time targets, contact channels, and access to technical account managers and proactive guidance.