AWS CloudOps Engineer (SOA-C03) key terms

A CloudWatch feature that watches a single metric against a threshold for a set number of periods and then changes state, optionally triggering SNS notifications, Auto Scaling actions, or EC2 recovery.

A time-ordered set of data points published to CloudWatch, such as CPU utilization or request count, that can be graphed, alarmed on, or used in dashboards.

An interactive query language and console for searching and analyzing CloudWatch Logs groups, letting you filter, aggregate, and visualize log events without exporting them elsewhere.

A pattern applied to a log group that counts or extracts values from matching log events and publishes them as custom CloudWatch metrics, enabling alarms on log content.

A configuration that streams matching log events from a log group to a destination such as Kinesis Data Streams, Firehose, or Lambda for real-time processing or archival.

A service that records API activity in an account as events, showing who made a request, from where, and when, and delivering those events to S3, CloudWatch Logs, or EventBridge.

A trail created in the management account of an AWS Organization that logs events for all member accounts into a shared destination bucket, simplifying centralized auditing.

A managed or custom check that evaluates whether a resource configuration complies with a desired state and reports resources as compliant or noncompliant, optionally with automatic remediation.

A Config resource that collects configuration and compliance data from multiple accounts and Regions into one place so you can view aggregated compliance status.

A rule that matches incoming events, such as AWS service state changes or a schedule, and routes them to targets like Lambda, SQS, or SSM Automation for automated response.

A pub/sub messaging channel to which publishers send messages and from which subscribers such as email, SQS queues, Lambda, or HTTPS endpoints receive them.

A CloudWatch alarm action that recovers an impaired EC2 instance by moving it to new hardware while keeping its instance ID, private IP, and attached resources.

An architecture that runs resources in at least two Availability Zones so the workload keeps serving traffic if one zone or data center fails.

An asynchronous copy of a database that serves read traffic and can be promoted to a standalone primary, reducing load on the primary and improving read scalability.

Recovery point objective is the maximum acceptable amount of data loss measured in time; recovery time objective is the maximum acceptable downtime before service is restored.

A policy that defines which resources to back up, how often, how long to retain recovery points, and where to copy them, applied across accounts via backup policies.

An S3 feature that asynchronously copies objects to a bucket in a different Region, supporting compliance, latency reduction, and disaster recovery.

A bucket setting that keeps multiple variants of an object so earlier versions can be restored after overwrites or deletions, and that is required for replication.

A service that continuously replicates on-premises or cloud servers to AWS and launches them as EC2 instances during a drill or actual failover.

A collection of AWS resources created and managed as a single unit from a template, so updates and deletions are applied consistently to the whole group.

A preview of the resource changes CloudFormation will make when a stack is updated, letting you review impact before executing the update.

The condition where actual resource configuration differs from what the stack template defines, usually because someone changed resources outside CloudFormation.

A feature that deploys the same template to stacks across multiple accounts and Regions from one administrator account, useful for organization-wide baselines.

A set of tagged EC2 instances, Lambda functions, or ECS services that CodeDeploy targets for a deployment, along with the deployment configuration and alarms to use.

A release technique that runs the new version alongside the old one and shifts traffic over once verified, allowing fast rollback by shifting traffic back.

A continuous delivery service that models release process stages such as source, build, test, and deploy, and runs them automatically when changes occur.

A managed build environment definition that specifies the build image, commands, and artifacts used to compile and test code in a pipeline.

A Systems Manager document that defines a series of steps to perform on managed instances or AWS resources, often triggered by EventBridge or Config for remediation.

A Systems Manager capability that provides shell access to instances through the Systems Manager service without opening inbound ports or managing bastion hosts.

An identity with permission policies that can be assumed temporarily by users, applications, or AWS services, granting credentials without long-term access keys.

A container for an IAM role that lets an EC2 instance obtain temporary credentials from the instance metadata service and call AWS APIs.

A service control policy attached at an AWS Organizations level that sets the maximum permissions for member accounts, filtering what IAM policies can allow.

A service for centrally managing multiple AWS accounts, grouping them into organizational units, applying policies, and consolidating billing.

A resource policy on a KMS key that defines which principals may use or administer the key, and it is required for any access to be granted.

A resource-based JSON policy attached to an S3 bucket that grants or denies access to the bucket and its objects for specified principals.

A set of account-level and bucket-level settings that override policies and ACLs to prevent S3 buckets and objects from being made public.

A Route 53 feature that monitors an endpoint's availability and, when combined with failover routing, redirects traffic away from unhealthy resources.

A routing policy that sends traffic to a primary record while it is healthy and automatically switches to a secondary record when the health check fails.

A routing policy that distributes traffic across multiple records according to assigned weights, commonly used for gradual traffic shifting and blue/green releases.

A private entry point that connects a VPC to supported AWS services without traversing the public internet, available as gateway or interface endpoints.

A stateful virtual firewall attached to resources that controls allowed inbound and outbound traffic by protocol, port, and source or destination.

A feature that captures metadata about IP traffic going to and from network interfaces in a VPC and publishes it to CloudWatch Logs or S3.

A commitment to a consistent amount of compute usage per hour for one or three years in exchange for lower prices, applying automatically across eligible services.

A discounted capacity reservation for a specific instance family in a Region for one or three years, with standard or convertible flexibility options.

Spare EC2 capacity offered at steep discounts that can be interrupted with short notice, suited to fault-tolerant, flexible batch and stateless workloads.

A group that maintains a desired number of EC2 instances, replaces unhealthy ones, and scales capacity in or out based on policies or schedules.

A service that analyzes resource utilization and configuration to recommend right-sizing for EC2 instances, EBS volumes, Lambda functions, and Auto Scaling groups.

A set of rules that automatically transitions objects to cheaper storage classes or deletes them after defined periods, reducing storage cost.

A storage class that automatically moves objects between access tiers based on observed usage patterns, avoiding retrieval fees while optimizing cost.