AWS Certified Cloud Practitioner key terms

A set of design principles and best-practice pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability) used to evaluate architectures and identify improvement areas. The Well-Architected Tool records reviews against these pillars.

Guidance that organizes cloud transformation into perspectives such as business, people, governance, platform, security, and operations, helping organizations plan migration and skills change. It focuses on organizational capability rather than individual service configuration.

The ability to acquire resources as demand rises and release them when demand falls, often automatically. It lets workloads match capacity to load instead of provisioning for peak, which reduces both idle spend and performance shortfalls.

The ability of a system to handle growth by adding capacity, either vertically (larger instances) or horizontally (more instances). Horizontal scaling usually pairs with stateless design and load balancing to distribute traffic across many nodes.

The property of a system that continues operating correctly when a component fails, typically by using redundant resources and automatic failover. It differs from high availability in that some degradation may be acceptable as long as service continues.

A design goal of minimizing downtime by removing single points of failure and spreading resources across isolated locations. It is usually measured as a percentage of uptime and supported by health checks, replication, and automated recovery.

The Well-Architected pillar concerned with running and monitoring systems to deliver business value, and with continually improving processes and procedures. It covers automation, small reversible changes, and learning from operational events.

The full cost of owning a solution over time, including hardware, facilities, power, licensing, staffing, and maintenance, not just purchase price. Comparing on-premises TCO with cloud spend is a common business case for migration.

Capital expenditure is upfront investment in long-lived assets such as servers; operating expenditure is ongoing pay-as-you-go cost. Cloud computing shifts most infrastructure spending from CapEx to OpEx, which affects budgeting and cash flow.

The service for creating users, groups, roles, and policies that control which principals may perform which actions on which resources. Policies are JSON documents evaluated to allow or deny requests.

A JSON document that specifies Effect, Action, Resource, and optional Condition elements describing permissions. Identity-based policies attach to principals; resource-based policies attach to resources such as buckets or queues.

An identity with permission policies that can be assumed temporarily by trusted principals, such as EC2 instances, Lambda functions, or users in another account. It issues temporary credentials, avoiding long-term access keys.

The practice of granting only the permissions required to perform a task, and no more. It limits blast radius if credentials are compromised and is implemented through narrow policies, scoped roles, and periodic access review.

An authentication control requiring a second proof of identity beyond a password, such as a time-based code or hardware key. AWS supports MFA for root and IAM users and can enforce it through policy conditions.

The identity created with an AWS account that has full access to all resources and billing. Best practice is to secure it with MFA, avoid daily use, and create IAM users or roles for routine administrative work.

A managed service for creating and controlling cryptographic keys used to encrypt data across AWS services. It provides key policies, automatic rotation options, and audit trails through integration with CloudTrail.

Protecting stored data so it cannot be read without the correct key, for example encrypting EBS volumes, S3 objects, or database storage. It complements encryption in transit, which protects data moving across networks.

Protecting data while it moves between systems, typically with TLS. Services such as load balancers, API endpoints, and database connections support TLS so credentials and payloads are not readable on the wire.

A service that records API activity in an account, showing who made a request, from where, and when. Event history and trails support security investigation, compliance auditing, and change tracking.

A service that records resource configuration changes and evaluates them against rules, helping assess compliance over time. It answers questions about how a resource was configured at a point in time and whether it drifted.

The division of security duties between AWS and the customer. AWS secures the cloud itself (facilities, hardware, managed service infrastructure), while customers secure what they put in the cloud, such as data, identities, and configurations.

A self-service portal providing on-demand access to AWS compliance reports and agreements, such as audit attestations and security certifications. Teams use it to collect evidence for their own audits without filing support requests.

A service providing resizable virtual servers in the cloud. You choose an instance type, machine image, network placement, and storage, and you pay for running capacity by the second or hour depending on the pricing model.

A template containing an operating system, configuration, and optional software used to launch EC2 instances. AMIs can be copied across Regions and shared, enabling consistent and repeatable instance deployment.

A stateful virtual firewall attached to network interfaces that permits inbound and outbound traffic by rule. Because it is stateful, return traffic for an allowed connection is automatically permitted without an extra rule.

A stateless subnet-level filter that evaluates ordered allow and deny rules separately for inbound and outbound traffic. Unlike security groups, it can explicitly deny traffic and requires rules for both directions of a connection.

A logically isolated virtual network where you define IP address ranges, subnets, route tables, and gateways. It provides control over network topology and connectivity to on-premises networks or the internet.

A range of IP addresses within a VPC tied to a single Availability Zone. Public subnets route to an internet gateway; private subnets typically reach the internet through a NAT device or use endpoints.

A horizontally scaled, redundant VPC component that allows communication between resources in a VPC and the internet. It requires route table entries and public IP addresses or elastic IPs on the communicating resources.

Object storage offering high durability and virtually unlimited capacity, organized into buckets and objects with keys. Common uses include backups, static website content, data lakes, and application assets.

A tier defining how objects are stored and priced, such as frequently accessed, infrequent access, or archive tiers. Choosing a class based on access frequency and retrieval tolerance is a primary cost lever.

Archive storage options designed for long-term retention at low cost, with retrieval times ranging from minutes to hours depending on tier. They suit compliance archives and rarely accessed backups.

A managed relational database service that handles provisioning, patching, backups, and failover for engines such as MySQL, PostgreSQL, and SQL Server. Multi-AZ deployments provide standby replicas for availability.

A configuration that keeps a synchronous standby copy of a database in a different Availability Zone and fails over automatically. It improves availability rather than read scaling, which is instead served by read replicas.

A fully managed NoSQL key-value and document database with single-digit millisecond performance at scale. Tables are partitioned automatically, and capacity is provisioned or handled on demand.

A serverless compute service that runs code in response to events and manages scaling automatically. You pay for invocation count and execution duration, and no servers are provisioned or patched by the customer.

An operating model where the provider handles server provisioning and scaling, and billing follows actual usage. It reduces operational overhead but imposes design constraints such as statelessness and execution time limits.

One or more discrete data centers with independent power and networking inside a Region. Deploying across multiple zones protects workloads from a single facility failure and supports high availability designs.

A geographic area containing multiple isolated Availability Zones. Choosing a Region considers latency to users, service availability, data residency requirements, and price differences between locations.

A content delivery network that caches content at edge locations close to viewers to reduce latency. It integrates with S3 and load balancers as origins and supports signed URLs and TLS.

A managed service that distributes incoming traffic across multiple targets such as instances, containers, or addresses. Health checks remove unhealthy targets, and it supports application and network layer balancing.

A capability that adjusts the number of running resources based on demand or schedules. It maintains a desired count, replaces unhealthy instances, and helps balance performance needs against cost.

A monitoring service collecting metrics, logs, and events from AWS resources and applications. Alarms can trigger notifications or automated actions when thresholds are crossed.

A billing model where charges accrue only for resources consumed, without upfront commitment. It removes the need to forecast capacity purchases and pairs with commitments like Savings Plans for discounts.

A flexible pricing model offering lower rates in exchange for a committed hourly spend over one or three years. Compute Savings Plans apply across instance families and Regions, unlike reserved capacity tied to a specific configuration.

A purchasing option giving a discount on EC2 capacity in exchange for a one- or three-year term. Standard reservations offer the largest discount but are tied to attributes such as instance family and Region.

Unused EC2 capacity offered at steep discounts, interruptible with short notice when capacity is reclaimed. It suits fault-tolerant, flexible workloads such as batch processing and containerized jobs.

A set of usage allowances available to new and existing accounts, including always-free limits and time-limited introductory amounts. Exceeding allowances results in standard charges, so usage monitoring matters.

A tool for setting spending, usage, or reservation targets and receiving alerts when actual or forecast values exceed them. It can also trigger actions, helping prevent unexpected overruns.

A console tool for visualizing and analyzing historical cost and usage, with filtering and forecasting. It helps identify spending trends and supports rightsizing and service-level cost review.

A key-value metadata label applied to resources and activated for billing so costs can be grouped by team, project, or environment. Consistent tagging is a prerequisite for meaningful cost accountability.

A web tool for estimating the monthly cost of an architecture by selecting services, Regions, and usage assumptions before deployment. Estimates can be shared and used to compare design options.

A tiered subscription defining response times, channels, and advisory services, ranging from basic to developer, business, and enterprise levels. Higher tiers add technical account management and faster critical response.

An advisory service that inspects an account and flags opportunities across cost optimization, security, fault tolerance, performance, and service limits. The depth of checks available depends on the support plan.

Account-level limits on resource counts and request rates for AWS services. Monitoring quota usage and requesting increases prevents throttling or deployment failures as workloads grow.