AWS Developer key terms

A managed compute service that runs your code in response to events or HTTP requests without you provisioning servers. You pay per invocation and duration, and the service scales capacity automatically.

A ZIP archive that holds libraries, custom runtimes, or shared code that multiple Lambda functions can reference. Layers keep deployment packages small and let you update shared dependencies in one place.

A setting that caps how many concurrent invocations a single function can use and guarantees that capacity is not taken by other functions. It also shelters the rest of the account from that function's spikes.

A fully managed NoSQL database that stores items by primary key and returns results in single-digit milliseconds. Capacity is either provisioned or on-demand, and tables replicate across Availability Zones automatically.

A time-ordered log of item-level changes in a DynamoDB table, retained for 24 hours. Lambda can consume the stream so your application reacts to inserts, updates, and deletes.

A managed message queue that decouples producers from consumers. Standard queues offer at-least-once delivery and high throughput; FIFO queues preserve order with exactly-once processing.

A separate queue where SQS or SNS moves messages that failed repeated processing, so you can inspect or replay them without blocking the main flow. A redrive policy defines the maximum receive count.

The period after a consumer receives an SQS message during which other consumers cannot see it. If the message is not deleted before it expires, it becomes visible again and may be delivered twice.

A managed service for publishing REST, HTTP, and WebSocket APIs. It handles routing, authorization, throttling, usage plans, and stages, and commonly integrates with Lambda or HTTP backends.

A workflow service that coordinates Lambda functions and other AWS calls as a state machine written in JSON (Amazon States Language). It tracks each step, retries failures, and supports long-running processes.

A URL signed with the credentials of the person who generated it, granting temporary permission to perform one specific S3 action, such as a GET or PUT on one object.

The ordered search the AWS SDKs use to find credentials: environment variables, shared config and credentials files, container or EC2 instance roles, and other providers. Knowing the order explains many access-denied and missing-credentials errors.

An identity with permission policies that trusted principals can assume to obtain temporary credentials. Roles are the standard way for EC2, Lambda, and cross-account access to reach AWS services without stored keys.

A JSON document listing statements of Effect, Action, Resource, and optional Condition. Identity-based policies attach to users, groups, or roles; resource-based policies attach to resources such as buckets or queues.

An AWS Security Token Service call that returns a temporary access key, secret key, and session token for an IAM role. It supports cross-account access, MFA requirements, and session tagging.

A managed directory of user accounts that handles sign-up, sign-in, password policies, MFA, and token issuance (ID, access, and refresh tokens). API Gateway and load balancers can validate these tokens directly.

A service that exchanges a login token from a user pool or external provider for temporary AWS credentials tied to an IAM role, giving app users scoped access to services like S3 or DynamoDB.

A managed service for creating and controlling encryption keys. Keys never leave the service; you call KMS to encrypt and decrypt data keys, which is the basis of envelope encryption for S3, EBS, and DynamoDB.

A store for secrets such as database credentials and API keys. It supports automatic rotation via Lambda, fine-grained IAM access, and retrieval through SDK calls at application runtime.

A hierarchical store for configuration data and secrets. Parameters can be plaintext or SecureString, which is encrypted with KMS; it is cheaper than Secrets Manager but has no built-in rotation.

A resource-based JSON policy attached to a bucket that grants or denies access to the bucket and its objects for specified principals, including anonymous users. It is evaluated alongside IAM policies.

An infrastructure-as-code service that creates and updates AWS resources from JSON or YAML templates organized into stacks. It tracks resource state and can roll back a stack when an update fails.

A preview of what a stack update will add, modify, or delete before you execute it. Change sets help catch destructive replacements, such as a resource being recreated after an immutable property change.

The AWS Serverless Application Model: a CloudFormation transform with shorthand resource types for Lambda, API Gateway, and DynamoDB, plus a CLI for building, local testing, and deploying serverless applications.

A platform-as-a-service that deploys and runs applications on EC2 or containers. You upload an application version and pick an environment tier and platform; Beanstalk handles provisioning, scaling, and health checks.

A CI/CD orchestrator that runs stages such as source, build, test, and deploy in a defined order. Each stage contains actions performed by services like CodeCommit, CodeBuild, or CodeDeploy.

A managed build service that runs commands from a buildspec file in a fresh container image and reports artifacts, logs, and test results. Build projects define the environment, compute size, and source.

A deployment service that installs application revisions on EC2 instances, Lambda functions, or ECS services using an AppSpec file and a deployment configuration that controls how traffic shifts.

A rule set describing how a deployment progresses, such as all-at-once, half-at-a-time, canary (for example 10 percent then the rest), or linear (for example 10 percent each minute), plus alarms that can trigger rollback.

A release technique that runs the new version in a separate environment or replacement fleet, shifts traffic to it once healthy, and keeps the old version available for fast rollback.

The monitoring service for metrics, logs, and alarms. AWS services publish metrics automatically, your code can publish custom metrics, and alarms can trigger scaling, notifications, or other automated actions.

A rule that watches one metric against a threshold over a number of periods and changes state between OK, ALARM, and INSUFFICIENT_DATA, optionally invoking actions such as SNS notifications or scaling policies.

A query language and console for searching and aggregating CloudWatch log groups. It supports filters, stats, and parsing commands to find errors and compute latency patterns across large log volumes.

A tracing service that records requests through distributed applications as segments and subsegments. It shows where latency and errors originate across API Gateway, Lambda, and downstream services.

A service that records AWS API activity as events, showing who called which action, from where, and when. Event history covers management events; trails deliver logs to S3 for long-term retention and analysis.

A retry strategy where the wait between attempts grows exponentially and is randomized, so many clients do not retry at the same instant. AWS SDKs apply it automatically for throttling and transient errors.

The DynamoDB error returned when a request exceeds the read or write capacity of a table or index. Clients should retry with backoff; persistent cases call for more capacity, caching, or better key distribution.

The extra latency a Lambda function incurs when a new execution environment is created before your handler runs, including code download and initialization. Provisioned concurrency or smaller packages reduce it.