AWS DevOps Engineer Professional key terms

A managed continuous delivery service that models release work as ordered stages containing actions, and moves artifacts between stages whenever a prior stage succeeds or a manual approval is granted.

A managed build service that runs commands from a buildspec file inside a fresh container image, producing artifacts and logs while scaling capacity on demand per build.

A deployment service that installs application revisions onto EC2 instances, on-premises servers, Lambda functions, or ECS tasks, following a named deployment configuration that controls how traffic shifts.

A build specification file placed in the source repository that declares CodeBuild phases, commands, environment variables, artifacts, and reports for a build project.

A deployment manifest used by CodeDeploy that names the files to copy, lifecycle hook scripts to run, and, for Lambda or ECS targets, the traffic routing and hooks to execute.

A CodeDeploy setting that defines the pace of a rollout, such as how many instances or what percentage of traffic is updated at once and how failures trigger rollback.

A release technique that stands up a full replacement environment or task set, shifts traffic to it once healthy, and keeps the old version available for fast rollback.

A gradual release pattern that sends a small slice of traffic to a new version first, watches error and latency signals, then expands traffic only if results stay acceptable.

The act of returning an application to a previously known-good revision, triggered automatically by failed health checks or alarms, or manually by an operator.

The S3 bucket where CodePipeline keeps intermediate and output artifacts, encrypted with a customer key, so stages can pass revisions to one another.

A pipeline design where stages run in different AWS accounts, requiring shared artifact buckets, KMS key policies, and IAM roles that trust the pipeline account.

An infrastructure-as-code service that provisions resources from declarative templates, tracks them as a stack, and reconciles drift or updates through change sets.

A CloudFormation preview that lists exactly which resources will be added, modified, or deleted before an update is executed, allowing review before impact.

The condition where live resource configuration no longer matches the deployed template, detected by CloudFormation drift detection and reported per resource.

A CloudFormation stack created as a resource inside another stack, used to break large templates into reusable, separately managed components.

A CloudFormation feature that deploys one template to many accounts and Regions from a central administrator account, with optional automatic deployment to new accounts.

A hierarchical store for configuration data and secrets that supports versioning, encryption with KMS, and controlled access, commonly referenced from templates and build jobs.

A secrets service that stores credentials, encrypts them with KMS, and can rotate them automatically by invoking a Lambda rotation function on a schedule.

A practice where servers or containers are replaced rather than patched in place, so every change produces a new, versioned image that can be tested and rolled back.

A service that builds, tests, and distributes hardened machine images on a schedule through recipes and pipelines, producing versioned AMIs.

An IAM role assumed by an AWS service, such as CodePipeline or CloudFormation, whose trust policy names that service and whose permissions bound what the service can do.

The resource-based policy that determines which principals may use or administer a customer managed key, and which must allow cross-account access for encrypted artifacts.

Running resources in more than one Availability Zone within a Region so a single zone failure does not take the workload offline, typical for RDS and load-balanced fleets.

A group that maintains a desired count of instances across zones, replaces unhealthy members using health checks, and scales capacity from policies or schedules.

A feature that pauses an Auto Scaling instance launch or termination so custom actions, such as draining connections or copying logs, can run before the transition completes.

An asynchronous copy of a database that serves read traffic and can be promoted to primary during failover or load growth, reducing pressure on the writer.

A DNS policy that answers with a primary record while its health check passes and switches to a secondary record when the primary is deemed unhealthy.

A probe, either active like a Route 53 or load balancer check or passive like error-rate alarms, that determines whether an endpoint should receive traffic.

A rule that watches a metric or expression against a threshold over periods and changes state, optionally invoking actions such as scaling, notifications, or rollback.

A CloudWatch alarm whose state is computed from the states of other alarms using Boolean rules, reducing noise from many low-level metric alarms.

A pattern applied to log events that increments a custom metric when matches occur, letting you alarm on error strings that are not native metrics.

A service that records API activity as events, delivered to S3 and optionally CloudWatch Logs, providing the audit trail for who changed what and when.

A managed or custom evaluation that checks resource configuration against a desired state and flags noncompliant resources, optionally triggering remediation.

Runbooks that execute a defined sequence of steps on AWS resources, often used to remediate findings automatically or to perform controlled operational tasks at scale.

A documented, repeatable procedure describing detection signals, triage steps, escalation paths, and recovery actions for a specific failure scenario.

A blameless analysis after an incident that records the timeline, contributing factors, and follow-up actions to prevent recurrence and shorten future detection.

A pattern that matches incoming events, such as state changes or scheduled ticks, and routes them to targets like Lambda, SNS, or Systems Manager for automated response.

A tracing service that follows requests across services, building a service map and segment timelines so latency and downstream errors can be attributed to a component.

Granting only the permissions required for a task, scoped by resource ARN and condition keys, and reviewed regularly so unused access is removed.

An IAM managed policy that caps the maximum permissions an identity-based policy can grant, without granting anything on its own.