AWS Certified Cloud Practitioner (CRI series) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

AWS Shared Responsibility Model

AWS secures the cloud itself: facilities, hardware, and hypervisor. Customers secure what runs in the cloud: data, identities, guest operating systems, and application patching.

Availability Zone

One or more discrete data centers within a Region, each with independent power, cooling, and networking, connected to other zones by low-latency links for high availability.

AWS Region

A geographic area containing multiple isolated Availability Zones. Choosing a Region is driven by latency, compliance and data residency, service availability, and pricing.

IaaS versus PaaS versus SaaS

IaaS gives raw compute, storage, and network control. PaaS adds managed runtimes so you deploy code only. SaaS delivers a finished application. Customer control decreases in that order.

Elasticity

The ability to acquire resources as demand grows and release them when demand falls, matching capacity to workload automatically instead of provisioning for peak.

Cloud Migration: Rehost

Lift-and-shift migration that moves an application to AWS with minimal changes. It is fast and low effort but does not exploit cloud-native features.

Well-Architected Framework Pillars

Six pillars guide architecture reviews: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. AWS provides a review tool for each.

AWS Global Infrastructure

Regions contain Availability Zones; edge locations and Regional edge caches sit closer to end users and serve CloudFront and Route 53 traffic rather than general compute.

IAM Policy Evaluation Logic

An explicit deny always wins. Otherwise an explicit allow must exist. Absent any allow, the request is implicitly denied. Permissions boundaries and SCPs cap maximum permissions.

IAM Role

An identity with no long-term credentials that trusted entities assume to receive temporary security credentials. Used for EC2, Lambda, cross-account access, and federation.

Security Group versus Network ACL

Security groups are stateful, allow-only rules attached to instances. Network ACLs are stateless allow-and-deny rules attached to subnets and evaluate traffic in both directions.

AWS CloudTrail

A service that records API calls made in an account, capturing who made the request, when, and from which source, supporting auditing and security investigation.

AWS Artifact

A self-service portal providing AWS compliance reports, such as SOC and ISO attestations, plus online agreements, used to satisfy customer audit evidence requirements.

AWS KMS

A managed service for creating and controlling encryption keys. Key policies define access, customer managed keys can be rotated, and integrated services encrypt data at rest.

Principle of Least Privilege

Granting identities only the permissions required for their tasks. IAM Access Analyzer, credential reports, and last-accessed information help identify and remove excess permissions.

Amazon GuardDuty

A managed threat detection service that continuously analyzes account, network, and DNS activity using threat intelligence and machine learning to surface suspicious behavior.

Multi-Factor Authentication

Requiring a second verification factor beyond a password at sign-in. AWS supports virtual and hardware MFA devices and recommends MFA for privileged and root accounts.

Amazon EC2 Spot Instances

Unused EC2 capacity offered at steep discounts, up to roughly ninety percent off On-Demand. Capacity can be reclaimed with short notice, so workloads must tolerate interruption.

Amazon S3 Durability

S3 Standard is designed for 99.999999999 percent durability, eleven nines, by storing objects redundantly across at least three Availability Zones within a Region.

AWS Lambda

A serverless compute service that runs code in response to events, scales automatically, and bills per request and per gigabyte-second of execution with no server management.

Amazon VPC

A logically isolated virtual network in AWS where you define IP ranges, subnets, route tables, gateways, and security controls for your resources.

Application Load Balancer

A layer 7 load balancer that routes HTTP and HTTPS traffic using content-based rules such as path and host, and supports targets including instances, containers, and Lambda.

Amazon Route 53

A highly available DNS web service offering routing policies including simple, weighted, latency-based, failover, geolocation, and multivalue answer for traffic management.

Amazon RDS

A managed relational database service supporting engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server, handling backups, patching, and Multi-AZ failover.

Amazon DynamoDB

A fully managed serverless NoSQL key-value and document database delivering consistent single-digit millisecond latency at any scale, with no servers to provision.

Amazon CloudFront

A global content delivery network that caches content at edge locations near users, reducing latency and offloading origin servers such as S3 buckets or web servers.

AWS Pricing Fundamentals

Three drivers: pay-as-you-go with no upfront commitment, lower cost when committing to Reserved Instances or Savings Plans, and volume discounts as usage grows.

AWS Free Tier

Three offer types: always-free allowances, twelve-month free usage after account creation, and short-term trials. Exceeding allowances bills at standard rates.

Consolidated Billing

An AWS Organizations feature combining member account charges into one bill, aggregating usage for volume discounts, and simplifying payment and cost visibility.

AWS Budgets

A tool for setting custom cost, usage, or reservation thresholds that trigger alerts, helping teams detect and respond to spending before it exceeds targets.

AWS Support Plan Tiers

Basic is free with no technical support. Developer adds business-hours email. Business adds twenty-four seven contact and full Trusted Advisor. Enterprise adds a technical account manager.

AWS Trusted Advisor

An advisory service that inspects cost optimization, performance, security, fault tolerance, and service quotas, producing recommendations. Full checks require Business or Enterprise support.