AWS Certified Cloud Practitioner (CRI series) key terms

A separate geographic area where a provider clusters data centers, letting customers place workloads close to users while meeting latency, residency, and availability requirements.

One or more isolated data centers within a region, with independent power and networking, so a failure in one zone does not take down the others.

A small site closer to end users than a region, used to cache content and terminate connections so responses arrive with lower latency.

The ability to add capacity automatically when demand rises and remove it when demand falls, so cost tracks actual usage rather than peak forecasts.

A design property where a system keeps operating correctly even when a component fails, usually by duplicating resources across independent failure domains.

Designing a system to remain accessible for a large majority of the time by removing single points of failure and adding redundancy and health checks.

The division of duties where the provider secures the underlying facilities, hardware, and managed service layers, while the customer secures data, identities, and configuration choices.

The service and practice of defining users, groups, and roles and attaching policies that state which actions are allowed on which resources.

Granting only the permissions needed to perform a task, and no more, to limit the damage from mistakes or compromised credentials.

An identity with permissions that trusted principals can temporarily assume, avoiding long-lived keys embedded in code or on servers.

A structured document that explicitly allows or denies actions on specified resources, evaluated together with other applicable policies to reach a decision.

Trusting an external identity provider so users sign in with existing corporate or social credentials and receive temporary access instead of separate accounts.

Requiring a second proof of identity, such as a one-time code or hardware token, in addition to a password, so stolen passwords alone are insufficient.

Protecting stored data by converting it to unreadable form with keys, so copies of disks or backups are useless without authorized key access.

Protecting data while it moves between systems using protocols such as TLS, preventing eavesdropping or tampering on the network path.

A managed service for creating, storing, rotating, and auditing cryptographic keys, integrated with storage and database services so encryption is simple to enable.

A chronological record of who did what and when across an account, used for investigations, compliance evidence, and detecting unusual activity.

Meeting external laws, regulations, and industry standards, often demonstrated through certifications, reports, and configuration controls the provider and customer jointly maintain.

A logically isolated network you define, with your own address ranges, subnets, routing, and gateways, controlling how resources communicate internally and externally.

A range of addresses within a virtual network, placed in one availability zone, used to separate public-facing resources from private ones.

A stateful virtual firewall attached to individual resources that permits only explicitly allowed inbound and outbound traffic.

A stateless firewall applied at the subnet boundary, with ordered allow and deny rules evaluated for traffic entering or leaving that subnet.

A set of rules that decides where network traffic from a subnet is sent, such as to a local network, an internet gateway, or a private connection.

A service that spreads incoming requests across multiple healthy targets, improving responsiveness and keeping applications available when individual targets fail.

Automatically adjusting the number of running instances based on demand metrics or schedules, maintaining performance while avoiding idle capacity.

Storing data as discrete objects in buckets, each with a key and metadata, ideal for files, backups, and static assets accessed over HTTP APIs.

A tier of storage balancing price against retrieval speed and access frequency, so rarely read data can cost far less than frequently read data.

Rules that automatically transition objects to cheaper storage tiers or delete them after a set period, reducing manual cleanup and ongoing cost.

A network of edge caches that serves content from a location near each user, cutting latency and reducing load on origin servers.

A managed database engine using tables, schemas, and SQL joins, suited to transactional workloads that need strong consistency and structured queries.

A provider-operated offering where patching, backups, and infrastructure maintenance are handled for you, leaving you responsible mainly for configuration and data.

A model where you deploy code or configuration without provisioning servers, and the provider scales and bills based on actual requests or execution time.

A pricing model charging only for resources consumed, with no upfront commitment, making it easy to start small but potentially costlier at steady scale.

A commitment to use a resource for a term of one or more years in exchange for a discounted rate, best for predictable, long-running workloads.

A flexible spending commitment that discounts eligible compute usage across services and regions, trading a term commitment for lower hourly rates.

The full lifetime cost of a solution, including hardware, facilities, staffing, licensing, and downtime, used to compare on-premises and cloud approaches fairly.

A key-value label attached to resources so spending can be grouped and reported by team, project, or environment for accountability.

A configured threshold that notifies owners when forecast or actual spending approaches a limit, enabling early corrective action.

A purchased tier of technical assistance defining response times, channels, and access to advisory resources such as architecture guidance or a technical account manager.