AWS SAP Specialty key terms

A service for centrally managing many AWS accounts, grouping them into organizational units, applying service control policies, and consolidating billing so governance is enforced once rather than per account.

A policy attached within AWS Organizations that sets the maximum permissions available to accounts or organizational units, filtering what identity policies may grant but never granting access on its own.

A logical grouping of AWS accounts inside AWS Organizations, used to apply service control policies and delegate administration to many accounts that share the same governance requirements.

A feature of AWS Organizations that combines usage from member accounts into one bill, aggregating volume to reach lower pricing tiers and sharing reserved capacity and savings plans across accounts.

A managed policy that sets the maximum permissions an identity-based policy can grant to an IAM principal, useful for safely delegating role creation without allowing privilege escalation.

A pattern where a principal in one account calls AWS Security Token Service to obtain temporary credentials for a role in another account, enabling access without sharing long-term keys.

A resource-based policy on an IAM role that declares which principals may assume it and under what conditions, such as requiring an external ID or a specific source account.

A flaw where a trusted service is tricked into acting on a resource using its own authority for the wrong customer; mitigated with external IDs or source-account conditions in trust policies.

A service for sharing subnets, transit gateways, route tables, license configurations, and other resources with other accounts or organizational units, avoiding duplicated infrastructure across accounts.

A regional network hub that connects many VPCs, VPNs, and on-premises links through a single attachment model, replacing complex full-mesh peering with centralized, policy-controlled routing.

A one-to-one network connection between two VPCs that routes traffic privately using their address ranges; it is non-transitive, so each pair of VPCs needs its own connection.

A globally available construct that lets one or more private virtual interfaces on Direct Connect reach many VPCs in different regions without establishing separate physical connections for each.

An operating model that separates workloads, environments, and teams into distinct AWS accounts to create strong security and billing boundaries while centralizing governance through Organizations.

A service that provisions and governs a multi-account landing zone using blueprints, guardrails, and a dashboard, automating account creation and policy enforcement aligned with best practices.

A set of design guidance organized into pillars such as operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability, used to review and improve workloads.

One or more discrete data centers with independent power and networking inside a region; deploying across multiple zones lets a workload tolerate the failure of a single zone.

Running redundant resources in separate availability zones, often with synchronous replication and automatic failover, so the workload keeps serving traffic when one zone fails.

A planned approach to restoring service after a large failure, ranked by recovery time and cost as backup and restore, pilot light, warm standby, or multi-site active-active.

The maximum acceptable duration that a workload may be unavailable after a disruption; it drives how much standby capacity and automation the recovery design must include.

The maximum acceptable amount of data loss measured in time before a disruption; it determines backup frequency, replication lag tolerance, and whether synchronous replication is required.

Separating application components so they communicate asynchronously through queues, topics, or event buses, reducing cascading failures and letting each part scale and fail independently.

A managed message queue service that buffers work between producers and consumers, supporting standard queues with at-least-once delivery and FIFO queues with ordered, exactly-once processing.

A separate queue that receives messages a consumer repeatedly fails to process, isolating poison messages so they can be inspected without blocking the main workflow.

A design where producers publish events and consumers react without direct calls, enabling loose coupling, independent scaling, and easy addition of new downstream processing.

A tier that trades retrieval speed and availability for cost, ranging from frequently accessed standard tiers through infrequent-access, archive, and deep-archive options with retrieval fees.

A rule set that automatically transitions objects between storage classes, expires versions, or deletes them after defined ages, controlling cost without manual intervention.

A flexible pricing commitment that offers lower rates in exchange for a consistent hourly spend, applying automatically across eligible compute and other usage regardless of instance family or region.

A capacity reservation for a specific instance family in a region or zone, purchased for a term to receive a discount; convertible types can be exchanged when requirements change.

Spare compute capacity offered at steep discounts that can be reclaimed with short notice, suitable for fault-tolerant, interruptible, or checkpointed batch workloads.

A controller that maintains a desired count of instances across zones, replacing unhealthy ones and adjusting capacity in response to schedules, metrics, or predictive forecasts.

A monitoring service collecting metrics, logs, and events, with alarms and dashboards that trigger automated responses such as scaling actions or notifications when thresholds are crossed.

A service recording API activity across accounts, capturing who made which call, from where, and when, supporting audit, security investigation, and compliance evidence.

A service that records resource configuration changes and evaluates them against rules, flagging drift or noncompliance and enabling automated remediation of affected resources.

A key-value label applied to resources and activated in billing reports so spend can be attributed to teams, projects, or environments for chargeback and optimization decisions.

A central place to track application migration progress across multiple migration tools and regions, giving a single view of discovery, assessment, and cutover status.

An agent-based service that continuously replicates source servers into AWS and launches them as EC2 instances, enabling lift-and-shift cutover with short test and switchover windows.

A managed replication service that moves data between homogeneous or heterogeneous databases with minimal downtime, supporting continuous replication during and after cutover.

A desktop utility that converts database schemas and stored code from one engine to another, reporting items it cannot convert automatically so they can be rewritten manually.

A modernization approach that incrementally replaces parts of a legacy system with new services behind a routing layer, retiring old components gradually instead of rewriting everything at once.