AWS Solutions Architect key terms

JSON permission document attached to an IAM user, group, or role that lists which actions are allowed or denied on which resources. It defines what a principal may do, not who may assume it.

Permission document attached directly to an AWS resource, such as an S3 bucket or SQS queue, naming which principals may act on it and under what conditions. Commonly used to grant cross-account access.

Stateful virtual firewall that controls inbound and outbound traffic for elastic network interfaces and the resources using them. Only allow rules exist, and return traffic for permitted connections is automatically allowed.

Stateless, numbered allow and deny filter applied at the subnet boundary. Rules are evaluated in order and apply separately to each direction, so return traffic requires its own rule.

Managed service that creates and stores encryption keys and performs cryptographic operations through API calls. Keys never leave the service, and access is governed by key policies together with IAM.

Private connection from a VPC to a supported AWS service without traversing the public internet. Gateway endpoints serve S3 and DynamoDB; interface endpoints use elastic network interfaces with private IP addresses.

Organization-level policy in AWS Organizations that sets the maximum permissions available to member accounts. It filters permissions but never grants them, so an action must also be allowed by IAM.

Web application firewall for CloudFront, Application Load Balancer, and API Gateway that inspects HTTP requests and allows, blocks, or counts them using rules, rate limits, and managed rule groups.

Paid DDoS protection offering enhanced detection, near-real-time attack visibility, access to the AWS response team, and cost protection for scaling charges incurred during an attack.

Identity service providing user directories for sign-up and sign-in (user pools) plus temporary AWS credentials for authenticated app users (identity pools), commonly used by mobile and web applications.

API call that returns temporary, expiring credentials for an IAM role. It underpins cross-account access, identity federation, and replacing long-term access keys on workloads.

Store for database credentials and API keys with built-in rotation through Lambda, fine-grained access control, and native integration with services such as RDS and Redshift.

Running resources across two or more Availability Zones in a region so that a single data center or zone failure does not take the workload offline. Managed databases use a synchronous standby in another zone.

Asynchronous copy of a database that serves read traffic and can be promoted to primary. It reduces load on the writer and offers a recovery target, but may lag behind the source.

DNS policy that directs traffic to a primary record while health checks pass and automatically switches to a secondary record when the primary is found unhealthy.

Collection of EC2 instances managed as one unit with minimum, maximum, and desired capacity. It replaces unhealthy instances and adds or removes capacity in response to demand.

Maximum acceptable elapsed time to restore a workload after a disruption. It drives architecture choices such as warm standby versus backup and restore.

Maximum acceptable amount of data loss, expressed as time before the failure. It determines how frequently backups run and how replication is configured.

Disaster recovery pattern in which a minimal core of replicated data and a few core servers runs in the recovery region and is scaled out at failover. The cheapest of the active recovery patterns.

Automatic asynchronous copying of objects to a bucket in a different region, used for compliance, lower-latency access, and regional failure resilience. Versioning is required on both buckets.

Multi-region, multi-active replication for DynamoDB tables in which every replica accepts writes and converges. It provides low-latency local reads and regional failover for NoSQL workloads.

Centralized, policy-driven service that schedules, retains, and restores backups across many AWS services, including cross-region and cross-account copies for compliance and recovery.

Layer 7 load balancer that routes HTTP and HTTPS requests by path, host, header, or query string, supports WebSocket, and integrates with AWS WAF and Amazon Cognito authentication.

Layer 4 load balancer built for extreme throughput and millions of requests per second with very low latency. It preserves source IP addresses and supports static Elastic IP addresses per zone.

Global content delivery network that caches responses at edge locations to cut latency and reduce origin load, with TLS termination, signed URLs, and WAF integration.

Managed in-memory caching service using Redis or Memcached that serves repeated reads from memory, offloads databases, and can hold session state for stateless application tiers.

In-memory write-through cache for DynamoDB that reduces read latency from milliseconds to microseconds for read-heavy tables, requiring only an endpoint change rather than application rewrites.

Logical grouping that packs instances close together within a single Availability Zone on high-bandwidth, low-latency networking, suited to tightly coupled high performance computing workloads.

Service that uses AWS edge locations and anycast IP addresses to carry TCP and UDP traffic over the AWS backbone to the best endpoint, improving latency and failover speed.

DNS policy that answers with the record for the region measured to have the lowest latency for the requester, often combined with health checks to avoid slow or failed regions.

Commitment to a consistent hourly amount of compute usage for a one- or three-year term in exchange for lower rates. Compute Savings Plans apply across instance families, sizes, and regions automatically.

Discounted capacity reservation for services such as EC2, RDS, and ElastiCache over a one- or three-year term. Standard reservations give the deepest discount but the least flexibility to change.

Spare EC2 capacity offered at steep discounts that can be reclaimed with a two-minute interruption notice. Best suited to fault-tolerant, stateless, and batch workloads rather than persistent stateful servers.

Storage class that automatically moves objects between frequent-access and infrequent-access tiers based on observed usage, charging a small monitoring fee instead of retrieval charges.

Set of rules that transitions objects between storage classes or expires them after defined periods, automating retention compliance and removing the cost of storing cold data in hot tiers.

Practice of matching instance types, storage, and database capacity to measured demand, typically using utilization metrics and recommendations, so that over-provisioned spend is eliminated.

Console and API tool for visualizing, filtering, and forecasting spend by service, account, or tag, and for reviewing Savings Plans and Reserved Instance purchase recommendations.