AWS SysOps Administrator key terms

A CloudWatch feature that watches a single metric and triggers actions such as notifications or scaling when the value crosses a threshold you define for a set number of evaluation periods.

A CloudWatch alarm whose state is computed from the states of other alarms combined with AND/OR logic, useful for reducing notification noise and expressing complex health conditions.

A CloudWatch Logs pattern that matches text inside log events and converts matches into numeric metrics or alarm actions, letting you monitor application behavior without writing extra code.

An interactive query language for searching and analyzing CloudWatch Logs data, supporting filtering, aggregation, and visualization across selected log groups and time ranges.

Software installed on EC2 instances or on-premises servers that collects system-level metrics and log files and publishes them to CloudWatch.

A service that records API activity in an account, showing who made each request, from where, and when, for auditing and security investigation.

A managed or custom rule that evaluates resource configuration against a desired state, flags noncompliant resources, and can trigger automatic remediation.

A service that inspects an account and returns recommendations across cost, performance, security, fault tolerance, and service limits, ranked by potential impact.

A pattern that matches incoming events on an event bus or schedule and routes them to targets such as Lambda functions, queues, or automation runbooks.

A Systems Manager document that defines a sequence of steps executed automatically against AWS resources, commonly used for patching, remediation, and recurring operational tasks.

The maximum amount of data, measured in time, that a workload can afford to lose during a disruption; it drives how frequently backups or replication must occur.

The maximum acceptable elapsed time a workload can be unavailable after a disruption before the business impact becomes unacceptable.

Placing resources such as databases or instances across two or more Availability Zones so a failure in one zone does not take the workload offline.

A disaster recovery strategy that keeps a minimal core of the workload, such as replicated data and a few core servers, running continuously and rebuilds the rest during failover.

A disaster recovery approach in which a scaled-down but fully functional copy of production runs continuously and is scaled up when failover is required.

An AWS Backup configuration that specifies which resources to protect, how often to back them up, the destination vault, and how long recovery points are retained.

An AWS Backup feature that enforces retention rules on a backup vault in a write-once manner, preventing recovery points from being deleted early, even by administrators.

A collection of EC2 instances managed as a unit that adjusts capacity to match demand and replaces unhealthy instances to keep the application available.

A reusable definition of instance settings such as AMI, instance type, security groups, and user data, consumed by Auto Scaling groups and EC2 Fleet.

A service that builds, tests, and automatically distributes customized machine images on a schedule, keeping golden images patched without manual pipeline work.

A CloudFormation capability that deploys one template to many accounts and Regions from a single administration account, optionally auto-deploying to newly added accounts.

A CloudFormation preview that lists exactly which resources a stack update would add, modify, or delete before you choose to execute it.

A CloudFormation capability that compares the live configuration of stack resources with the template and reports resources changed outside of CloudFormation.

A release technique that shifts traffic from the current environment to an identical new one after validation, allowing quick rollback by moving traffic back.

A set of tagged instances or platform targets plus settings such as rollout speed, alarms, and rollback behavior that CodeDeploy uses when releasing an application revision.

An identity carrying permission policies that users, applications, or AWS services can assume temporarily to obtain credentials without long-term access keys.

An AWS Organizations policy that defines the maximum permissions available to member accounts, filtering what the IAM policies inside those accounts can allow.

A resource policy that defines which principals may use or administer a KMS key; if no statement allows a principal, nobody can use the key.

A stateful virtual firewall attached to network interfaces that permits or blocks traffic by protocol, port, and source or destination address.

A stateless subnet-level firewall whose numbered allow and deny rules are evaluated in order for traffic entering and leaving the subnet.

A private connection from a VPC to a supported AWS service that keeps traffic off the public internet; gateway endpoints serve S3 and DynamoDB, interface endpoints use elastic network interfaces.

A regional hub that connects VPCs and on-premises networks through a single attachment point, simplifying routing compared with many point-to-point peering links.

A DNS routing policy that answers with a primary record while its health check passes and switches to a secondary record when the primary is unhealthy.

A CloudFront setting that signs requests to an S3 origin so the bucket stays private and objects can be read only through the distribution.

A commitment to a consistent hourly amount of compute usage for one or three years in exchange for lower prices, applied automatically to eligible compute services.

Spare EC2 capacity offered at a large discount that can be reclaimed with short notice, suited to fault-tolerant and flexible workloads.

A service that analyzes utilization metrics and configuration to recommend right-sizing for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions.

A set of rules that transitions objects to cheaper storage classes or deletes them after defined time periods, reducing storage cost automatically.

A solution that starts and stops resources on a defined schedule, such as business hours only, so you avoid paying for idle non-production capacity.

A service that learns normal spending patterns and alerts you when costs deviate unexpectedly, helping catch waste or misconfiguration early.