AWS Certified Cloud Practitioner key terms

On-demand delivery of computing power, storage, and applications over the internet with pay-as-you-go pricing, instead of buying and maintaining physical data centers yourself.

The ability to acquire resources automatically as demand grows and release them when demand falls, so capacity tracks actual workload instead of peak estimates.

The capacity of a system to handle growing load by adding resources, either vertically by enlarging a single server or horizontally by adding more servers.

Designing systems to remain accessible despite component failures, typically by running redundant resources across multiple locations and routing traffic away from unhealthy ones.

The property of a system that keeps operating correctly when part of it fails, usually through redundancy and automatic failover with minimal or no interruption to users.

Upfront spending on long-lived assets such as servers and data center buildings. Cloud adoption shifts much of this to variable operating expense.

Ongoing day-to-day spending on services you consume, such as monthly cloud usage bills, rather than upfront investment in owned infrastructure.

A comparison method that adds all costs of an option over time, including hardware, power, staffing, and licensing, to judge whether migration or cloud usage is financially justified.

A set of design guidance organized into pillars such as operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability, used to review workloads.

The ability of a workload to perform its intended function correctly and consistently, including recovery from failure, tested through mechanisms like backups and multi-location deployment.

The division of security duties between the cloud provider, which secures the infrastructure, and the customer, who secures data, identities, and configuration of what they deploy.

A service for creating users, groups, and roles and attaching policies that define which actions each principal may perform on which resources.

Granting only the permissions required to perform a task, and no more, to limit the impact of compromised credentials or mistakes.

A JSON document that lists statements with effects, actions, resources, and conditions, evaluated to decide whether a request is allowed or denied.

An identity with permission policies that trusted principals can temporarily assume, obtaining short-lived credentials instead of storing long-term access keys.

Trusting an external identity provider so users sign in with existing corporate or social credentials and receive temporary access to cloud resources.

Requiring a second proof of identity beyond a password, such as a one-time code from a device, which reduces the risk of account takeover.

Protecting stored data by converting it to unreadable form with keys, so disks, buckets, and databases remain confidential if physical media is exposed.

Protecting data while it moves between clients and services using protocols such as TLS, preventing interception or tampering on the network.

A managed service for creating and controlling cryptographic keys, integrating with storage and database services so you do not operate your own key servers.

A logging service that records API activity in an account, supporting auditing of who did what, when, and from where.

Meeting legal, regulatory, and industry requirements for handling data, often evidenced by third-party audit reports and certifications the provider publishes.

A geographic area containing multiple isolated data center groups, chosen to place workloads near users and to satisfy data residency requirements.

One or more discrete data centers with independent power and networking inside a region, used together to survive a single-site failure.

A site closer to end users than a region, used to cache content and terminate connections so latency is reduced for global audiences.

A logically isolated network you define, with your own address ranges, subnets, route tables, and gateways controlling how resources communicate.

A range of IP addresses within a virtual network, placed in one availability zone and marked public or private to control direct internet exposure.

A stateful virtual firewall attached to resource network interfaces that allows specified inbound and outbound traffic and denies everything else by default.

A stateless, ordered set of allow and deny rules applied at the subnet boundary, evaluated separately for inbound and outbound traffic.

A service providing resizable virtual servers where you choose the operating system, install software, and pay for the capacity you run.

Automatically adjusting the number of running instances based on demand or schedules, maintaining performance while avoiding idle capacity costs.

Distributing incoming traffic across multiple targets and health-checking them, so unhealthy targets are removed and no single server is overwhelmed.

Object storage that keeps files as objects inside buckets, offering high durability, versioning, lifecycle rules, and multiple storage classes.

A tier of object storage trading retrieval speed and availability for lower cost, chosen per object based on how often it is accessed.

Rules that automatically transition objects or delete them after a set age, reducing storage cost without manual cleanup.

The probability that stored data survives over time without loss or corruption, distinct from availability, which concerns whether it can be read now.

A globally distributed caching layer that serves content from locations near users, lowering latency and offloading origin servers.

A model where the provider manages servers entirely, runs your code or services on demand, and bills only for what is consumed.

A service where the provider handles provisioning, patching, backups, and scaling tasks, letting your team focus on applications rather than infrastructure.

A pricing model charging only for the resources consumed, with no upfront commitment, suited to variable or unpredictable workloads.

A commitment to use a service for a term, such as one or three years, in exchange for a lower hourly rate than on-demand pricing.

Spare compute capacity offered at steep discounts that can be reclaimed with short notice, suitable for interruption-tolerant batch work.

The practice of measuring, attributing, and reducing spend through right-sizing, commitment discounts, storage tiering, and eliminating unused resources.

A threshold notification that warns you when forecast or actual spending approaches a limit, enabling action before the bill surprises you.

A reporting tool that visualizes historical spend and forecasts by service, account, or tag, helping identify where money is going.

Attaching key-value metadata to resources so costs and ownership can be grouped and reported by project, department, or environment.

A purchased tier defining response times, channels, and access to advisory help, ranging from basic self-service to dedicated technical account management.

A formal commitment about measurable service characteristics such as uptime, including remedies if the commitment is not met.