AWS Certified Cloud Practitioner (CRWT) key terms

A separate geographic area, such as us-east-1 or eu-west-1, where AWS clusters data centers. Resources are created in a chosen Region, and data generally stays there unless you explicitly move or replicate it.

One or more discrete data centers with independent power, cooling, and networking inside a Region. Deploying across multiple zones lets an application survive the failure of a single facility.

A smaller AWS site positioned close to end users, used by services such as CloudFront and Route 53 to cache content and answer DNS queries with low latency. There are far more edge locations than Regions.

An architecture that places redundant copies of a workload in two or more Availability Zones so that losing one zone does not take the application down. Common for databases and load-balanced tiers.

The split of duties between AWS and the customer: AWS secures the facilities, hardware, and managed service foundations, while the customer secures data, identities, configurations, and patching of what they control.

A long-lived identity in an AWS account representing a person or application, with its own credentials. Best practice is to use roles for workloads and require multi-factor authentication for humans.

An identity that can be assumed temporarily by users, applications, or AWS services to obtain short-lived credentials. Roles avoid embedding permanent access keys and are the preferred way to grant cross-account or service access.

A JSON document that lists allowed or denied actions on specified resources, optionally under conditions. Policies are attached to users, groups, or roles and are evaluated together to decide each request.

The resource-based policy on an IAM role that states which principals, such as an account, service, or federated identity, are permitted to assume it. It answers who may use the role, not what the role can do.

A design principle of granting only the permissions needed for a task, and only for as long as needed. It limits the blast radius of mistakes and compromised credentials and is a recurring theme in audit findings.

A stateful virtual firewall attached to resources such as EC2 instances that allows or denies inbound and outbound traffic by protocol, port, and source. Return traffic for allowed connections is automatically permitted.

A stateless, subnet-level filter that evaluates numbered allow and deny rules for inbound and outbound traffic in order. Because it is stateless, both directions of a connection need explicit rules.

A managed service for creating and controlling encryption keys used by AWS services and your own applications. It records key usage in logs and separates key administration from data access through policies.

Protecting stored data, on disks or in object storage, so it is unreadable without the correct key. On AWS this is typically achieved with KMS-managed keys or customer-provided keys for services like S3, EBS, and RDS.

Protecting data while it moves between clients, services, and networks, usually with TLS. It prevents eavesdropping and tampering on the wire and is required by many compliance frameworks.

A service that provisions, manages, and renews public or private TLS certificates for use with load balancers, CloudFront, and API Gateway. It removes manual certificate renewal work.

A service that records API activity in an account, showing who made a request, from where, and when. Trails can deliver logs to S3 and feed detective controls and audits.

A service that records resource configurations over time and evaluates them against rules. It helps detect drift, prove compliance, and answer questions about how a resource looked at a past moment.

A self-service portal for downloading AWS compliance reports and agreements, such as audit attestations and certifications. Teams use it to satisfy their own auditors without contacting AWS support.

A logically isolated virtual network you define, with your own IP address ranges, subnets, route tables, and gateways. Most AWS compute and database resources are launched inside a VPC.

A range of IP addresses within a VPC placed in one Availability Zone. Subnets are labeled public or private depending on whether their route table sends traffic to an internet gateway.

A horizontally scaled VPC component that connects a VPC to the public internet. Resources need a public IP address and a route to the gateway to be reachable from outside.

A managed component that lets instances in private subnets initiate outbound internet traffic while blocking unsolicited inbound connections. It is billed by hourly usage plus data processed.

A service for launching resizable virtual servers with a choice of instance family, operating system, and purchasing option. You manage the guest operating system and everything above it.

Block storage volumes attached to EC2 instances, persisting independently of the instance lifecycle. Volume type and size determine performance and cost, and snapshots back them up to S3.

Object storage organized into buckets, with virtually unlimited capacity and eleven nines of designed durability for standard storage. Access is controlled by bucket and object policies and IAM.

A per-object setting that trades retrieval speed and availability for lower cost, such as Standard, Infrequent Access, Glacier tiers, and Intelligent-Tiering. Lifecycle rules can move objects between classes automatically.

A set of rules that automatically transitions objects or volumes to cheaper storage or deletes them after a defined age. It is a common way to control storage cost without manual cleanup.

A managed service that distributes incoming traffic across multiple targets in one or more Availability Zones and performs health checks. Application, Network, and Gateway variants suit different protocols.

A controller that maintains a desired count of EC2 instances, replacing unhealthy ones and scaling in or out based on policies or schedules. It works with load balancers to keep capacity matched to demand.

A serverless compute service that runs code in response to events or requests, billed per invocation and execution duration. AWS handles servers, scaling, and patching, so you focus only on the function code.

A managed NoSQL key-value and document database offering single-digit millisecond latency at any scale. Capacity is provisioned or on-demand, and tables can replicate across Regions with global tables.

A managed relational database service for engines such as MySQL, PostgreSQL, and SQL Server, handling backups, patching, and failover. Multi-AZ deployments provide standby replicas for availability.

A content delivery network that caches responses at edge locations to reduce latency and origin load. It integrates with certificate management, access controls, and web application firewalls.

A highly available DNS service with routing policies such as simple, weighted, latency, failover, and geolocation. It also registers domains and can health-check endpoints to drive failover.

A set of design guidance organized into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Reviews against it surface risks and improvement opportunities.

A service that inspects an account and flags issues across cost optimization, security, fault tolerance, performance, and service limits. Some checks are free; full results require a business or enterprise support plan.

A commitment to a specific instance family in a Region for one or three years in exchange for a significant discount over on-demand pricing. Savings Plans offer a more flexible alternative.

A commitment to a consistent amount of compute usage per hour for one or three years, priced lower than on-demand. Compute Savings Plans apply across instance families, Regions, and Lambda.

Spare EC2 capacity offered at a steep discount that can be reclaimed with short notice when demand rises. Suitable for fault-tolerant, interruptible work such as batch processing.

A tiered support subscription, from Basic through Developer, Business, and Enterprise, that determines response times, channels, and access to advisory services such as a technical account manager.

A console tool for visualizing and forecasting spending by service, account, tag, or time period. It supports filtering and grouping so teams can find the largest cost drivers.

A feature for setting spending, usage, or reservation targets and receiving alerts when actual or forecast values cross thresholds. Alerts notify; they do not automatically stop resources.

A key-value label applied to resources so costs can be grouped by project, team, or environment in billing reports. Tags must be activated in billing settings before they appear as cost dimensions.