HCIE-Cloud Service key terms

A geographic area containing one or more isolated data centers, chosen to place workloads close to users and to satisfy data residency requirements. Resources generally do not span regions without explicit cross-region replication.

An independent physical location within a region, with separate power, cooling, and network. Deploying instances across AZs protects an application from a single-site failure while keeping latency low.

A logical resource-isolation container inside an account, used to separate environments or departments and to scope permissions and billing. Resources in different projects are isolated by default.

A delegated identity that a service or account assumes temporarily to act on resources. It avoids embedding long-term credentials and underpins cross-service and cross-account access patterns.

A management tag grouping cloud resources for cost allocation and permission control across services. Unlike a project, it can span multiple projects and is used for chargeback reporting.

A logically isolated virtual network where you define subnets, routes, and security policies. It provides the private address space in which most compute and database resources are launched.

A range of private IP addresses inside a VPC, bound to one availability zone. Instances in different subnets communicate through route tables and network ACLs.

A stateful virtual firewall applied at the instance network interface level. Rules allow or deny traffic by protocol, port, and source or destination, and return traffic is automatically permitted.

A stateless subnet-level filter that evaluates inbound and outbound rules separately. Because return traffic must be explicitly allowed, it complements rather than replaces security groups.

A private link between two VPCs that routes traffic over the provider backbone without exposing it to the internet. It is non-transitive, so hub-and-spoke designs need a transit solution.

A dedicated private connection between an on-premises data center and a cloud region. It offers predictable bandwidth and lower latency than internet VPN for hybrid workloads.

An IPsec-based tunnel endpoint that securely connects on-premises networks or remote sites to a VPC over the public internet. It is cheaper and faster to deploy than dedicated circuits.

A resizable virtual machine with selectable CPU, memory, image, and disk. It supports flavor changes, auto scaling, and placement controls, and is the default compute building block for lift-and-shift workloads.

A service for creating, storing, and sharing server images used to launch ECS instances. Private images capture an OS and installed software so that identical nodes can be reproduced quickly.

Block storage volumes attached to ECS instances, available in several performance tiers and replicated within an availability zone. Snapshots provide point-in-time backups for recovery.

Durable, virtually unlimited object storage accessed over HTTP APIs, with storage classes and lifecycle rules. It commonly holds backups, static website content, logs, and data-lake input.

A rule set that automatically transitions objects or volumes between storage tiers and deletes them after a defined age. It controls long-term storage cost without manual intervention.

A service distributing incoming traffic across multiple backends, with health checks and listener rules. It supports layer 4 and layer 7 balancing and removes unhealthy nodes from rotation.

A service that adjusts the number of instances based on schedules, metrics, or alarms within minimum and maximum bounds. It pairs with load balancing to keep capacity matched to demand.

A placement policy that forces instances onto different physical hosts to reduce correlated failure. It is used for clustered databases and other nodes where simultaneous host loss is unacceptable.

A managed relational database offering automated backups, patching, and read replicas. Primary and standby instances can be placed in different AZs for high availability.

A read-only database copy that receives changes asynchronously from the primary. It offloads reporting queries and can be promoted during recovery, but may lag behind the primary.

The maximum acceptable amount of data loss measured in time before a disruption. It drives decisions about replication mode, backup frequency, and whether synchronous replication is required.

The maximum acceptable elapsed time to restore a service after failure. It determines whether a standby site is active-passive or active-active and how much automation recovery needs.

A planned test that exercises failover and failback procedures against defined RPO and RTO targets. Regular drills expose gaps in runbooks, DNS switching, and data replication.

A reusable, parameterized definition of infrastructure and software configuration used to provision environments consistently. It reduces drift and supports repeatable scaling and disaster recovery builds.

A release pattern running two identical environments and switching traffic from the old to the new one after validation. Rollback is fast because the previous environment remains intact.

A gradual rollout that sends a small share of traffic to a new version while monitoring error rates and latency. Traffic share increases only if health metrics stay within thresholds.

A periodic probe that tests whether a backend responds correctly, marking it in or out of service. Correct thresholds and intervals prevent flapping and avoid routing traffic to failed nodes.

A migration approach that moves workloads to the cloud with minimal code change, often as virtual machines. It is fast but may not capture cost or elasticity benefits without later optimization.

Redesigning an application to use managed and distributed cloud services rather than mimicking on-premises topology. It raises initial effort but improves elasticity, resilience, and operational cost.

A structured review of application dependencies, traffic patterns, data volume, and compliance constraints before migration. Its output is a prioritized wave plan with target architectures and cutover criteria.

The controlled moment when production traffic and data move from the source to the target environment. It requires a rollback trigger, a communication plan, and verified data synchronization beforehand.

Assigning metadata tags to resources so consumption can be aggregated by team, application, or environment. Consistent tagging is a prerequisite for accurate chargeback and idle-resource cleanup.

The monitoring service collecting metrics, events, and alarms for cloud resources. Alarm actions can trigger scaling, notifications, or automated remediation when thresholds are breached.

Centralized collection, search, and alerting over application and service logs. Correlating logs with metrics shortens root-cause analysis during incidents and supports audit requirements.

Adjusting instance, storage, and database capacity to match observed utilization. It removes over-provisioning cost while preserving headroom for peaks, and should follow a measurement period.

A pattern where an account assumes a role in another account to manage or read resources without sharing permanent credentials. It is common in multi-account landing zones and managed service delivery.