AWCC key terms

An ordered set of rules attached to an interface or resource that permits or denies traffic based on attributes such as source address, destination address, protocol, or port. Evaluation stops at the first matching rule.

A lightweight software component installed on an endpoint that collects telemetry, enforces policy, or executes controller-directed actions. Agents typically maintain a persistent outbound connection to the management plane rather than accepting inbound connections.

A scoped credential used to authenticate programmatic requests to a management API instead of a username and password. Tokens should be short-lived, restricted to required permissions, and rotated regularly.

A chronological, tamper-evident record of administrative actions, authentication events, and configuration changes. Audit logs support forensic investigation and compliance evidence, so they are usually shipped off-box and retained per policy.

A documented, approved starting state for devices or services, against which drift is measured. Baselines capture required settings such as firmware level, credentials policy, and enabled services, and are revalidated after approved changes.

The controlled process of requesting, reviewing, approving, scheduling, and documenting modifications to a production environment. It provides rollback plans and a record linking each change to its justification and outcome.

Artifacts such as logs, configuration exports, scan reports, and attestations that demonstrate a control is designed and operating. Evidence must be current, attributable, and stored where auditors can retrieve it.

Any divergence between the running state of a system and its approved baseline. Drift commonly arises from manual edits, failed automation, or partial upgrades and is detected by periodic comparison or continuous reconciliation.

The central management component that stores intended configuration, distributes it to managed nodes, and aggregates status. It is the authoritative source of policy in a controller-based architecture and is usually deployed as a redundant cluster.

A specific, testable statement of what a security or operational control must achieve, such as restricting administrative access to authorized personnel. Objectives are mapped to technical safeguards and to the evidence that proves them.

The logical layer that makes forwarding and policy decisions and manages device state, as distinct from the data plane that moves payload traffic. Failures in the control plane affect manageability even when traffic still flows.

The logical layer that actually forwards or processes user traffic according to decisions made elsewhere. Troubleshooting the data plane focuses on throughput, drops, and path selection rather than configuration state.

A model in which the operator describes the desired end state and the platform computes the steps to reach it, rather than scripting each procedural step. Declarative models enable idempotent, repeatable reconciliation.

The process by which a new device or agent authenticates to the management platform, receives its identity credentials, and is admitted to policy. Enrollment typically requires a bootstrap token or certificate and an approval step.

The low-level software embedded in a hardware component that controls its basic operation. Firmware versions must be tracked against a supported matrix because mismatches can break features or invalidate support.

A preconfigured, validated system template used to provision new instances consistently. Golden images reduce configuration error but must be rebuilt periodically to absorb patches and baseline changes.

An automated probe that verifies a component is functioning, such as a periodic request to a status endpoint. Health checks feed load balancers and orchestrators so unhealthy instances are removed from service.

A design that keeps a service usable despite the failure of individual components, usually through redundancy, health checking, and automatic failover. It addresses availability, not durability or backup.

The property that repeating an operation produces the same end state as performing it once. Idempotent automation is safe to rerun after partial failure and is a prerequisite for reliable reconciliation loops.

The principle of granting each identity only the permissions required for its current task, for only as long as needed. It limits blast radius from compromised accounts and accidental misconfiguration.

The logical layer used to administer a system, such as CLI sessions, web interfaces, and APIs. It should be reachable only from trusted networks and protected by strong authentication and logging.

The average elapsed time between the onset of an incident and its detection by monitoring or a user report. Reducing MTTD depends on meaningful alerting and adequate telemetry coverage.

The average elapsed time from incident detection to restoration of normal service. It is improved by runbooks, clear ownership, and observability that shortens diagnosis.

Authentication requiring two or more independent factor types, such as a password plus a hardware key or push approval. It is the primary defense against credential theft for administrative access.

Recording raw network traffic on an interface for analysis. Captures reveal retransmissions, resets, and malformed payloads that logs omit, but they contain sensitive data and require handling controls.

A blameless analysis after an incident that establishes a timeline, contributing factors, and concrete follow-up actions with owners. Its purpose is systemic learning rather than assigning individual fault.

Access rights that can alter system configuration, security settings, or data at scale. Such access is typically brokered through a controlled gateway, time-bound, and fully logged.

The automated creation and initial configuration of infrastructure or accounts so they are ready for use. Good provisioning is repeatable, parameterized, and driven from version-controlled definitions.

The corrective action that restores a system to its approved state or closes a finding. Effective remediation includes verification that the fix worked and a record linking it to the original issue.

An authorization model in which permissions are bundled into roles and roles are assigned to identities. It simplifies administration and supports least privilege by making entitlements reviewable as named sets.

Restoring a prior known-good state after a failed change. A viable rollback requires a captured backup or versioned configuration, a tested procedure, and a decision point defined before the change begins.

A step-by-step operational procedure for a recurring task or known failure mode, including verification steps and escalation contacts. Runbooks reduce dependence on individual knowledge during high-pressure incidents.

A control that divides a sensitive process among different identities so no single person can both initiate and approve a critical action. It reduces fraud and error risk in change and access workflows.

A measurable target for a service reliability or performance indicator, such as successful request percentage over a window. SLOs guide alerting thresholds and prioritization of reliability work.

A federated authentication arrangement in which one identity provider authenticates a user and asserts that identity to multiple applications. It centralizes deprovisioning and enables consistent MFA enforcement.

A standard protocol and message format for sending event records from devices to a central collector. Centralized syslog preserves records across device failure and supports correlation across the estate.

Streamed measurements and events emitted by systems, including metrics, logs, and traces, used to observe behavior. Telemetry differs from auditing in that it is optimized for operational insight rather than evidentiary retention.

The volume of work or data a system successfully processes per unit time, distinct from latency. Throughput ceilings often appear only under load, so capacity testing is required to find them.

The root certificate or key material that a system implicitly trusts when validating other identities. Compromise or careless rotation of a trust anchor undermines every certificate chain built on it.