Cloud Computing on AWS

A separate geographic area where AWS runs its data centers, such as us-east-1 or eu-west-1. Each region is fully isolated from the others so an outage in one does not spread to another.

One or more physically separate data centers within a region, each with its own power, cooling, and networking. Spreading resources across multiple AZs is the basic way to survive a single data-center failure.

A site in the global CloudFront network that caches content close to users. There are far more edge locations than regions, which is what makes content delivery fast worldwide.

The split of security duties between AWS and you. AWS secures the cloud itself (hardware, facilities, core services) while you secure what you put in it (data, access, patching, configuration).

The ability to add and remove capacity automatically as demand rises and falls, so you pay for what you actually use instead of provisioning for peak load all the time.

Designing a system to keep running through component failures, usually by running redundant resources across multiple Availability Zones behind a load balancer.

The billing model where you are charged for the resources you consume by the hour, second, request, or gigabyte, with no upfront hardware purchase.

Virtual servers in the cloud that you can launch, resize, and terminate on demand. EC2 gives you full control over the operating system, making it the workhorse for running almost any workload.

A named hardware profile that sets an EC2 instance's CPU, memory, storage, and network capacity. Families are tuned for different jobs, such as compute-optimized (c), memory-optimized (r), or general purpose (t and m).

A template that contains the operating system, software, and configuration used to launch an EC2 instance. Baking an AMI lets you start identical, ready-to-run servers in seconds.

A managed set of EC2 instances that grows or shrinks automatically based on demand or a schedule. It replaces unhealthy instances and keeps the fleet at your desired count.

A serverless compute service that runs your code in response to events without you managing any servers. You are billed only for the time your function actually runs.

AWS's own container orchestrator for running and scaling Docker containers. It handles placement, health checks, and networking so you do not have to build that yourself.

A serverless engine for containers that runs ECS or EKS tasks without you provisioning or managing EC2 instances. You just define CPU and memory, and AWS runs the container for you.

A managed Kubernetes control plane on AWS. It runs and maintains the Kubernetes masters for you while you focus on your workloads and worker nodes.

A platform-as-a-service layer that deploys and manages web apps for you, provisioning the EC2 instances, load balancer, and scaling behind the scenes from your uploaded code.

A managed service that runs relational databases like PostgreSQL, MySQL, and SQL Server for you, handling patching, backups, and failover so you do not babysit the server.

AWS's own MySQL- and PostgreSQL-compatible database engine, built for the cloud with higher throughput and storage that grows automatically. It is offered through RDS.

A fully managed NoSQL key-value and document database that delivers single-digit-millisecond performance at any scale. It has no servers to manage and scales throughput on demand.

A managed in-memory cache using Redis or Memcached. Putting it in front of a database absorbs read load and speeds up responses by serving hot data from memory.

A read-only copy of an RDS database that stays in sync with the primary. Sending read queries to replicas offloads the primary and improves read scalability.

An RDS setup that keeps a standby copy of your database in another Availability Zone and fails over to it automatically if the primary goes down, boosting availability.

Your own isolated virtual network inside AWS where you launch resources. You control its IP range, subnets, routing, and gateways, giving you data-center-like control in the cloud.

A slice of a VPC's IP range tied to a single Availability Zone. A public subnet has a route to the internet; a private subnet does not, which is where you keep databases and internal services.

A stateful virtual firewall attached to an instance that controls its inbound and outbound traffic by rules. Being stateful, a reply to an allowed request is automatically permitted back.

A stateless firewall applied at the subnet level, evaluating traffic against numbered allow and deny rules. Because it is stateless, you must write rules for both directions of every flow.

A VPC component that lets resources in public subnets send and receive traffic to and from the internet. Without one attached, a subnet cannot reach the outside world.

A managed service that lets instances in a private subnet reach the internet for updates while staying unreachable from it. Outbound connections work; unsolicited inbound ones do not.

AWS's scalable DNS and domain registration service. It resolves domain names to resources and can route users based on latency, geography, or health checks.

The AWS content delivery network that caches your content at edge locations near users. It cuts latency for static and dynamic content and absorbs traffic spikes.

A managed service that distributes incoming traffic across healthy targets in multiple Availability Zones. The Application Load Balancer works at Layer 7 (HTTP), while the Network Load Balancer works at Layer 4.

A static public IPv4 address you allocate to your account and can attach to any instance. Because it does not change, it is handy for services that need a fixed public endpoint.

The monitoring service that collects metrics, logs, and alarms from AWS resources. Alarms can trigger scaling actions or notifications when a metric crosses a threshold.

The infrastructure-as-code service that provisions AWS resources from a declarative template. You describe the stack you want and CloudFormation creates, updates, or tears it down for you.

A service that records API calls and account activity for auditing and security investigation. It answers the question of who did what, when, and from where in your account.

A billing commitment to use a certain instance type for one or three years in exchange for a large discount over on-demand pricing. It suits steady, predictable workloads.

Spare EC2 capacity sold at a steep discount that AWS can reclaim with short notice. It is ideal for fault-tolerant, interruptible work like batch jobs and CI runners.

The service that controls who can do what in your AWS account through users, groups, roles, and policies. It is the front door to every permission decision AWS makes.

A JSON document that grants or denies specific actions on specific resources. Attaching a policy to a user or role is how you define exactly what they are allowed to do.

A set of permissions that can be assumed temporarily by a user, service, or instance instead of being tied to one person. Giving an EC2 instance a role is the safe way to grant it AWS access without hardcoded keys.

The practice of granting only the permissions a user or service actually needs, and nothing more. It limits the blast radius if a credential is ever leaked or misused.

A managed service for creating and controlling the encryption keys that protect your data. Most AWS services integrate with KMS to encrypt data at rest with a key press away.

A service that stores, encrypts, and rotates secrets like database passwords and API keys. Applications fetch secrets at runtime instead of baking them into code or config.

A second proof of identity, such as a code from a phone app, required on top of a password. Enabling it on the root and admin accounts is one of the highest-value security steps on AWS.

Object storage that holds files (objects) in containers called buckets, accessed over HTTP. It offers effectively unlimited capacity and very high durability, making it the default place to store data on AWS.

A top-level container in S3 that holds objects. Bucket names are globally unique across all of AWS and set the region, permissions, and access policy for what they hold.

A tier that trades access speed for cost, such as Standard for hot data, Standard-IA for infrequent access, and Glacier for cheap long-term archives.

A very low-cost S3 storage class built for archival data you rarely read. Retrieval can take minutes to hours depending on the option, in exchange for the lowest storage price.

Network-attached block storage volumes for EC2 instances, behaving like a virtual hard disk. Volumes persist independently of the instance and can be snapshotted for backup.

A managed, elastic NFS file system that many EC2 instances can mount at once. It grows and shrinks automatically as you add or remove files, unlike a fixed-size EBS volume.

A point-in-time backup of an EBS volume stored in S3. Snapshots are incremental, so each one only saves the blocks that changed since the last.