AWS Certified Cloud Practitioner — knowledge map
The 614 core concepts of AWS Certified Cloud Practitioner and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (614)
Performance metrics (IOPS/throughput/bandwidth/latency)
Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.
AWS Lambda
Serverless (FaaS): event-driven function execution billed only for what runs; no server management.
Related: Serverless (FaaS)
Amazon CloudWatch
The observability core: Logs aggregates logs (query with Logs Insights); metrics are numeric time-series (including custom); alarms notify/auto-respond on threshold breaches (SNS/Auto Scaling). Lambda logs flow to Logs automatically.
Related: Custom metrics、CloudWatch Logs Insights
ML data preparation (encoding/scaling/imbalance)
Shaping raw data for learning. Encoding turns categories numeric (one-hot/ordinal/target); scaling = standardize (z-score)/normalize (Min-Max); imbalance = SMOTE oversampling/class weights (evaluate with F1/PR-AUC). Fit transforms only on post-split training data (prevent leakage).
Amazon Bedrock
A fully managed service to access foundation models from multiple providers via API and build generative AI into apps; also Knowledge Bases (RAG), agents, and Guardrails.
Related: Amazon Bedrock Knowledge Bases
Amazon SageMaker
A managed environment to build, train, and deploy ML models end to end (custom models on your data); JumpStart for trying/fine-tuning prebuilt models.
Related: SageMaker JumpStart
Pricing models (On-Demand / Savings Plans·RI / Spot)
On-Demand = pay-as-you-go, most flexible; Savings Plans/RI = discount for a 1–3 year commitment; Spot = spare capacity up to ~90% off (interruptible).
Prerequisites: Consumption-based pricing
Auto Scaling
Automatically adjusts the number of EC2 (and more) with demand or failures (elasticity); combine with ELB for HA.
Prerequisites: Elasticity
Amazon DynamoDB
A serverless NoSQL key-value/document DB with a flexible schema and low latency at scale.
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
Prerequisites: Shared responsibility model
Serverless (FaaS)
No server management; code runs only on events and bills only for execution (e.g., AWS Lambda).
Related: AWS Lambda
AWS CloudTrail
Records an audit log of API activity (who did what, and when) in the account.
Amazon CloudFront
A CDN that caches content at edge locations for low-latency delivery to users.
Related: Edge location
Amazon API Gateway
A fully managed service to create, publish, and manage REST/HTTP/WebSocket APIs, with throttling, authorization (Cognito/Lambda authorizers), stages, usage plans, and caching; backed by Lambda and more.
Prerequisites: Amazon Cognito、Managed services (management boundary)
IAM policy structure (Effect/Action/Resource/Condition)
Elements of a JSON policy: Effect (Allow/Deny), Action (APIs like s3:GetObject), Resource (target ARNs), Condition (IP, MFA, tags, etc.), and Principal (who—resource policies only). Least privilege narrows these to specifics.
Subnet
A smaller network range carved out of a virtual network address space; groups resources by purpose or public/private and serves as a unit for routing and access control.
AWS Glue
The core of serverless ETL. Crawlers infer schema into the Data Catalog (central metadata shared by Athena/Redshift Spectrum/EMR); ETL jobs transform/cleanse on serverless Spark; Glue Data Quality (DQDL) validates data; job bookmarks prevent reprocessing.
Related: Glue Data Quality (DQDL)、Job bookmarks、Glue crawler、Redshift Spectrum
Amazon Route 53
DNS (name resolution) and domain registration, with health checks and routing policies.
Related: Route 53 routing policies
Transit Gateway
A router that consolidates many VPCs and on-premises into a single hub. It avoids full-mesh VPC peering, simplifying large-scale connectivity with a hub-and-spoke model.
Related: VPC peering
AWS CloudFormation
An IaC service that deploys resource groups (stacks) reproducibly from declarative templates (YAML/JSON); change sets preview diffs before apply and drift detection finds divergence from reality. Nested stacks and StackSets modularize and deploy across accounts.
Related: AWS Resource Groups、YAML
AWS IAM
Identity and access management—users/groups/roles/policies control "who can do what" with least privilege; roles grant temporary permissions (no keys).
Amazon Athena
A serverless service running Presto/Trino-based SQL on S3 data. Billed per data scanned, so Parquet conversion + partitioning greatly cuts cost. Uses the Glue Data Catalog for metadata.
Prerequisites: Partitioning (S3/data lake)
Related: Glue Data Catalog
Route table
A set of rules deciding where a subnet’s traffic goes: each destination CIDR maps to a target (IGW, NAT GW, peering, endpoint, etc.). Longest-prefix match wins; the local (in-VPC) route cannot be removed.
AWS Systems Manager (SSM)
A unified toolset to operate fleets at scale without opening SSH/RDP: Run Command (commands at scale), Session Manager (shell without open ports), Patch Manager (patch baselines + maintenance windows), Automation (runbooks for auto-remediation), and Parameter Store (config/SecureString). Requires the SSM agent and an IAM role.
Prerequisites: AWS Config rules and remediation、Patch Manager、Session Manager、SSM Automation (runbooks)
Related: Parameter Store、Run Command
Cost allocation (chargeback/showback)
Allocating cloud spend to teams/projects. Chargeback bills each unit for actual cost (accountability); showback only shows usage without billing (awareness). Implemented via cost allocation tags, Cost Categories, and Cost Explorer.
Prerequisites: AWS Cost Explorer
CloudWatch Logs
Aggregates and stores logs: log streams sit under a log group (which sets retention). Metric filters extract numeric metrics from logs, and subscription filters stream logs in real time to Kinesis/Lambda/OpenSearch. Logs from Lambda and many services arrive automatically.
Prerequisites: Amazon OpenSearch Service、SNS message filtering
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Prerequisites: S3 access control (bucket policy/ACL/ownership)
Amazon Aurora
A cloud-native, MySQL/PostgreSQL-compatible database. Storage is 6-way replicated across 3 AZs with self-healing and auto-growth (up to 128 TiB); up to 15 read replicas, failover usually under 30s—higher availability/performance than RDS.
Kinesis Data Streams
Durable streaming ingestion. It retains data for replay, parallelizes via shards, and lets multiple custom consumers read the same stream.
Prerequisites: Durability and availability (nines)
Related: Amazon Data Firehose
AWS Direct Connect
A network service that connects on-premises infrastructure directly to AWS over a dedicated line. Because it bypasses the public internet, it offers low, consistent latency and stable bandwidth, suiting large data transfers and latency-sensitive workloads. For redundancy, AWS recommends connections from multiple locations or pairing with Site-to-Site VPN as a failover path.
Related: AWS Site-to-Site VPN
Amazon GuardDuty
Analyzes logs to detect threats automatically; Security Hub aggregates findings, Inspector scans vulnerabilities, Macie finds sensitive data.
Prerequisites: Amazon Inspector、Amazon Macie
AWS Fargate
A serverless compute engine for ECS/EKS: no EC2 instances to manage (patching, scaling)—you just specify vCPU/memory per task. The default choice to reduce operational overhead.
Amazon Redshift
A petabyte-scale data warehouse (OLAP) using columnar storage and MPP for fast large aggregations; Redshift Spectrum queries S3 directly, and Serverless removes provisioning.
Related: Redshift Spectrum
IAM user
A long-lived identity representing a person or application that can hold long-term credentials such as a password or access keys. Best practice favors roles with temporary credentials for people, keeping the number of IAM users and long-term keys to a minimum.
Prerequisites: Temporary credentials
AWS Firewall Manager
A service that centrally applies and enforces WAF, Shield Advanced, security group, Network Firewall, and Route 53 Resolver DNS Firewall rules across the organization (Organizations), auto-applying to new accounts.
Prerequisites: Route 53 Resolver、AWS Organizations (consolidated billing)、Amazon Route 53、Route 53 Resolver DNS Firewall
API keys and usage plans
An API key is a token that identifies a client; alone it does not authenticate, but paired with a usage plan it enforces rate limits (requests per second) and quotas (e.g., monthly caps). Authentication itself is handled separately by a Lambda authorizer, IAM, or a Cognito authorizer.
Prerequisites: AWS Lambda、Amazon Cognito、Rate limiting
Related: API Gateway caching、API Gateway stage
Network ACL (NACL)
Traffic control at the subnet level; stateless (return traffic must be explicitly allowed), supports both allow and deny rules, and is the place to block a specific IP.
Prerequisites: Subnet
Related: Security group (AWS)
AWS Organizations (consolidated billing)
Groups multiple accounts for consolidated billing (volume discounts, central management) and SCPs for org-wide guardrails.
Compliance reporting
Assessing and reporting adherence to standards and regulations; continuously surfaced by AWS Config (rule compliance), Audit Manager (evidence collection), and Security Hub (aggregated scores).
Prerequisites: AWS Config、AWS Audit Manager
Related: Audit trail、Change management
Consumption-based pricing
Paying for what you actually use rather than reserved capacity; no up-front investment and less waste.
Prerequisites: DynamoDB capacity modes (on-demand / provisioned + Auto Scaling)
Amazon Data Firehose
Delivers streams to S3/Redshift/OpenSearch with no code. It supports buffering, Lambda transforms, and Parquet conversion, but keeps no retention for replay.
Prerequisites: AWS Lambda、Amazon OpenSearch Service
Related: Kinesis Data Streams、Data Firehose features (buffering/transform/dynamic partitioning)
Amazon OpenSearch Service
A managed search engine strong at full-text search and log analytics/observability, visualized via OpenSearch Dashboards (Kibana). Redshift leads for large aggregation analytics; use OpenSearch for search/log use cases.
Prerequisites: Amazon Redshift
AWS X-Ray
Distributed tracing: records the segments/subsegments and latency a request passes through and pinpoints bottlenecks/errors via the service map; samples a subset. Complements logs ("what happened").
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: X-Ray sampling and subsegments
High availability (HA)
Designing so a service keeps running despite failures (redundancy, availability zones, etc.).
Multi-Region (active-active / active-standby)
Deploying across Regions for regional-failure resilience and low latency. Active-active = both Regions serve traffic (highly available, costlier, data-consistency challenges); active-standby = one stands by (promoted on failover). Built with Route 53, Global Accelerator, and global tables.
Prerequisites: AWS Global Accelerator
AWS Site-to-Site VPN
An IPsec VPN connecting on-premises to a VPC over the internet—quick and cheap, with two redundant tunnels per connection. Lower bandwidth than Direct Connect but also used as its backup.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: AWS Direct Connect
S3 access control (bucket policy/ACL/ownership)
A bucket policy is a bucket-level resource policy (the recommended control); ACLs are legacy object/bucket permissions (now recommended to disable). Object Ownership’s “bucket owner enforced” disables ACLs to consolidate on policies; Block Public Access is the backstop.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)
AWS Secrets Manager
Securely stores secrets (DB credentials, API keys) with automatic rotation via Lambda. More feature-rich than SSM Parameter Store (rotation, cross-account sharing) and billed per secret/use.
Prerequisites: API keys and usage plans、Parameter Store
Related: Secrets Manager automatic rotation
AWS Global Accelerator
Provides two static anycast IPs and gets users onto the AWS backbone from the nearest edge to reach the optimal Region with low latency. It supports TCP/UDP on any port and enables second-scale regional failover based on health checks (no caching). A traffic dial on the endpoint group throttles flow.
Prerequisites: Anycast、Performance metrics (IOPS/throughput/bandwidth/latency)
Audit trail
A traceable record of who did what and when; in AWS, CloudTrail records API calls for tamper detection and incident investigation.
Prerequisites: AWS CloudTrail
Related: Change management、Compliance reporting
AWS Artifact
Obtain AWS compliance reports and agreements (ISO/SOC audit artifacts) on demand.
Prerequisites: Audit trail、Pricing models (On-Demand / Savings Plans·RI / Spot)、Compliance reporting
AWS Config
Records resource configuration and evaluates compliance with rules (tracks config changes).
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)
AWS WAF
A web application firewall that inspects and blocks malicious HTTP requests (e.g., SQL injection, XSS) using managed rules and rate limits; attaches to CloudFront, ALB, and API Gateway.
Prerequisites: Amazon CloudFront、Amazon API Gateway、Rate limiting
Related: AWS Shield (Standard/Advanced)
Amazon Bedrock Knowledge Bases
A managed RAG capability: Bedrock ingests data sources (e.g., S3) and handles chunking, embedding generation, storage in a vector store (OpenSearch Serverless/Aurora pgvector, etc.), retrieval, and cited answers—delivering grounded generation without building your own retrieval stack.
Prerequisites: Chunking (splitting strategy)
Related: OpenSearch Serverless (vector engine)、Amazon Bedrock
AWS Cost Explorer
Visualizes cost and usage over time, by service, and by tag for trend analysis and forecasting; also provides RI/Savings Plans recommendations and reserved utilization/coverage reports.
Related: AWS Budgets
Amazon QuickSight
A serverless BI dashboard service. Visualizes from Athena/Redshift/RDS sources, accelerated by SPICE (in-memory), with row/column-level security, natural-language Q, and embedding. Its role is visualization—not a query engine itself.
Prerequisites: Amazon Redshift、Amazon Athena、Serverless (FaaS)
AWS Step Functions
Orchestrates multi-step workflows as a state machine, declaratively handling branching, parallelism, retries, error handling, and waits to sequence Lambda and other services.
Prerequisites: AWS Lambda
Principal
The actor that performs an action in IAM—an IAM user, role, AWS service, another account, or a federated identity. It is what a Principal element in a resource-based or trust policy names when specifying who is granted access.
Prerequisites: Trust policy
Related: Resource-based policy
Resource-based policy
A policy attached to a resource itself—such as an S3 bucket policy or SQS queue policy—that defines who can access that resource. Because it includes a Principal element, it can grant access to a principal in another account that doesn't own the resource, making it the standard way to enable cross-account access.
Prerequisites: Cross-account access、S3 access control (bucket policy/ACL/ownership)
Related: Principal、Identity-based policy
Loose coupling (decoupling)
A design that separates components via queues (SQS), notifications (SNS), or events (EventBridge) instead of direct calls—so failures/load on one side don’t cascade, and parts scale and deploy independently while buffering spikes.
Prerequisites: Data Firehose features (buffering/transform/dynamic partitioning)
SageMaker inference options
Choose among four by requirement. Real-time = always-on, low latency (Auto Scaling; many models via multi-model endpoints). Serverless = scales to zero when idle (intermittent; cold starts). Asynchronous = queue large payloads/long-running. Batch transform = offline scoring of a whole dataset with no endpoint.
Prerequisites: Amazon SageMaker、Auto Scaling、ML data preparation (encoding/scaling/imbalance)、Performance metrics (IOPS/throughput/bandwidth/latency)
Choosing SageMaker built-in algorithms
Choose by task and output type. Tabular classification/regression → XGBoost (gradient-boosted trees robust to missing/scale); Linear Learner for linear/sparse; Factorization Machines for recommendations. Clustering → K-Means, dimensionality reduction → PCA, streaming anomaly detection → Random Cut Forest. Time-series forecasting → DeepAR (one model across many series, probabilistic, strong at cold start); text classification/embeddings → BlazingText (Word2Vec). No-code optimization → Autopilot (AutoML).
Prerequisites: Amazon SageMaker、k-means clustering、SageMaker Autopilot、CloudWatch alarms (composite/anomaly)
Related: Gradient boosting、Ensemble learning (bagging/boosting)
Polling vs. webhook (push/pull)
Two integration styles. Polling (pull) periodically queries (simple but adds latency/waste); webhooks (push) call you on events (immediate, efficient, but the receiver must be available). On AWS, EventBridge/SNS are push; SQS receive is pull.
Chunking (splitting strategy)
Splitting documents into smaller pieces (chunks) suited to embedding and retrieval in RAG. Strategies include fixed-size, overlapping, hierarchical, and semantic chunking (splitting at meaning boundaries); size and overlap drive retrieval accuracy and context quality—too small loses context, too large adds noise.
AWS Compute Optimizer
Uses ML to analyze usage of EC2, EBS, Lambda, Auto Scaling groups, etc., detecting over/under-provisioning and recommending right-sizing. A starting point for cost optimization.
Prerequisites: Auto Scaling、AWS Lambda、ML data preparation (encoding/scaling/imbalance)
Amazon EventBridge
A serverless event bus at the core of event-driven architectures. It ingests events from many sources, filters via rules, and routes to targets like Lambda or Step Functions, loosely coupling services.
Prerequisites: AWS Lambda、AWS Step Functions、Loose coupling (decoupling)、SNS fan-out and event-driven
AWS PrivateLink
A way to connect privately from a VPC to AWS services or another account's services without traversing the internet; traffic stays within the AWS network and avoids public routes.
Route 53 routing policies
Policies that control how DNS responds: failover routing (to standby via health checks), latency routing (to the nearest region), weighted routing (proportional split), geolocation routing, and more—improving availability and performance.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon Route 53
Amazon Detective
A service that builds an entity behavior graph from GuardDuty/CloudTrail/VPC Flow Logs to investigate the timeline, scope, and root cause of an attack from a finding. GuardDuty does detection; Detective does investigation.
Prerequisites: AWS CloudTrail、Amazon GuardDuty、Blast radius
Secrets Manager automatic rotation
Periodically auto-updates credentials (e.g., for databases) via Lambda to reduce leak risk and toil. RDS/Aurora support built-in rotation.
Prerequisites: AWS Lambda、Amazon Aurora、Toil
Related: AWS Secrets Manager
Public / private subnet
A public subnet has a route to an internet gateway (IGW) for direct external traffic; a private subnet has no IGW route and reaches out via a NAT gateway. Best practice: place only public-facing resources in public subnets.
Prerequisites: Route table、Subnet
Related: Internet gateway (IGW)
Temporary credentials
Short-lived credentials issued by STS (access key, secret key, and session token); they auto-expire, so leak risk is lower than embedded long-term keys.
Prerequisites: DynamoDB TTL (auto-expiry)
Bedrock inference modes (on-demand/provisioned)
On-demand bills per use; provisioned throughput reserves capacity (model units) for stable, large-scale, low-latency inference. Inference on custom/fine-tuned models generally requires provisioned throughput (on-demand support is model-dependent).
Prerequisites: Amazon Bedrock、Pricing models (On-Demand / Savings Plans·RI / Spot)、Performance metrics (IOPS/throughput/bandwidth/latency)
VPC endpoint implementation (private DNS / endpoint policy)
Enabling private DNS on an interface endpoint resolves the service’s normal name to the ENI’s private IP, switching to the private path with no code change. An endpoint policy (resource-based IAM) limits which APIs/resources are allowed through the endpoint and, combined with an S3 bucket policy aws:sourceVpce condition, can restrict access to a specific endpoint only. A gateway VPC endpoint is for S3/DynamoDB only—free, via the route table.
Prerequisites: Amazon DynamoDB、Resource-based policy、Route table、S3 access control (bucket policy/ACL/ownership)
Related: VPC endpoint types and private DNS
Cooldown and warmup
Cooldown suppresses the next scaling evaluation for a set period right after Auto Scaling takes a scaling action, preventing excessive back-to-back scaling (flapping) while metrics catch up. Warmup is the grace period before a newly launched instance is counted into target tracking scaling's average-value calculation.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)、Auto Scaling policies and lifecycle hooks
Edge location
Sites that cache/deliver content near users (Amazon CloudFront) for low-latency delivery.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon CloudFront
AWS Resource Groups
A feature that groups resources by conditions such as tags, resource type, or CloudFormation stack into one logical collection. Once grouped, they can be targeted together for Systems Manager Automation, Patch Manager, or monitoring dashboards.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Patch Manager、AWS Systems Manager (SSM)
Related: Tag Editor、AWS CloudFormation
Amazon VPC
Your private network in AWS; divided into public/private subnets, with traffic controlled by security groups/NACLs.
Prerequisites: Network ACL (NACL)、Security group (AWS)、Subnet
Block storage
Low-latency storage the OS mounts as a volume (EBS); suited to databases and boot disks. Most volumes attach to a single instance, but configurations like EBS Multi-Attach allow simultaneous attachment from multiple instances.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: File storage、Object storage
Capacity planning / demand forecasting
Estimating future load to plan needed capacity, cost, and scaling policy. In the cloud, Auto Scaling and predictive scaling follow demand dynamically, avoiding fixed over-provisioning; Compute Optimizer and CloudWatch trend analysis feed it.
Prerequisites: Auto Scaling scaling policies、Auto Scaling、Amazon CloudWatch、ML data preparation (encoding/scaling/imbalance)
Cost and Usage Report (CUR)
The most granular billing data report AWS provides. It outputs hourly usage, pricing, and discount breakdowns in CSV/Parquet to S3, serving as the source data for advanced analysis and chargeback via Athena or QuickSight.
Prerequisites: Cost allocation (chargeback/showback)、Amazon Athena、Amazon QuickSight
Cost governance
Organizationally governing cloud spend: alert via Budgets and anomaly detection; visualize with cost allocation tags and categories; curb over-provisioning via SCPs/Service Quotas; optimize with purchase options (RI/SP/Spot). The operational basis of FinOps.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、Cost allocation (chargeback/showback)、AWS Budgets、AWS Cost Explorer
Amazon RDS Proxy
A fully managed proxy that pools and shares connections to RDS/Aurora, preventing connection exhaustion for Lambda-heavy apps and shortening failover; integrates IAM auth and Secrets Manager.
Prerequisites: AWS Lambda、Amazon RDS、Managed services (management boundary)、AWS Secrets Manager
Glue Data Catalog
A central metadata store of tables, schemas, and partitions, referenced as shared metadata by Athena, Redshift Spectrum, and EMR.
Prerequisites: Amazon Redshift、AWS Glue
Related: Amazon Athena、Redshift Spectrum
DNS / name resolution (record types)
Translates domain names to IPs. Key records: A (IPv4), AAAA (IPv6), CNAME (alias; not at apex), MX (mail), TXT (verification), NS (delegation). AWS Alias records are a CNAME alternative that can point to AWS resources at the apex; TTL controls cache duration.
Related: Alias records
Amazon Inspector
A service that continuously scans and assesses EC2, ECR container images, and Lambda for known vulnerabilities (CVEs). Findings carry severity scores, can aggregate into Security Hub, and can be wired into CI/CD pipelines to block deploys of vulnerable images.
Prerequisites: AWS Lambda
Amazon Cognito
App user auth/authorization. User pool = sign-up/sign-in (authentication) issuing JWTs; identity pool = exchange tokens for temporary AWS credentials (AWS authorization). Supports external-IdP federation and MFA.
Event source mapping and destinations
Event source mapping polls SQS/Kinesis/DynamoDB Streams to invoke Lambda. Tune batch size/window, and route failures to destinations or a DLQ.
Prerequisites: Amazon DynamoDB、AWS Lambda、Kinesis Data Streams、Polling vs. webhook (push/pull)
ECS task execution role
The IAM role the ECS agent itself uses to launch containers—pulling images from ECR, shipping logs to CloudWatch Logs, and fetching secrets from Secrets Manager/SSM Parameter Store for environment variables. It is distinct from the task role and is never exposed to the application code.
Prerequisites: AWS IAM、CloudWatch Logs、Amazon CloudWatch、ECS task role
EventBridge Pipes
Point-to-point pipes that connect a source (SQS, Kinesis, DynamoDB Streams, etc.) directly to a target. Optional filtering, enrichment (e.g., via Lambda), and transformation steps can sit in between, often removing the need to write a separate Lambda just for integration glue.
Prerequisites: Amazon DynamoDB、AWS Lambda、AWS Glue、Kinesis Data Streams
Related: EventBridge Scheduler
Conversation history / session memory
Storing and referencing prior turns so multi-turn conversations keep context—persisted in DynamoDB, etc., and passed back to the prompt as a summary/relevant subset to avoid context overflow. Bedrock Agents handle memory per session.
Prerequisites: Agents for Amazon Bedrock、Amazon Bedrock、Amazon DynamoDB
Related: Context window overflow
Trust policy
A special resource policy attached to an IAM role that defines who may assume it (who can call sts:AssumeRole). It is distinct from the identity-based policy that grants the role's own permissions—both must align for the role to actually be assumable.
Prerequisites: AWS IAM、Identity-based policy、IAM policy structure (Effect/Action/Resource/Condition)
Related: AssumeRole
Lambda invocation models (sync/async/stream)
Synchronous waits for the result (e.g., API Gateway); asynchronous queues and runs later, retrying automatically with a dead-letter queue/Destinations on failure; stream/poll uses event source mappings (SQS/Kinesis). Failure handling differs by model.
Prerequisites: AWS Lambda、Kinesis Data Streams、Amazon API Gateway、Polling vs. webhook (push/pull)
CIDR notation
A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.
Object storage
Virtually unlimited storage that manages data by key and is accessed over HTTP (S3); suited to backups, distribution, and data lakes, with a flat namespace rather than a hierarchy.
Related: Block storage、File storage
OpenSearch Serverless (vector engine)
OpenSearch without provisioning that offers k-NN vector search; used as a default vector store for Bedrock Knowledge Bases, retrieving relevant chunks fast via approximate nearest-neighbor search over embeddings. Aurora pgvector or Pinecone are alternatives.
Prerequisites: Amazon Bedrock、Amazon Aurora、Amazon OpenSearch Service、Chunking (splitting strategy)
Related: Amazon Bedrock Knowledge Bases
Fault tolerance
Designing so the service keeps running despite component failures—stronger than high availability (fast recovery): it continues without interruption. Achieved via redundant parallel paths (active/active), N+1, and spreading across AZs (auto-recovery, which involves a brief recovery, is more an HA technique).
Prerequisites: High availability (HA)
Single point of failure (SPOF)
A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.
Prerequisites: RDS Multi-AZ and read replicas
Reliability
The ability to recover from and withstand failures/disasters; if HA means "do not fall," reliability means "get back up."
Route 53 Resolver DNS Firewall
A service that evaluates DNS queries issued from a VPC against domain lists and blocks resolution of malicious or unapproved domains. It is used to detect and stop malware C2 communication and data exfiltration via DNS tunneling; query logs can be exported as DNS logs to CloudWatch Logs or S3.
Prerequisites: Route 53 Resolver、Amazon Route 53、CloudWatch Logs、DNS / name resolution (record types)
DynamoDB design features (GSI/DAX/Global Tables)
Global secondary indexes (GSI) enable alternate-key queries, DAX adds microsecond caching, Global Tables provide multi-Region active replication, and Streams emit change events. Capacity is on-demand or provisioned.
Prerequisites: Amazon DynamoDB、Pricing models (On-Demand / Savings Plans·RI / Spot)
AssumeRole
An STS API operation that assumes a specified IAM role to obtain temporary credentials; a trust policy restricts who may assume it. The basis for cross-account and third-party access.
Prerequisites: AWS IAM、Temporary credentials
Related: Trust policy
AWS Control Tower
Automates setup and governance of multi-account environments. It builds a landing zone and applies guardrails (mandatory/recommended preventive and detective controls) to stand up a best-practice org quickly.
Prerequisites: Amazon Detective
S3 encryption and public-access prevention
S3 data protection. Choose encryption from SSE-S3 (AWS-managed key), SSE-KMS (CMK control, CloudTrail audit), or DSSE-KMS (double encryption). Prevent accidental exposure with Block Public Access (account & bucket) + restrictive bucket policy + ACL disablement.
Related: DSSE-KMS (dual-layer server-side encryption)、S3 access control (bucket policy/ACL/ownership)
AWS Certificate Manager (ACM)
Provisions and auto-renews SSL/TLS certificates for free, integrated with ELB/CloudFront/API Gateway to prevent expiry-related outages; auto-renewal is most reliable with DNS validation (email validation can also auto-renew conditionally).
Prerequisites: Amazon CloudFront、Amazon API Gateway、TLS
Related: AWS Private Certificate Authority
AWS Shield (Standard/Advanced)
A DDoS protection service. Standard is free and automatic (L3/L4) for all AWS; Advanced (paid) adds L7 protection, 24/7 DRT support, cost protection, and detailed reporting—paired with WAF.
Related: AWS WAF
Auto Scaling policies and lifecycle hooks
Scaling methods: target tracking (hold a metric at target), step, scheduled, and predictive. Lifecycle hooks insert initialization or draining at launch/terminate.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)
AWS Config rules and remediation
Config rules (managed/custom) continuously evaluate resource configuration for compliance, bundled by conformance packs, with non-compliance auto-remediated via SSM Automation.
Prerequisites: AWS Config
Related: SSM Automation (runbooks)
Internet gateway (IGW)
A horizontally scaled, redundant VPC component that enables communication between a VPC and the internet. When a public subnet’s route table points to the IGW and resources have public IPs, two-way internet communication is possible. For outbound-only, use a NAT gateway (IPv4) or an egress-only internet gateway (IPv6).
Prerequisites: Public IPv4 address behavior、Route table、Subnet
Related: Public / private subnet、Centralized egress and egress-only IGW
X-Ray sampling and subsegments
Sampling traces only a fraction of requests (rate controlled by rules) to limit overhead and cost. Segments/subsegments are the service spans/internal work (e.g., DB calls) within a trace; annotations add filterable metadata.
Related: AWS X-Ray
Vector databases
Stores embedding vectors for nearest-neighbor search, used as the retrieval layer for RAG. On AWS, options include OpenSearch Service (k-NN), pgvector on Aurora/RDS, MemoryDB, and DocumentDB (Amazon Kendra is not a vector DB but a separate managed-search service).
Prerequisites: Amazon Kendra、Amazon Aurora、Amazon DocumentDB、Amazon MemoryDB
MTU and jumbo frames
The maximum packet size on a path: up to 9001 within a VPC (jumbo frames), 1500 over an IGW/VPC peering, 8500 over Transit Gateway, and up to 1500 over Site-to-Site VPN (less in practice with IPsec). Exceeding a smaller MTU with the DF bit set requires path MTU discovery’s ICMP (Fragmentation Needed); blocking it in an SG/NACL causes the classic failure where connections establish but large transfers hang.
Prerequisites: Network ACL (NACL)、ICMP、AWS Site-to-Site VPN、Transit Gateway
Route 53 Resolver
The mechanism handling hybrid DNS resolution for a VPC. An inbound endpoint accepts queries from on-premises into VPC resources (Amazon-provided DNS), while an outbound endpoint forwards queries from the VPC to on-premises DNS servers according to conditional forwarding rules. Used when on-prem and cloud need to share a single namespace.
Prerequisites: Amazon Route 53、DNS / name resolution (record types)
Related: Route 53 Resolver endpoints
API Gateway caching
A per-stage response cache. For a configured TTL it returns a stored response for identical requests instead of invoking the backend (e.g., Lambda), cutting latency and backend load. Cache size is chosen from 0.5GB to 237GB and is billed hourly.
Prerequisites: AWS Lambda、Amazon API Gateway、Performance metrics (IOPS/throughput/bandwidth/latency)
Auto Scaling scaling policies
Auto Scaling adjustment methods: target tracking (keep a metric at a target—recommended, simplest), step scaling (graded steps by breach size), simple scaling (one adjustment then cooldown), scheduled scaling (time-based), and predictive scaling (ML forecast).
Prerequisites: Cooldown and warmup、Auto Scaling、ML data preparation (encoding/scaling/imbalance)、Auto Scaling policies and lifecycle hooks
AWS CodeBuild
A fully managed build/test service; compiles and tests source per steps defined in buildspec.yml and produces artifacts. Pay-per-use with no build servers to manage.
Prerequisites: Consumption-based pricing、Managed services (management boundary)
Related: CodeDeploy (deployment groups/agent)
AWS KMS
A managed service to create, manage, and rotate encryption keys, called KMS keys (formerly known as CMKs/Customer Master Keys). It encrypts data in S3, EBS, etc. and controls key use through IAM and key policies, auditing via CloudTrail. KMS keys come in types such as AWS managed and customer managed keys—the two terms are not synonymous.
Prerequisites: AWS CloudTrail、Managed services (management boundary)
AWS Marketplace
A catalog to find and procure third-party software (billed via your AWS invoice).
Amazon RDS
A managed relational (SQL) database service supporting MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server engines; AWS handles patching, backups, Multi-AZ redundancy, and read replicas.
Prerequisites: RDS Multi-AZ and read replicas
Amazon S3
Object storage for images, backups, and assets with high durability, accessed over HTTP(S); optimize cost via storage classes (Standard/IA/Glacier).
Prerequisites: Durability and availability (nines)、Object storage
AWS Trusted Advisor
Checks/recommends best practices across cost, security, fault tolerance, performance, and service limits (for your environment).
Prerequisites: Fault tolerance
Provisioned throughput optimization
Operating Bedrock provisioned throughput (reserving model units for stable capacity) efficiently: monitor utilization and reserve for peaks while shifting off-peak to on-demand. Cheaper for steady high load; on-demand wins for sporadic load.
Prerequisites: Bedrock inference modes (on-demand/provisioned)、Amazon Bedrock、Pricing models (On-Demand / Savings Plans·RI / Spot)、Throughput optimization (generative AI)
CloudWatch Network Monitor
A service that actively probes the network paths of hybrid connectivity between on-premises and AWS (Site-to-Site VPN, Direct Connect), monitoring latency and packet loss. It helps isolate whether a fault lies on the AWS side or the on-premises side.
Prerequisites: AWS Direct Connect、Amazon CloudWatch、AWS Site-to-Site VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: CloudWatch Internet Monitor
Containerization
Packaging an app and its dependencies into one image that runs the same anywhere. Lighter and faster to start than VMs, with higher density and portability. On AWS, run via ECR (registry) + ECS/EKS (orchestration) + Fargate (serverless).
Prerequisites: AWS Fargate、Serverless (FaaS)
Control types (preventive/detective/responsive)
Categories of security controls: preventive (stop it happening—SCPs, IAM, SGs), detective (find what happened—Config, GuardDuty, CloudTrail), and responsive/corrective (auto-fix—SSM Automation, Config remediation). Layered together; Control Tower guardrails follow this model.
Prerequisites: AWS CloudTrail、Amazon GuardDuty、AWS Control Tower、Amazon Detective
AWS Budgets
Sets budget thresholds on cost/usage/RI-SP coverage and alerts on actual or forecast overruns; Budget Actions can auto-apply IAM policies or stop resources.
Related: AWS Cost Explorer
Container Insights / Lambda Insights
CloudWatch extensions that automatically collect detailed operational metrics and logs (CPU, memory, disk, network) for ECS/EKS containers and Lambda functions. They feed dashboards and anomaly-detection alarms, surfacing bottlenecks specific to container and serverless platforms.
Prerequisites: AWS Lambda、Amazon CloudWatch、Serverless (FaaS)
CloudWatch Logs export to S3
A feature that exports logs accumulated in CloudWatch Logs to an S3 bucket for long-term retention, cost optimization (tiering to Glacier), or analysis in another tool. The export runs as a non-real-time batch job; for continuous streaming delivery, a subscription filter to Kinesis Data Firehose is used instead.
Prerequisites: CloudWatch Logs、Amazon Data Firehose、Kinesis Data Streams、Amazon CloudWatch
CloudWatch Metric Streams
Continuously delivers metrics in near real time to S3 or third parties (e.g., Datadog) via Data Firehose—lower latency and load than polling with GetMetricData for integrating external monitoring.
Prerequisites: CloudWatch metrics、Amazon Data Firehose、Amazon CloudWatch、Performance metrics (IOPS/throughput/bandwidth/latency)
CloudWatch ServiceLens
A CloudWatch feature that correlates metrics, logs, and X-Ray traces in a single view. It visualizes where latency or errors occur on a service map, speeding up root-cause analysis (RCA) in distributed systems.
Prerequisites: Amazon CloudWatch、AWS X-Ray、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Container Insights / Lambda Insights、CloudWatch Synthetics
CloudWatch Synthetics
A CloudWatch feature that runs canaries (configurable scripts) on a schedule to monitor endpoints and user flows from the outside, mimicking real users. It can detect availability or latency degradation before real traffic is affected, complementing SLA monitoring and health checks.
Prerequisites: Amazon CloudWatch、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Container Insights / Lambda Insights、CloudWatch ServiceLens
DynamoDB capacity modes (on-demand / provisioned + Auto Scaling)
On-demand requires no capacity management and auto-follows demand (unpredictable load, pay-per-use); provisioned sets RCUs/WCUs with Auto Scaling tracking a utilization target (cheaper for predictable load; reserved capacity adds discounts). Choose by load profile.
Prerequisites: Auto Scaling、Amazon DynamoDB、Pricing models (On-Demand / Savings Plans·RI / Spot)、ML data preparation (encoding/scaling/imbalance)
AWS Lake Formation
Centralizes data-lake permissions. Grants column/row/cell-level access on Glue Data Catalog tables, applied consistently to Athena/Redshift Spectrum/EMR. LF-Tags (tag-based access control) enable governance at scale by attribute, covering granularity IAM alone struggles with.
Prerequisites: Amazon Redshift、Amazon Athena、Glue Data Catalog、AWS Glue
Amazon Macie
A service that uses ML to discover and classify sensitive data (PII, credentials, etc.) in S3. It supports data-protection compliance, and findings can aggregate into Security Hub for continuous monitoring.
Durability and availability (nines)
Durability = probability of not losing data (S3 is 99.999999999%—eleven nines—virtually no loss). Availability = probability the service is reachable (e.g., 99.99% ≈ 52 minutes/year of downtime). They are distinct; SLAs are usually stated as availability.
DynamoDB capacity and TTL
Capacity is on-demand (auto, pay-per-request) or provisioned (RCU/WCU, Auto Scaling). TTL auto-deletes expired items, PartiQL gives SQL-like access, and throttling is retried with exponential backoff.
Prerequisites: Auto Scaling、Amazon DynamoDB、Pricing models (On-Demand / Savings Plans·RI / Spot)、ML data preparation (encoding/scaling/imbalance)
Dedicated Host
An EC2 placement option that dedicates an entire physical server to one customer. Sockets, cores, and the host ID are visible, which matters when bringing your own socket/core-based software licenses (BYOL). It costs more than Dedicated Instances but lets you control instance placement on the same host.
Related: Dedicated Instance
Edge computing
Processing near users/data (the edge) to cut latency. On AWS via CloudFront/Lambda@Edge/CloudFront Functions (delivery edge), Local Zones and Wavelength (low-latency zones), and Outposts (on-premises).
Prerequisites: CloudFront origin protection (OAC) and edge functions、Edge extensions (Local Zones / Outposts / Wavelength)、Amazon CloudFront、AWS Lambda
Elasticity
Automatically scaling capacity with load (autoscaling); scalability made automatic.
Prerequisites: ML data preparation (encoding/scaling/imbalance)、Scalability
File storage
Storage exposed as a shared file system that many clients can access concurrently (EFS, FSx), organizing files in a directory hierarchy.
Related: Block storage、Object storage
Data Firehose features (buffering/transform/dynamic partitioning)
Buffering accumulates by size/time before delivery (avoiding many tiny files); Lambda transformation processes records pre-delivery; format conversion turns JSON into Parquet/ORC; dynamic partitioning splits S3 paths by content to improve Athena query efficiency.
Prerequisites: AWS Lambda、Amazon Athena、JSON
Related: Amazon Data Firehose
Continuous monitoring for generative AI (drift/bias)
Operations that continuously monitor production generation quality, auto-detecting data drift, bias drift, guardrail violations, and cost/latency anomalies to drive remediation—combining CloudWatch metrics, Bedrock logs, model evaluations, and human review.
Prerequisites: Bedrock Model Evaluations、Amazon Bedrock、CloudWatch metrics、Amazon CloudWatch
Horizontal scaling (scale out)
Scaling by adding more instances to spread the load. It assumes a stateless design plus a load balancer and auto scaling, and since one instance failing doesn't take down the whole system, it also improves fault tolerance. Considered the default direction in cloud-native design.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)、Fault tolerance、Scalability
HTTPS
HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.
Related: TLS
AWS SAM (Serverless Application Model)
An extension that lets you write CloudFormation concisely for serverless (Lambda/API Gateway/DynamoDB); its short syntax expands into a CloudFormation template at deploy, and sam local enables local run/test.
Prerequisites: AWS CloudFormation、Amazon DynamoDB、AWS Lambda、Amazon API Gateway
Identity-based policy
A policy attached to an IAM user, group, or role that defines what that principal can do. It comes as managed policies (AWS- or customer-managed) or inline policies, and is the basic form of granting permissions within the same account.
Prerequisites: IAM inline policy、Principal、IAM user
Related: Resource-based policy
IAM inline policy
A policy embedded directly inside a single IAM user, group, or role, tied strictly one-to-one to that identity. It can't be attached to or reused by another identity, and it disappears when its identity is deleted. It's used for narrow cases where exactly one identity needs an exceptional permission.
Prerequisites: AWS IAM、IAM user
Related: IAM managed policy
Idempotency key pattern
A design pattern where the client attaches a unique key to each request and the server caches that key's result so a resend with the same key is not re-executed. It guards against network retries or SQS at-least-once delivery causing the same operation (e.g., a duplicate payment) to run twice; a common implementation checks first-use of the key with a DynamoDB conditional write.
Prerequisites: Amazon DynamoDB、Delivery semantics (at-least-once/exactly-once)、DynamoDB write control (conditional/transactions)
Related: Optimistic locking、Pessimistic locking
Launch template
A versioned definition bundling launch settings (AMI, instance type, user data, networking) used by Auto Scaling and Spot; the older launch configuration is legacy.
Prerequisites: Auto Scaling、Pricing models (On-Demand / Savings Plans·RI / Spot)、User data、ML data preparation (encoding/scaling/imbalance)
MCP (Model Context Protocol)
An open protocol that standardizes how LLM applications connect to tools and data sources. Where each integration once needed bespoke glue code, exposing a capability as an MCP server lets any MCP-aware client (agent) call it in a common format. On AWS, tools implemented in, e.g., Lambda are commonly exposed this way as MCP servers.
Prerequisites: AWS Lambda、AWS Glue、ML data preparation (encoding/scaling/imbalance)
Related: Function calling
Rate limiting
Capping the number of requests accepted per unit of time to protect downstream systems from overload and abuse (DoS, scraping, etc.). Commonly implemented as API-gateway throttling or a web-application-firewall rate-based rule.
Related: WAF rules (managed/rate-based)
PII masking (generative AI)
A safeguard that redacts—replaces or masks—tokens of personally identifiable information (PII) found in generative-AI inputs, outputs, and logs. Detections from Amazon Comprehend or Bedrock Guardrails' sensitive-information filters mask the relevant spans in prompts, responses, and logs to prevent data leakage and compliance violations.
Prerequisites: Amazon Bedrock、Amazon Comprehend、Sensitive data protection (PII / masking)
Related: Bedrock Guardrails
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: HTTPS
Prompt governance
Governing prompts as managed assets: template, version, and deploy (aliases) them via Bedrock Prompt Management, constrain deviations with Guardrails, and audit API operations/access via CloudTrail/CloudWatch Logs—making it traceable who used which prompt version and when.
Prerequisites: Amazon Bedrock Prompt Management、Amazon Bedrock、AWS CloudTrail、CloudWatch Logs
RDS Multi-AZ and read replicas
Multi-AZ provides HA via a synchronous standby with automatic failover (for availability), while read replicas scale reads via async replication (for performance)—distinct purposes.
Prerequisites: High availability (HA)
Amazon SNS
Publish/subscribe messaging that fans out one message to many subscribers (push-based, 1:many); SNS + SQS forms a fan-out pattern.
Prerequisites: Polling vs. webhook (push/pull)
Amazon SQS
A fully managed message queue that decouples producers/consumers and buffers work to absorb spikes (pull-based, typically 1:1).
Prerequisites: Loose coupling (decoupling)、Managed services (management boundary)、Polling vs. webhook (push/pull)
Service Quotas
A service to centrally view and request increases to AWS service quotas (limits), used to manage scaling ceilings in large designs.
Prerequisites: ML data preparation (encoding/scaling/imbalance)
Scalability
Adjusting capacity to demand; scale up = vertical (bigger machine), scale out = horizontal (more machines).
AWS Audit Manager
A service that continuously collects and organizes audit evidence against regulatory frameworks (PCI DSS/HIPAA/SOC 2) to support audit reporting. Its role differs from configuration-compliance evaluation (Config) and finding aggregation (Security Hub).
Prerequisites: Compliance programs and AWS Artifact
KMS key policies and grants
Access to a KMS key is controlled by the key policy (resource-based, the ultimate source of permission), combined with IAM policies and grants (temporary, programmatic delegation). Multi-Region keys replicate across Regions.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Resource-based policy、Multi-Region (active-active / active-standby)
SSM Automation (runbooks)
Runs operational tasks and auto-remediation via runbooks (defined procedures), automating fixes triggered by EventBridge or Config findings.
Related: AWS Config rules and remediation
SSM Document
A JSON/YAML definition of actions Systems Manager runs. Types include Command documents (for Run Command), Automation documents (runbooks), and Session documents; both AWS-provided and custom exist.
Prerequisites: JSON、Run Command、AWS Systems Manager (SSM)、SSM Automation (runbooks)
Tag Editor
A console tool that searches existing resources across an account and lets you bulk-add, edit, or remove tags. It is used to retroactively enforce a tagging strategy or bulk-apply cost allocation tags, avoiding opening each resource individually to edit tags.
Prerequisites: Cost allocation (chargeback/showback)、AWS Cost Explorer、IAM policy structure (Effect/Action/Resource/Condition)、Tagging strategy
Related: AWS Resource Groups
Tagging strategy
A consistent policy for applying key/value tags to resources—used for cost allocation (chargeback), automation (targeting), access control (ABAC), and inventory; enforced/monitored via tag policies, cost allocation tags, and Config.
Prerequisites: Cost allocation (chargeback/showback)、AWS Cost Explorer、Tag policies (Organizations)、ABAC (attribute-based access control)
TCP
A reliability-focused transport-layer protocol that establishes a connection (three-way handshake), guarantees ordering, and retransmits lost data. Used for HTTP, SSH, database connections, and anywhere data loss or reordering is unacceptable.
Prerequisites: Message ordering、Reliability
Related: ICMP、Port number、UDP
Transit Gateway attachment
The unit representing each thing connected to a Transit Gateway—a VPC, a VPN, a Direct Connect gateway, a Direct Connect transit VIF, or a peering to another TGW. Each attachment associates with exactly one TGW route table, which determines what it can communicate with.
Prerequisites: Direct Connect architecture (VIF / DX Gateway / LAG)、AWS Direct Connect、Route table、Transit Gateway
UDP
A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.
Prerequisites: Message ordering、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: ICMP、Port number、TCP
VPC endpoint
The entry point that privately connects a VPC to AWS services; interface endpoints create an ENI (via PrivateLink, for many services) and gateway endpoints serve S3/DynamoDB (via route table, free).
Prerequisites: Amazon DynamoDB、Route table、AWS PrivateLink
VPC endpoint types and private DNS
Gateway type (S3/DynamoDB only, via route table, free) and interface type (PrivateLink, ENI + private IP, many services, hourly cost). Enabling private DNS resolves the public service name through the endpoint transparently.
Prerequisites: Amazon DynamoDB、Route table、AWS PrivateLink、VPC endpoint
Related: VPC endpoint implementation (private DNS / endpoint policy)
VPC/subnet quotas
The limits governing VPC network design—such as VPCs per Region and subnets per VPC—which can be checked and increase-requested via Service Quotas. By contrast, the subnet CIDR size range (/16 to /28) is a fixed architectural specification of VPC/subnets, not a Service-Quotas-adjustable value. A subnet's own CIDR block cannot be changed after creation, but a VPC's address space can be expanded by adding secondary CIDR blocks.
Prerequisites: CIDR notation、Service Quotas、Subnet、Secondary CIDR block
Related: Subnet reserved addresses
WAF logging
A feature that sends details of requests WAF inspected—matched rule, action taken, headers, etc.—to CloudWatch Logs, S3, or Kinesis Data Firehose. Used to investigate false positives and tune rules.
Prerequisites: CloudWatch Logs、Amazon Data Firehose、Kinesis Data Streams、Amazon CloudWatch
Related: WAF Bot Control
Inference types (real-time/batch)
Real-time inference responds per request at low latency; batch inference processes large data asynchronously in bulk. Choose by latency needs and cost.
Prerequisites: SageMaker inference options、Performance metrics (IOPS/throughput/bandwidth/latency)
Amazon Bedrock AgentCore
An agent platform to run production AI agents with any framework (CrewAI/LangGraph/LlamaIndex/Strands) and any model. Modular services: Runtime (serverless, session isolation), Memory (short/long-term), Gateway (turn APIs/Lambda into MCP tools), Identity (agent auth), Code Interpreter, Browser, and Observability—no infrastructure to manage.
Prerequisites: Strands Agents、Amazon Bedrock、AWS Lambda、Serverless (FaaS)
Amazon Comprehend
A task-specific AI service that analyzes text (sentiment, entities, key phrases).
Amazon Kendra
An intelligent search service that queries enterprise documents in natural language; ingests varied data sources via connectors and returns relevant passages (also used as a retrieval layer for RAG).
Related: Amazon Lex
Amazon Lex
A service to build conversational bots (chatbots/IVR) for voice and text; design dialogs with intents and slots and implement logic via Lambda. Same technology as Alexa.
Prerequisites: AWS Lambda
Related: Amazon Kendra
Accelerated Site-to-Site VPN
An option that routes VPN traffic through AWS Global Accelerator edge locations onto the AWS backbone network as early as possible, reducing latency and jitter over the public internet segment. Useful for geographically distant sites or latency-sensitive workloads.
Prerequisites: AWS Global Accelerator、Edge location、AWS Site-to-Site VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
Alias records
A Route 53-specific record that resolves to AWS resources (ELB, CloudFront, S3, API Gateway) even at the zone apex. It works like a CNAME at no extra charge.
Prerequisites: Amazon CloudFront、Amazon Route 53、Amazon API Gateway
Related: DNS / name resolution (record types)
CloudFront origin protection (OAC) and edge functions
Origin Access Control (OAC, formerly OAI) keeps S3 private while allowing access only via CloudFront; it is the current recommendation, supporting SSE-KMS, all Regions, and all HTTP methods. For edge compute, choose by use: ultra-light, viewer-only CloudFront Functions (header tweaks/redirects/URL rewrites) versus Lambda@Edge, which can hook origin events and make external calls.
Prerequisites: Amazon CloudFront、AWS Lambda、S3 encryption and public-access prevention
Direct Connect architecture (VIF / DX Gateway / LAG)
A virtual interface (VIF) is the logical connection unit over Direct Connect: a private VIF to a VPC, a public VIF to AWS public services, and a transit VIF to a Transit Gateway. A Direct Connect Gateway connects multiple Regions/VPCs together, and a LAG (link aggregation group) bundles physical links for more bandwidth (resiliency is separate—use multiple locations).
Prerequisites: AWS Direct Connect、Performance metrics (IOPS/throughput/bandwidth/latency)、Transit Gateway
Edge extensions (Local Zones / Outposts / Wavelength)
Extensions bringing AWS closer to users: Local Zones place compute/storage in metros, Outposts put AWS racks on-prem, and Wavelength sits inside 5G networks for ultra-low latency.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Anycast
A communication mode that advertises the same IP address from multiple locations at once, automatically routing traffic to the topologically nearest node. CDNs, DNS, and global load-balancing services use it as the foundation for low latency and high availability.
Prerequisites: High availability (HA)、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Unicast
API Gateway stage
A named environment (e.g., dev/prod) bound to a specific deployment of an API. Stage variables let backend targets differ per environment, and canary releases can route a portion of traffic to a new deployment. Each stage can carry its own settings such as throttling and log level.
Prerequisites: Amazon API Gateway、API Gateway features (stages, throttling, integrations)
AWS (Amazon Web Services)
One of the largest public clouds, offering compute, storage, databases, networking, and more on a pay-as-you-go basis.
Prerequisites: Consumption-based pricing、Public cloud
AWS App Runner
A fully managed service that automatically builds, deploys, and scales web apps/APIs from source code or a container image. It exposes containerized apps without managing load balancers, autoscaling, or certificates—lower operational overhead than ECS/Fargate. In DevOps, the choice for running a simple container web service with minimal ops.
Prerequisites: AWS Fargate、Containerization、Managed services (management boundary)
Availability Zone (AZ)
One or more isolated datacenters within a Region (separate power/cooling/network); spreading across AZs gives high availability.
Prerequisites: High availability (HA)
AWS CLI
The official tool for operating AWS services from the command line. It manages profiles/credentials and Region settings and is used to automate within shell scripts and CI/CD steps, calling APIs directly as `aws <service> <operation>` with JSON output you can post-process (e.g., with jq).
Prerequisites: JSON
AWS Copilot (CLI)
A command-line tool to build, deploy, and operate containerized apps on ECS/Fargate/App Runner. Declaring a service type (e.g., Load Balanced Web Service) and environments (test/prod) generates the underlying CloudFormation, pipelines, and logging. Unrelated to GitHub Copilot.
Prerequisites: AWS App Runner、AWS CloudFormation、AWS Fargate、Containerization
Amazon EC2
Virtual servers (IaaS), the most flexible compute where you manage the OS and above; optimize via purchasing options (On-Demand/RI/Savings Plans/Spot).
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、IaaS (Infrastructure as a Service)
AWS Health Dashboard
Shows AWS service health and events affecting your resources (AWS-side status; distinct from Trusted Advisor, which advises on your environment).
Prerequisites: AWS Trusted Advisor
Amazon Managed Grafana
A fully managed Grafana. It visualizes and alerts on metrics/logs/traces from multiple data sources (CloudWatch, Prometheus, X-Ray, etc.) in a single dashboard—an observability "visualization" layer without self-managing Grafana.
Prerequisites: Amazon CloudWatch、AWS X-Ray、Managed services (management boundary)
Region (AWS)
A geographically separate area made of multiple Availability Zones (usually 3+); chosen by latency, compliance, cost, and service availability.
Prerequisites: Availability Zone (AZ)、Performance metrics (IOPS/throughput/bandwidth/latency)
Root user
The all-powerful account-creation user; protect with MFA, avoid daily use, and use IAM users/roles instead.
Prerequisites: AWS IAM
Security group (AWS)
A virtual firewall controlling traffic at the instance (ENI) level; stateful (return traffic auto-allowed) and allow-rules only (no deny rules).
Related: Network ACL (NACL)
Compliance programs and AWS Artifact
AWS complies with third-party certifications (ISO, SOC, PCI DSS, HIPAA, FedRAMP) and provides their audit reports on demand via AWS Artifact. Scope is shared per the shared responsibility model.
Prerequisites: AWS Artifact、Pricing models (On-Demand / Savings Plans·RI / Spot)、Shared responsibility model
CloudFront geo restriction
A per-distribution control that allows or blocks delivery using a country-code allow list or deny list. It's used to satisfy content-licensing or export-regulation requirements that are geography-specific. Because it judges location from IP geolocation, it can be bypassed via VPNs.
Prerequisites: Amazon CloudFront、Route 53 routing policies、SCP deny-list strategy
Related: CloudFront automatic compression
CloudFront invalidation
An operation that forcibly removes cached content from CloudFront edge locations before its TTL expires (by path), so the next request fetches fresh content from the origin. The first 1,000 paths per month are free, but frequent invalidation adds cost and slight latency, so cache policies or versioned filenames are the generally recommended alternative.
Prerequisites: Amazon CloudFront、Edge location、CloudFront cache policy、Performance metrics (IOPS/throughput/bandwidth/latency)
CloudFront signed URL
A URL that restricts access to a single file by expiry, IP, or a custom policy. Because one signed URL maps to exactly one object, distributing many files (e.g., video segments) means generating one per request; it is signed with a CloudFront key pair or a trusted key group.
Prerequisites: Amazon CloudFront、S3 developer features (presigned URLs, encryption)、X-Ray sampling and subsegments
Related: CloudFront signed cookies
CloudTrail event types (management/data/Insights)
Management events = control-plane API actions (recorded by default, free). Data events = high-volume data operations like S3 object access or Lambda invokes (opt-in, paid). Insights events detect unusual API call-rate anomalies.
Prerequisites: AWS CloudTrail、AWS Lambda
Related: CloudTrail advanced configuration
Amazon ECS (Elastic Container Service)
AWS-native container orchestration: describe containers in a task definition and run them on the EC2 launch type (self-managed) or the Fargate launch type (serverless); scales by task/service.
Prerequisites: AWS Fargate、Serverless (FaaS)
Context window optimization
Designing to make efficient use of a model's context window (a finite token budget). In RAG, retrieve and pass only the most relevant chunks; for conversation history, compress via summarization or trim old turns—keeping irrelevant information out to balance answer quality against latency and cost.
Prerequisites: Conversation history / session memory、Performance metrics (IOPS/throughput/bandwidth/latency)、Chunking (splitting strategy)
Related: Context window overflow
Cross-account access
Access where a principal in one account assumes a role in another via AssumeRole; permitted by a trust policy, with ExternalId guarding against the confused-deputy problem for third parties.
Prerequisites: Principal、Trust policy、AssumeRole
CloudWatch alarm states
An alarm has three states: OK (within threshold), ALARM (breached), and INSUFFICIENT_DATA (not enough data—at startup or on missing metrics). Each transition can trigger actions (SNS notify, Auto Scaling, EC2 action).
Prerequisites: Auto Scaling、Amazon CloudWatch、EC2 status checks and auto recovery、ML data preparation (encoding/scaling/imbalance)
Connection pooling
A mechanism that pre-establishes database connections and holds them in a pool, avoiding the overhead of opening a new connection per request and preventing connection exhaustion. Amazon RDS Proxy is the flagship example, and it matters most for serverless/high-concurrency apps like Lambda.
Prerequisites: AWS Lambda、Amazon RDS、Amazon RDS Proxy、Serverless (FaaS)
Amazon DocumentDB
A managed MongoDB-compatible document database, fitting workloads with flexible JSON-like documents.
Prerequisites: JSON
Amazon EMR
A managed big-data platform running Apache Spark/Hadoop/Hive/Presto on clusters. Fits very large custom distributed processing and migrating existing Hadoop/Spark assets (Glue is simpler for lightweight serverless ETL).
Prerequisites: AWS Glue、Serverless (FaaS)
Glue crawler
Scans data sources to infer schema and partitions, automatically registering/updating table definitions in the Glue Data Catalog.
Prerequisites: Glue Data Catalog
Related: AWS Glue
Redshift Spectrum
Queries S3 data directly from Redshift. Without loading, it joins across the data lake and warehouse, referencing the Glue Data Catalog.
Related: Amazon Redshift、Glue Data Catalog、AWS Glue
API Gateway features (stages, throttling, integrations)
Stages (dev/prod) separate deployments with stage variables; throttling and caching protect and speed up; Lambda proxy integration and mapping templates transform requests/responses; CORS is configured.
Prerequisites: AWS Lambda、Amazon API Gateway
S3 developer features (presigned URLs, encryption)
Presigned URLs grant temporary upload/download permission, multipart upload parallelizes large objects, and encryption is chosen among SSE-S3, SSE-KMS, SSE-C, and client-side.
Prerequisites: S3 performance features (Transfer Acceleration / S3 Select)、S3 encryption and public-access prevention
EBS snapshots
Incrementally backs up an EBS volume to S3 (only changes after the first). Snapshots can be copied across AZ/Region, turned into AMIs, and shared. Fast Snapshot Restore (FSR) removes first-touch latency; Data Lifecycle Manager automates schedules.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon Data Lifecycle Manager (DLM)
On-Demand Capacity Reservation
Reserves needed instance capacity in a specific AZ without a long-term commitment—ensuring critical or DR workloads can launch when needed; combinable with Savings Plans for discounts (capacity assurance + cost optimization).
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、DynamoDB capacity and TTL
Instance Metadata Service (IMDS)
An endpoint at 169.254.169.254 that lets an EC2 instance read its own data (instance ID, the IAM role’s temporary credentials, user data, etc.). IMDSv2 requires a session token to prevent credential theft via SSRF (enforcing it is recommended).
Prerequisites: AWS IAM、User data、Instance metadata (IMDSv2)、Temporary credentials
Asynchronous processing (generative AI)
Handling slow generations or large batches by decoupling request/response: enqueue jobs in SQS, process with Lambda workers, and return results via storage/notification. Avoids timeouts, absorbs spikes, and levels cost; combine with Bedrock batch inference.
Prerequisites: Amazon Bedrock、AWS Lambda、Loose coupling (decoupling)
Related: Inference types (real-time/batch)
In-Region resilience (capacity/throttling)
Designing generative-AI calls to withstand capacity pressure and throttling: capacity reservation (provisioned throughput), queue + exponential-backoff retries, fallback across models, and cross-Region inference—maintaining availability.
Prerequisites: Bedrock inference modes (on-demand/provisioned)、Cross-Region Inference、On-Demand Capacity Reservation、Performance metrics (IOPS/throughput/bandwidth/latency)
GenAI monitoring (specific metrics / golden dataset)
Quality monitoring specific to generative AI: track accuracy, grounding rate, toxicity, refusal rate, and latency/cost, and detect regressions against a golden dataset (a benchmark set of inputs and expected outputs). Combine CloudWatch, Bedrock logs, and human evaluation.
Prerequisites: Amazon Bedrock、Amazon CloudWatch、Performance metrics (IOPS/throughput/bandwidth/latency)
Throughput optimization (generative AI)
Optimization to raise generative-AI processing volume: efficient token processing, batch inference, concurrency management, provisioned throughput, and caching—maximizing work per unit time while avoiding throttling.
Prerequisites: Bedrock inference modes (on-demand/provisioned)、Inference types (real-time/batch)、Performance metrics (IOPS/throughput/bandwidth/latency)
Health check types and thresholds
Designing health determination: shallow checks (process liveness) vs deep checks (real functionality including dependencies). Healthy/unhealthy thresholds (consecutive successes/failures) confirm state and reduce flapping; interval and timeout are tuned too. Used by ELB, Route 53, and Auto Scaling.
Prerequisites: Auto Scaling、Amazon Route 53、ML data preparation (encoding/scaling/imbalance)
Instance profile (IAM role for EC2)
A container that passes an IAM role to EC2: instead of embedding access keys, the instance fetches auto-rotating temporary credentials via instance metadata (lower leak risk). IMDSv2 is recommended.
Prerequisites: AWS IAM、Instance metadata (IMDSv2)、Secrets Manager automatic rotation、Temporary credentials
ICMP
A protocol for control and diagnostic messages rather than data transfer. It powers ping (reachability checks) and traceroute (path checks), and carries unreachable/TTL-exceeded notifications—essential for diagnosing network connectivity issues.
Related: Port number、TCP、UDP
Principle of least privilege
A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.
Prerequisites: AWS IAM、Blast radius
Message ordering
A guarantee that messages are processed in send order. Standard SQS/SNS do not guarantee order (high throughput); FIFO guarantees order per message group. When order matters, address it with group-ID design or a single consumer.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: FIFO (ordering / deduplication)
Microservices
An architectural style splitting an application into small, independent services that can each be deployed, scaled, and failed in isolation—at the cost of more inter-service communication and operational complexity. Commonly built on containers or serverless compute plus an API gateway.
Prerequisites: Amazon API Gateway、Serverless (FaaS)
Related: Monolith
Endpoint auto-scaling
Scales the instance count of a real-time inference endpoint by load to balance cost and latency; serverless inference can scale to zero.
Prerequisites: ML data preparation (encoding/scaling/imbalance)、SageMaker inference options、Performance metrics (IOPS/throughput/bandwidth/latency)、Serverless (FaaS)
AWS Billing and Cost Management
The umbrella for billing and cost management—billing dashboard, cost allocation tags, budgets (Budgets), and cost analysis (Cost Explorer)—to track, allocate, and optimize ML training/inference cost.
Prerequisites: Cost allocation (chargeback/showback)、AWS Budgets、AWS Cost Explorer
Modality mapping (preprocessing routing)
Routing preprocessing to the right AWS service by input type: documents/images → Textract, audio → Transcribe, general image understanding → Rekognition/multimodal FM, text normalization → Comprehend—extracting and normalizing before passing to generative AI.
Prerequisites: Amazon Comprehend、Amazon Rekognition、Amazon Textract、Amazon Transcribe
Multi-account strategy
Separating workloads, environments, and teams by account to delimit billing, security, and blast radius. Governed with Organizations + OUs + SCPs, and Control Tower vends standardized accounts (account vending). A landing zone is the foundation.
Prerequisites: AWS Organizations (consolidated billing)、ML data preparation (encoding/scaling/imbalance)、Blast radius、AWS Control Tower
Broadcast
A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.
Prerequisites: Public cloud、X-Ray sampling and subsegments
NAT instance vs. NAT gateway
Two ways to provide egress for private subnets. A NAT gateway is managed, highly available (redundant in an AZ), and auto-scaling (recommended). A NAT instance is a self-run EC2 (requires disabling source/destination check, is a single point of failure, cheap/special-purpose).
Prerequisites: ML data preparation (encoding/scaling/imbalance)、Single point of failure (SPOF)、Subnet、Public / private subnet
Three pillars of observability (metrics/logs/traces)
Three signals to understand a system from outside: metrics (numeric time-series for trends/alerts), logs (records of discrete events for root cause), and traces (a request’s path and latency for bottlenecks). On AWS, CloudWatch + X-Ray provide these.
Prerequisites: Amazon CloudWatch、AWS X-Ray、Performance metrics (IOPS/throughput/bandwidth/latency)
Optimistic locking
A concurrency-control technique that compares a version number or timestamp at update time and lets the write succeed only if no one else has changed the record. It doesn't lock upfront, so concurrency stays high; DynamoDB conditional writes (ConditionExpression) are the classic implementation, with conflicts resolved by retrying.
Prerequisites: Amazon DynamoDB
Related: Idempotency key pattern、DynamoDB write control (conditional/transactions)
Tag policies (Organizations)
An Organizations feature that enforces standard tag keys/allowed values org-wide and detects non-compliant tags—ensuring the tag consistency that cost allocation and ABAC depend on. Distinct from SCPs (SCPs govern permissions; tag policies govern tags).
Prerequisites: AWS Organizations (consolidated billing)、Cost allocation (chargeback/showback)、ABAC (attribute-based access control)
Sensitive data protection (PII / masking)
Protecting sensitive data such as PII (personally identifiable information) and PHI: discover/classify with Macie, then protect via encryption, access control, and minimization. Masking/tokenization hides values, and handling varies by data classification; also prevent sensitive data leaking into logs.
Prerequisites: Text preprocessing (tokenization/TF-IDF/n-gram)
Related: Amazon Macie
Provisioned vs. serverless
A capacity-model contrast. Provisioned reserves capacity ahead (predictable, steady load—can be cheaper); serverless auto-follows demand, pay-per-use, no capacity management (intermittent/unpredictable load). A choice across Aurora, DynamoDB, Lambda, etc.
Prerequisites: Amazon DynamoDB、AWS Lambda、Amazon Aurora、Serverless (FaaS)
S3 Bucket Key
A feature that, when encrypting with SSE-KMS, reuses a short-lived bucket-level data key instead of calling KMS per object, sharply cutting the number of KMS API calls. It reduces KMS API cost and request-based throttling, and is recommended whenever a workload stores large volumes of objects under SSE-KMS.
Prerequisites: Envelope encryption and data keys、S3 encryption and public-access prevention
Related: S3 default encryption、DSSE-KMS (dual-layer server-side encryption)
S3 default encryption
A setting that automatically encrypts newly stored objects in a bucket. Today it is on by default for every S3 bucket (SSE-S3) and cannot be turned off; switching to SSE-KMS or DSSE-KMS lets you meet stronger key-management or compliance requirements.
Prerequisites: EBS encryption、DSSE-KMS (dual-layer server-side encryption)、S3 encryption and public-access prevention
Related: S3 Bucket Key
S3 Object Lambda
A feature that inserts a Lambda function between an S3 GET request and the underlying bucket to transform the response data on the fly. It enables use cases like PII masking, image resizing, or CSV-to-JSON conversion without changing application code or duplicating the data.
Prerequisites: AWS Lambda、JSON、Sensitive data protection (PII / masking)、PII masking (generative AI)
SNS fan-out and event-driven
Fan-out from one SNS topic to multiple SQS queues or Lambdas enables decoupled parallel processing. EventBridge routes events to many targets via rules.
Prerequisites: AWS Lambda、Loose coupling (decoupling)、Amazon SNS
Resource Access Manager (RAM)
Shares specific AWS resources (Transit Gateway, subnets, licenses, etc.) across accounts and the organization, letting multiple accounts use them without duplication.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Transit Gateway、Subnet
Schema Conversion Tool (SCT)
A tool that converts schema and stored procedures for heterogeneous DB migrations (e.g., Oracle → Aurora PostgreSQL), reporting what cannot be converted. Unnecessary for same-engine moves, where DMS alone suffices.
Prerequisites: Amazon Aurora
VPC peering
A one-to-one direct connection between two VPCs. It is non-transitive, so connecting many VPCs becomes a hard-to-manage full mesh—use Transit Gateway at scale.
Related: Transit Gateway
IAM Access Analyzer
A service supporting least privilege via external-access analysis (detect externally exposed S3/roles/KMS/Secrets), unused-access analysis (surface unused roles/permissions/access keys), policy validation, and least-privilege policy generation from CloudTrail.
Prerequisites: AWS CloudTrail
CloudTrail advanced configuration
An organization trail centrally records all accounts, log file validation detects tampering, and data events record S3 object/Lambda invocations in detail. CloudTrail Lake enables SQL query analysis.
Prerequisites: AWS CloudTrail、AWS Lambda
Instance metadata (IMDSv2)
A scheme requiring a session token (PUT→GET) to access EC2 instance metadata, preventing SSRF-based theft of the instance role’s temporary credentials. The recommendation is to disable IMDSv1 and enforce IMDSv2.
Prerequisites: Temporary credentials
WAF rules (managed/rate-based)
AWS WAF evaluates rules in a Web ACL: AWS managed rule groups (common threats, OWASP, bots), rate-based rules (limit IPs exceeding a threshold), and custom rules.
Prerequisites: AWS WAF
Related: Rate limiting
Amazon Security Lake
A service that automatically centralizes and normalizes security logs/events (to the OCSF standard schema) into an S3 data lake in a dedicated account. It aggregates VPC Flow Logs, CloudTrail, Route 53, and various AWS/third-party security data for cross-source analysis with Athena/OpenSearch.
Prerequisites: AWS CloudTrail、Amazon Route 53、Amazon Athena、Amazon OpenSearch Service
CloudWatch alarms (composite/anomaly)
Alarms that notify/act when a metric crosses a threshold. Composite alarms combine conditions with AND/OR, and anomaly detection flags deviations from a dynamic baseline.
Prerequisites: Amazon CloudWatch
Elastic IP and placement groups
An Elastic IP is a remappable static public IP. Placement groups control physical instance placement: cluster (low latency), spread (fault isolation), or partition (large distributed).
Prerequisites: Placement groups (cluster/spread/partition)、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Public IPv4 address behavior
AWS Health (Personal Health Dashboard)
Notifies events affecting your account (maintenance, issues, deprecations). Today this is the 'Your account health' view of the AWS Health Dashboard (formerly the Personal Health Dashboard); overall status is shown by 'Service health' (formerly the Service Health Dashboard).
Related: AWS Health Dashboard
SSM Inventory
A Systems Manager capability that collects metadata—installed software, applications, network configuration, and more—from managed instances into a central view. Collected data can feed Athena/QuickSight for compliance assessment and asset inventory.
Prerequisites: Amazon Athena、Amazon QuickSight、AWS Systems Manager (SSM)
Related: SSM State Manager
Transit Gateway route table
A route table that controls reachability between the attachments connected to a Transit Gateway. Combining association (which route table an attachment resolves routes through) with propagation (whether another attachment's routes are auto-injected) implements segmentation between environments such as production and development.
Prerequisites: Route table、Transit Gateway、X-Ray sampling and subsegments
Transit Gateway vs. VPC peering
Choosing a connectivity model. VPC peering is 1:1 and non-transitive (A-B and B-C don’t let A reach C), so full mesh explodes in management. Transit Gateway is hub-and-spoke, aggregating many VPCs/on-prem with route-table segmentation (for scale).
Prerequisites: Route table、Transit Gateway、VPC peering、X-Ray sampling and subsegments
Vertical scaling (scale up)
Scaling by upgrading a single instance's specs (CPU, memory, etc.). It requires little application change and is simple, but is capped by instance-type limits, tends to be a single point of failure, and often requires downtime to apply. The counterpart choice to horizontal scaling.
Prerequisites: Horizontal scaling (scale out)、ML data preparation (encoding/scaling/imbalance)、Single point of failure (SPOF)、Scalability
Dual-stack VPC (IPv4/IPv6)
A configuration where a single VPC/subnet runs both IPv4 and IPv6 addressing together. IPv6 addresses are all globally routable with no exhaustion concern, but to allow only outbound traffic and block inbound, an egress-only internet gateway is used.
Prerequisites: Centralized egress and egress-only IGW、Internet gateway (IGW)、Subnet
Related: Public IPv4 address behavior
Elastic Network Interface (ENI)
A virtual network card holding private IPs, Elastic IPs, security groups, and a MAC; it can be detached/attached between instances (failover). Multiple ENIs enable multi-homing or separating management/data traffic.
Prerequisites: Security group (AWS)、Elastic IP and placement groups
VPC flow log fields and destinations
Flow logs record source/destination IP, ports, protocol, bytes, and ACCEPT/REJECT, etc. Destinations are CloudWatch Logs, S3, or Data Firehose. Enabled per ENI/subnet/VPC for investigating rejected traffic and analyzing flows.
Prerequisites: CloudWatch Logs、Amazon Data Firehose、Amazon CloudWatch、Subnet
Six pillars of Well-Architected
Axes for sound design: operational excellence (operations/automation), security, reliability (fault tolerance/recovery), performance efficiency, cost optimization, and sustainability (environmental impact). Reviewed via the Well-Architected Tool to surface risks.
Prerequisites: Fault tolerance、Reliability
Related: AWS Well-Architected Framework
AI governance
A framework for governing generative AI across an organization: model cards (documenting use/limits), data/model lineage (provenance), CloudTrail audit trails, plus approval flows and access control—ensuring accountability, compliance, and reproducibility.
Prerequisites: Model transparency (AI Service/Model Cards)、Audit trail、AWS CloudTrail
Agents for Amazon Bedrock
Amazon Bedrock Agents (formerly Agents for Amazon Bedrock): a Bedrock capability that breaks tasks into steps and autonomously executes multi-step processing by calling APIs (action groups) and knowledge bases.
Prerequisites: Amazon Bedrock、Amazon Bedrock Knowledge Bases
Context window overflow
A condition where input+output tokens exceed the model context-window limit. Behavior varies by model/API (input truncation, error responses, or dropping old conversation history) and can cause cut-off answers or missing information; addressed with dynamic chunking, prompt design, and response-size limits.
Prerequisites: Chunking (splitting strategy)
Related: Conversation history / session memory、Context window optimization
Bedrock Model Invocation Logs
A logging capability that records each Amazon Bedrock request/response to S3 or CloudWatch Logs for detailed quality analysis and auditing.
Prerequisites: Amazon Bedrock、CloudWatch Logs、Amazon CloudWatch
Amazon Bedrock Prompt Flows
A Bedrock builder to visually link prompts, FMs, knowledge bases, and Lambda into GenAI workflows. Promote via working draft → immutable version → alias, with branching and sequential chains.
Prerequisites: Amazon Bedrock、AWS Lambda、Amazon Bedrock Knowledge Bases
Amazon Q
A ready-to-use generative AI assistant for business and coding (Amazon Q Business / Amazon Q Developer).
Amazon Rekognition
A task-specific AI service that analyzes images/video (objects, faces, moderation).
Amazon Textract
A task-specific AI service that extracts text and fields from documents/forms (OCR + structure).
Amazon Transcribe
An AI service that converts speech to text (ASR); used for transcribing calls, meetings, and media, with speaker diarization, custom vocabulary, and real-time or batch modes.
Managed prefix lists
Bundles multiple CIDRs into one named list referenced by security groups and route tables. Changing an entry propagates to all references, simplifying rule maintenance.
Prerequisites: Security group (AWS)、CIDR notation、Route table
Route 53 health checks and failover
Monitors endpoint health and, on failure, fails over to a healthy target via failover routing. It also supports calculated health checks and CloudWatch alarm integration.
Prerequisites: Amazon Route 53、Amazon CloudWatch、Route 53 routing policies
Transit Gateway appliance mode and centralized inspection
To inspect many VPCs’ traffic in one place (an inspection VPC), split TGW route tables to route through the inspection VPC. If forward and return traverse appliances in different AZs, asymmetric routing drops the return, so enable TGW appliance mode to pin a flow to the same-AZ appliance.
Prerequisites: Route table、Transit Gateway
Capacity Rebalancing
An Auto Scaling group feature that proactively launches a replacement instance as soon as AWS signals an elevated risk of Spot interruption, without waiting for the actual interruption notice. The existing instance is terminated only after the replacement is healthy, minimizing impact on availability.
Prerequisites: Auto Scaling、Pricing models (On-Demand / Savings Plans·RI / Spot)、ML data preparation (encoding/scaling/imbalance)
Instance refresh
Rolls an Auto Scaling group’s instances to a new launch template/AMI in batches, replacing them gradually while keeping a minimum healthy percentage—enabling immutable deployments.
Prerequisites: Auto Scaling、Launch template、ML data preparation (encoding/scaling/imbalance)
Mixed instances policy
Combines multiple instance types and an On-Demand/Spot ratio within one Auto Scaling group—resilient to Spot interruptions while balancing capacity assurance and cost savings.
Prerequisites: Auto Scaling、Pricing models (On-Demand / Savings Plans·RI / Spot)、ML data preparation (encoding/scaling/imbalance)
Warm pool
A mechanism that keeps pre-initialized instances (stopped or running) on standby in a separate pool ahead of an Auto Scaling group's scale-out. It cuts startup time far below launching from scratch during a demand spike, especially valuable for apps with heavy boot processes; the standby state (stopped vs. running) lets you trade off cost against responsiveness.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)、Scalability
Asynchronous replication
Replication that acknowledges first and applies to the replica afterward; low write latency but possible loss of not-yet-replicated data on failure. Used by read replicas and cross-Region replication; chosen vs. synchronous by RPO.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、Synchronous replication
Amazon EBS
Block storage—a virtual disk attached to EC2; one volume normally attaches to one instance (io1/io2 support Multi-Attach to several), while one instance can have many volumes. Types include gp3/io2, backed up via snapshots.
Prerequisites: Block storage
Amazon EFS
File storage—an NFS file system many EC2 can mount and share.
Prerequisites: File storage
Elastic Load Balancing (ELB)
Distributes traffic to healthy targets across instances/AZs; a staple for high availability.
Prerequisites: High availability (HA)
Free Tier
Ways to try AWS at no cost. New accounts since July 2025 get a credit-based plan (a fixed credit amount with a time limit) granted at sign-up; the traditional model has three forms—12-month free, always-free, and trials.
AWS License Manager
A service to centrally manage software licenses (BYOL—bring your own license). It defines licensing rules to prevent overage and tracks/reports usage based on dedicated hosts or core/socket counts—used for license compliance across an organization.
Prerequisites: Dedicated Host
AWS Private Certificate Authority
A managed service for running a private certificate authority (CA) for internal use. It issues private certificates that public ACM cannot, enabling mutual TLS (mTLS) between internal services and use cases like IoT device authentication where a public CA is inappropriate, including building a CA hierarchy.
Prerequisites: Managed services (management boundary)
Related: AWS Certificate Manager (ACM)
AWS Backup Audit Manager
Continuously evaluates whether backups comply with organizational policy (frequency, retention, encryption, cross-Region) and generates compliance reports—detecting unprotected resources and deviations to meet audit requirements.
Prerequisites: Compliance reporting、AWS Audit Manager、AWS Backup
Bedrock data privacy
In Bedrock, your inputs/outputs are not used to train the base models by default and data stays within your account. Connect privately via VPC endpoints (PrivateLink) without traversing the internet, encrypt with KMS, and audit with CloudTrail—foundational for generative AI on sensitive data.
Prerequisites: Amazon Bedrock、AWS CloudTrail、AWS PrivateLink
Centralized logging (log archive account)
A best practice of aggregating organization logs (CloudTrail, Config, VPC flow logs, app logs) into S3 in a dedicated log archive account, with tamper-proofing (Object Lock) and long-term retention. Control Tower’s landing zone provisions this by default.
Prerequisites: AWS CloudTrail、S3 Object Lock、AWS Control Tower
Change management
A management process for planning, assessing, approving, and recording changes to production so they can be applied safely with minimal impact (ITIL's change management is a representative example). Its core elements are approval workflows, controlling allowed change windows, and having a rollback procedure ready; AWS tools like SSM Change Calendar and Change Manager automate parts of this for AWS workloads specifically.
Prerequisites: SSM Change Calendar
Related: Audit trail、Compliance reporting
AWS Partners and support resources
Resources that support adoption and operations: AWS Partner Network (APN) certified partners, AWS Professional Services, AWS Marketplace, and the Knowledge Center/re:Post.
Prerequisites: AWS Marketplace
CloudFront automatic compression
A feature where CloudFront automatically compresses origin responses with Gzip or Brotli, cutting transfer size and speeding up rendering. It only applies when the origin returns an uncompressed response, the Content-Type is on the compressible (text-based) allowlist such as HTML/CSS/JS, and the object size is between 1,000 and 10,000,000 bytes; it's enabled per cache behavior. CloudFront picks the format (gzip or br) based on the viewer's Accept-Encoding header.
Prerequisites: Amazon CloudFront、ML data preparation (encoding/scaling/imbalance)
Related: CloudFront geo restriction
CodeDeploy (deployment groups/agent)
A deployment group bundles targets (EC2 tags, ASG, ECS/Lambda) and method (in-place/blue-green, canary/linear). appspec.yml defines lifecycle hooks to validate and auto-roll back on failure; EC2 needs the CodeDeploy agent.
Prerequisites: AWS Lambda、Auto Scaling policies and lifecycle hooks
Related: AWS CodeBuild
Config configuration recorder
The core AWS Config capability that continuously detects configuration changes on tracked resources and records them as time-series Configuration Items. Without enabling the recorder, neither Config rule evaluation nor the resource timeline works, and it must be enabled per Region.
Prerequisites: AWS Config、IAM policy structure (Effect/Action/Resource/Condition)、AWS Config rules and remediation
Amazon EKS (Elastic Kubernetes Service)
Managed Kubernetes: AWS runs the control plane; workers run on EC2 or Fargate. Chosen when you want to keep existing Kubernetes assets/ecosystem (more complex than ECS).
Prerequisites: AWS Fargate
Economies of scale
The idea that AWS aggregates many customers’ demand to lower unit costs, passing savings back as price cuts. Alongside pay-as-you-go, no upfront investment, and easy global reach, it’s a core cloud value proposition.
Prerequisites: Consumption-based pricing
Cost Optimization Hub
A Billing feature that consolidates cost-saving opportunities across the org (unused resources, right-sizing, Savings Plans/RI recommendations) ranked by estimated savings—aggregating recommendations from Compute Optimizer and Trusted Advisor.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、AWS Trusted Advisor、AWS Compute Optimizer
CloudWatch dashboard sharing
A feature that securely shares a CloudWatch dashboard with external parties who have no AWS account, or with non-logged-in users. There are three sharing methods: inviting up to 5 specific email addresses (each with their own Cognito-backed password), sharing a single dashboard as a public link with no authentication, and sharing all dashboards in the account via SSO/SAML integration. It lets you provide read-only access—like a status page—without granting IAM permissions.
Prerequisites: Amazon CloudWatch、Amazon Cognito、CloudWatch dashboards and Synthetics
CloudWatch metrics
The numeric time-series data CloudWatch handles, identified by namespace and dimensions and feeding alarms and dashboards; standard metrics (e.g., EC2) are collected automatically.
Prerequisites: Amazon CloudWatch
DynamoDB TTL (auto-expiry)
Sets an expiry-timestamp attribute on items so expired items are deleted automatically (without consuming write capacity). Auto-cleans transient data like sessions/logs to cut storage cost; deletions can also flow to DynamoDB Streams.
Prerequisites: Amazon DynamoDB、DynamoDB design features (GSI/DAX/Global Tables)
DDoS attack types (L3/L4 vs L7)
L3/L4 attacks saturate links/resources with volumetric packets (SYN flood, reflection/amplification)—absorbed by Shield/NLB/scrubbing. L7 attacks exhaust the app with legitimate-looking requests—mitigated by WAF rate-based rules and Shield Advanced. Layer defenses by tier.
Prerequisites: AWS Shield Advanced、WAF rules (managed/rate-based)、AWS Shield (Standard/Advanced)
AWS DMS (Database Migration Service)
A service for database migration and continuous replication. CDC (change data capture) ingests only deltas and syncs without stopping the source DB. Pair with SCT (Schema Conversion Tool) when schema conversion is needed.
Prerequisites: Schema Conversion Tool (SCT)
Amazon MemoryDB
A Redis-compatible, durable in-memory database for ultra-low-latency workloads that also need persistence (ElastiCache is for caching only).
Prerequisites: Durability and availability (nines)、Performance metrics (IOPS/throughput/bandwidth/latency)
Amazon S3 Tables
Managed storage for tabular data in Apache Iceberg format on S3, efficiently queryable from analytics engines (Athena/EMR/Spark) with automatic compaction to optimize tables.
Prerequisites: Amazon S3、Amazon Athena、Compaction (small-file consolidation)
Delivery semantics (at-least-once/exactly-once)
Guarantee levels for message delivery: at-least-once = may duplicate (standard SQS—needs idempotent handling); exactly-once = no duplicates or loss (SQS FIFO); at-most-once = may drop but no duplicates. Designs tolerate duplicates via idempotency.
AWS AppConfig
A Systems Manager capability to safely deliver app configuration and feature flags, with validation, gradual rollout, and automatic rollback (tied to CloudWatch alarms) to reduce risk.
Prerequisites: Amazon CloudWatch、AWS Systems Manager (SSM)
Systems Manager Incident Manager
A service that coordinates major-incident response. It manages response plans, escalation plans, on-call schedules (rotations), and contact channels; auto-triggers runbooks on occurrence, pages stakeholders, and supports post-incident analysis.
Prerequisites: Incident response and forensics、AWS Systems Manager (SSM)、SSM Automation (runbooks)
AWS Elastic Beanstalk
A PaaS that automates provisioning through deployment from uploaded code; choose a deployment method (all-at-once/rolling/immutable/traffic splitting) and codify settings via .ebextensions.
Prerequisites: PaaS (Platform as a Service)
DynamoDB write control (conditional/transactions)
Conditional writes prevent conflicts and optimistic locking (version number) detects overwrites. Multi-item consistency uses transactions (TransactWriteItems), and reads use Query (by key) vs Scan (full).
Prerequisites: Amazon DynamoDB
Related: Optimistic locking
Lambda configuration (layers, env vars, ephemeral storage)
Share common libraries via layers and pass settings via environment variables (KMS-encryptable). The /tmp ephemeral storage scales up to 10GB, and the memory setting also determines CPU allocation.
Prerequisites: AWS Lambda
Direct Connect vs. VPN
Comparing on-prem connectivity. Site-to-Site VPN is cheap and instant over the internet but has variable bandwidth/latency; Direct Connect is a dedicated link—stable, low-latency, high-bandwidth—but slower and costlier to set up. Critical links pair DX with VPN as backup.
Prerequisites: AWS Direct Connect、AWS Site-to-Site VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
EBS encryption
A feature that encrypts EBS volumes at rest with an AWS KMS key. Snapshots and AMIs created from an encrypted volume inherit the encryption, and default encryption can be enforced account/Region-wide. An existing unencrypted volume cannot be converted directly—it must be copied via a snapshot.
Prerequisites: AWS KMS、Encryption at rest
Public IPv4 address behavior
A standard auto-assigned public IPv4 address is dynamic and can change whenever the instance is stopped and started. To keep it fixed, a separately allocated, remappable Elastic IP is required (Elastic IP itself is a distinct concept).
Related: Dual-stack VPC (IPv4/IPv6)、Elastic IP and placement groups
User data
A bootstrap script run at an EC2 instance's first boot to automate package installation and configuration; by default it runs once at launch.
Related: Bootstrapping
ECS task role
The IAM role that the application code running inside the container assumes to call AWS APIs such as S3 or DynamoDB. It's the target for least-privilege scoping of the app's own permissions, specified via a task definition's taskRoleArn.
Prerequisites: Amazon DynamoDB、AWS IAM
Encryption at rest
Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.
Prerequisites: Object storage
Error rate
The proportion of failed requests out of total requests. It's one of the most common SLIs, used as a CloudWatch metric and alarm threshold; a sudden spike is often monitored as a signal of a deployment-caused failure or throttling.
Prerequisites: Amazon CloudWatch
Related: Toil
EventBridge rule
A rule that routes events matching an event pattern (match conditions on source/content) or a schedule to one or more targets (Lambda, SQS, Step Functions, etc.). A single rule can have multiple targets, and retry behavior or a dead-letter queue for failed deliveries can be configured.
Prerequisites: AWS Lambda、AWS Step Functions、Dead-letter queue (DLQ)
Eventual consistency
A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.
Prerequisites: High availability (HA)、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Strong consistency
Free Tier alert
AWS Billing notifications that warn by email as Free Tier usage nears its limit. For accounts created on/after 2025-07-15 under the new credit-based Free Tier, alerts fire when 50%/25%/10% of credits remain and at 15/7/2 days left in the free period. Often paired with AWS Budgets as an early warning against unexpected charges.
Prerequisites: Free Tier、AWS Budgets、AWS Billing and Cost Management
Evaluation reporting / model comparison
Evaluating multiple models or prompt configurations on common metrics/datasets and comparing them via visualizations and automated reports. Bedrock Model Evaluation (automatic metrics, human, LLM-as-a-judge) lines up accuracy/cost/latency to inform selection and improvement decisions.
Prerequisites: LLM-as-a-Judge、Amazon Bedrock、Performance metrics (IOPS/throughput/bandwidth/latency)
Gradient boosting
An ensemble technique that sequentially adds weak decision trees, each one trained to reduce the errors left by the trees before it (flagship implementations: XGBoost, LightGBM). A strong default for tabular data, and offered as a built-in algorithm by many managed ML services.
Prerequisites: Decision tree、Ensemble learning (bagging/boosting)
GuardDuty detector / threat lists
A detector enables GuardDuty per Region, analyzing CloudTrail, VPC flow logs, and DNS logs with ML and threat intelligence. You can add trusted IP lists (suppress false positives) and threat IP lists (custom block targets).
Prerequisites: AWS CloudTrail、Amazon GuardDuty
IaaS (Infrastructure as a Service)
Renting infrastructure such as VMs; you manage the OS and above—the most control (e.g., Azure Virtual Machines).
Infrastructure as Code (IaC)
Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.
Prerequisites: AWS CloudFormation
Service-linked role
A predefined IAM role dedicated to an AWS service so it can act on other resources on your behalf. Its permissions are predefined and protected from accidental breakage (e.g., used by Auto Scaling, ELB, Config). Unlike normal roles, it’s restricted from deletion/editing.
Prerequisites: Auto Scaling、AWS IAM、ML data preparation (encoding/scaling/imbalance)
Wildcard permission
Using "*" in a policy's Action or Resource (e.g., s3:*), which grants broader operations or resources than intended. This is a classic least-privilege violation, and IAM Access Analyzer policy validation or Access Advisor is used to detect and fix the excess.
Prerequisites: Access Advisor (last-accessed info)、IAM policy structure (Effect/Action/Resource/Condition)、IAM Access Analyzer
Kinesis consumers (enhanced fan-out / KCL)
The read side of Kinesis Data Streams. Standard consumers share a shard’s throughput; enhanced fan-out gives each consumer a dedicated 2 MB/s for low latency; the KCL (Kinesis Client Library) handles checkpointing and load balancing.
Prerequisites: Kinesis Data Streams、Performance metrics (IOPS/throughput/bandwidth/latency)、Amazon SNS
Lambda MCP server
A server implementation that exposes MCP (Model Context Protocol) tools on AWS Lambda—serving lightweight, stateless tools (search, compute, API calls) serverlessly so agents can call them in a standard form; scales with demand and is cost-efficient.
Prerequisites: AWS Lambda、MCP (Model Context Protocol)、Serverless (FaaS)
Iterative least-privilege tightening
An operating cycle that starts broad, then continuously removes unneeded permissions based on Access Analyzer’s unused access, actual usage in CloudTrail, and Access Advisor’s last-accessed data—tightening safely with generated policies.
Prerequisites: AWS CloudTrail、Access Advisor (last-accessed info)、IAM Access Analyzer
Function calling
The basic mechanism that lets an LLM use external tools or APIs. Given schemas (name, arguments, description) of callable functions, the model does not execute anything itself—it returns only a structured proposal (e.g., JSON) saying which function to call with which arguments, while the app performs the actual call and returns the result.
Prerequisites: JSON
Related: MCP (Model Context Protocol)
Hyperparameter optimization (HPO)
Automatically searching settings fixed before training (learning rate, tree depth, regularization, etc.) to optimize a metric—via grid/random search, Bayesian optimization, and early stopping. SageMaker Automatic Model Tuning is the prime example; evaluate on validation data to avoid overfitting.
Prerequisites: Amazon SageMaker、Automatic Model Tuning (HPO)、Key hyperparameters
Bring your own container (BYOC) and ECR
Packaging custom training/inference code as a Docker image stored in Amazon ECR and run on SageMaker, covering needs that built-in algorithms cannot.
Prerequisites: Amazon SageMaker、Amazon ECR (Elastic Container Registry)
SageMaker training jobs and distributed training
Managed jobs that train models with built-in algorithms or custom containers, using data/model-parallel distributed training and managed spot for large-scale, low-cost training.
Prerequisites: Amazon SageMaker、Pricing models (On-Demand / Savings Plans·RI / Spot)、Bring your own container (BYOC) and ECR
Key hyperparameters
Settings that control training: learning rate (step size), batch size, epochs, tree depth, and regularization strength—tuned to balance convergence and generalization.
Prerequisites: Decision tree
Multicast
A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.
Prerequisites: Broadcast、Transit Gateway、Unicast
Default route (0.0.0.0/0)
The catch-all route in a route table for destinations that match no more-specific route. In public subnets it points to an IGW; in private subnets to a NAT gateway—deciding the egress path.
Prerequisites: Route table、Subnet、Public / private subnet
Ephemeral port
A temporary high-numbered port (typically 1024–65535) a client uses for the return leg of a connection. Stateless firewall rules (e.g., network ACLs) must explicitly allow this range for return traffic to work—an easily overlooked source of misconfiguration.
Prerequisites: Network ACL (NACL)、Port number
Network Firewall stateful rules
Inspects traffic at VPC subnet boundaries with stateless rules (fast allow/deny) and stateful rules (connection tracking, Suricata-compatible signatures for domain/protocol inspection)—used for egress domain filtering and IPS.
Prerequisites: Connection tracking、AWS Network Firewall、Subnet
OpEx (operational expenditure)
Spending paid continuously as you consume it. Cloud pay-as-you-go billing follows this model, minimizing upfront investment and letting cost flex with demand. The CapEx-to-OpEx shift is commonly cited as a core financial benefit of moving to the cloud.
Prerequisites: CapEx (capital expenditure)、Consumption-based pricing
Pessimistic locking
A concurrency-control technique that acquires a lock on the target before updating and makes other transactions wait while it's held. It's safer than optimistic locking when contention is frequent, but it reduces concurrency and risks deadlocks. Distributed locks spanning multiple nodes are typically implemented with DynamoDB or similar.
Prerequisites: Amazon DynamoDB、Optimistic locking
Related: Idempotency key pattern
Private cloud
A cloud dedicated to one organization, built in-house or in a dedicated host, with control kept in-house.
Prerequisites: Dedicated Host
Public cloud
A shared cloud owned/operated by a provider (e.g., Azure); start immediately with no up-front investment.
Route 53 Resolver endpoints
Hybrid DNS. An inbound endpoint lets on-premises resolve names inside AWS; an outbound endpoint plus Resolver rules forward specific domains from AWS to on-premises DNS—enabling mutual name resolution between VPCs and on-prem.
Prerequisites: Amazon Route 53、DNS / name resolution (record types)
Related: Route 53 Resolver
RAG incremental update (delta re-embedding)
On knowledge-base updates, re-chunk and re-embed only the changed documents (not all) and apply to the vector store—cutting ingestion cost/latency while keeping data fresh. Knowledge Bases sync supports incremental ingestion.
Prerequisites: Amazon Bedrock Knowledge Bases、Performance metrics (IOPS/throughput/bandwidth/latency)、Chunking (splitting strategy)
Blast radius
The scope of impact from a failure, mistake, or breach. Kept small via account separation, multiple Regions/AZs, least privilege, and cell-based partitioning. Limiting blast radius is fundamental to resilience and security.
Robust FM API integration
Integrating FM APIs at production quality: streaming/async for perceived latency and throughput, exponential backoff + retry for throttling, X-Ray for distributed tracing, error logs and validation for diagnosis, and loose coupling (event-driven) to localize failures.
Prerequisites: AWS X-Ray、Loose coupling (decoupling)、Performance metrics (IOPS/throughput/bandwidth/latency)
DSSE-KMS (dual-layer server-side encryption)
A server-side encryption mode that applies two independent encryption layers to an S3 object using KMS keys. It targets regulated workloads with high-assurance requirements (mandated double encryption) that a single layer can't satisfy, such as FIPS 140-2 or ITAR contexts, at a higher processing cost than ordinary SSE-KMS.
Related: S3 Bucket Key、S3 encryption and public-access prevention
Multi-Region Access Point
A feature providing one global endpoint to access S3 buckets distributed across multiple Regions. Built on AWS Global Accelerator, it automatically routes requests to the Region closest to the requester, used for failover and latency improvement.
Prerequisites: AWS Global Accelerator、Multi-Region (active-active / active-standby)、Performance metrics (IOPS/throughput/bandwidth/latency)
S3 server access logging
Records detailed requests to a bucket (requester, operation, response) and stores them in another bucket—used for access analysis and security audits; CloudTrail data events complement it at the API level.
Prerequisites: AWS CloudTrail、CloudTrail event types (management/data/Insights)、CloudTrail advanced configuration
Aurora features (Serverless / Global Database)
Aurora is a durable DB replicating 6 copies across 3 AZs. Aurora Serverless v2 auto-scales to load, and Global Database replicates to multiple Regions at low latency for DR and reads.
Prerequisites: Amazon Aurora、Performance metrics (IOPS/throughput/bandwidth/latency)、Serverless (FaaS)
Caching layer design
Layered caching with CloudFront (edge), API caching, ElastiCache (in front of DBs), and DAX (in front of DynamoDB) to cut latency, backend load, and cost.
Prerequisites: Amazon CloudFront、Amazon DynamoDB、Performance metrics (IOPS/throughput/bandwidth/latency)
DR strategies (four)
Backup & restore (cheap/slow) → pilot light → warm standby → multi-site (costly/fast); shorter RTO/RPO costs more. Use cross-region replication + Route 53 failover for region-wide failures.
Prerequisites: Amazon Route 53
SaaS (Software as a Service)
Using finished software as-is; the provider manages almost everything (e.g., Microsoft 365).
AWS Batch
A managed service to run and schedule batch computing jobs at scale, automatically provisioning the needed compute (EC2/Fargate/Spot).
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、AWS Fargate、Managed services (management boundary)
AWS Management Console
The web console for operating and monitoring AWS resources via a GUI—one of the primary interfaces alongside CLI/SDK/IaC.
Application Migration Service (MGN)
The workhorse for rehosting on-prem or other-cloud servers to EC2 via agent-based, block-level continuous replication. Validate with test launches and minimize downtime at cutover.
Prerequisites: Migration strategies (the 7 Rs)
Multi-account network design
Aggregates many accounts/VPCs via a Transit Gateway or Cloud WAN hub, optimizing security and cost with a shared-services VPC, centralized egress, and centralized inspection (inspection VPC).
Prerequisites: AWS Cloud WAN、Transit Gateway appliance mode and centralized inspection、Transit Gateway
AWS Security Hub
Aggregates findings from GuardDuty, Inspector, Macie, Config, and more in ASFF format and presents compliance scores against CIS and the AWS Foundational Security Best Practices, visualizing security posture.
Prerequisites: Amazon GuardDuty、Amazon Inspector、Amazon Macie
AWS Service Catalog
Publishes approved IT services (CloudFormation products) as portfolios so users self-service-deploy standardized configurations, balancing governance and speed with guardrails.
Prerequisites: AWS CloudFormation
Amazon SES (Simple Email Service)
A scalable email sending/receiving service for transactional and marketing email with high deliverability and bounce/complaint handling.
Prerequisites: SES deliverability (bounces/configuration sets)
Savings Plans types
Purchase options giving discounts for a 1- or 3-year usage commitment. Compute Savings Plans are most flexible (EC2/Fargate/Lambda, across Regions/families); EC2 Instance Savings Plans lock to a family/Region for deeper discounts. More flexible than RIs.
Prerequisites: AWS Lambda、Pricing models (On-Demand / Savings Plans·RI / Spot)、AWS Fargate
ABAC (attribute-based access control)
An access model that decides access dynamically by attributes like tags. Matching aws:PrincipalTag with aws:ResourceTag in conditions (e.g., allow if the same department tag) scales without adding roles. Contrasted with role-based RBAC.
Incident response and forensics
The AWS incident-response flow and evidence preservation: prepare (playbooks/IR roles/always-on logs) → contain (isolation SG/quarantine VPC, disable credentials) → preserve evidence (volatile memory → EBS snapshot, stop not terminate) → analyze in an isolated environment. Immediate termination loses evidence.
Prerequisites: EBS snapshots
AWS Network Firewall
A managed network firewall that statefully inspects and filters VPC traffic. With domain allow-lists, IPS/IDS, and protocol inspection, it provides more advanced perimeter defense than SGs/NACLs.
Prerequisites: Network ACL (NACL)
AWS Shield Advanced
Advanced protection against large DDoS attacks: always-on detection, response-team (DRT/SRT) support, cost protection, and WAF integration (Shield Standard is free basic protection).
Prerequisites: AWS Shield (Standard/Advanced)
SES deliverability (bounces/configuration sets)
Operations to keep email delivered: high bounce (undelivered) or complaint (spam-report) rates throttle sending. Configuration sets emit events (send/delivery/bounce/complaint) to SNS/CloudWatch for monitoring; DKIM/SPF/DMARC authenticate, and dedicated IPs/warm-up manage reputation.
Prerequisites: Cooldown and warmup、Amazon CloudWatch
CloudWatch dashboards and Synthetics
Dashboards visualize metrics/logs on one screen, and Synthetics canaries continuously test endpoint availability and response via synthetic monitoring.
Prerequisites: CloudWatch Synthetics、Amazon CloudWatch
Parameter Store
A Systems Manager store that holds configuration and secrets (SecureString is KMS-encrypted) hierarchically with versioning, used to centralize app config.
Related: AWS Systems Manager (SSM)
Patch Manager
Defines approved patches via patch baselines and applies them fleet-wide within maintenance windows, evaluating patch compliance.
Related: Patch compliance
Run Command
A Systems Manager feature to run commands/scripts across many instances at once without SSH/RDP, targeting by tags and aggregating results.
Related: AWS Systems Manager (SSM)
Session Manager
Connects to an instance shell from the browser/CLI with no open ports and no bastion, logging activity to CloudTrail/S3.
Prerequisites: AWS CloudTrail
Dead-letter queue (DLQ)
A dedicated queue that captures messages which failed processing a set number of times, used for investigation and reprocessing and to keep poison messages from clogging the main queue; maxReceiveCount sets the redrive threshold.
Related: SQS redrive (reprocessing from DLQ)
FIFO (ordering / deduplication)
The FIFO variant of SQS/SNS: guarantees strict ordering per message group and removes duplicate sends within 5 minutes via a deduplication ID (or content-based dedup). Lower throughput than standard, but for workloads needing ordering and exactly-once.
Prerequisites: Delivery semantics (at-least-once/exactly-once)、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Message ordering
Session Manager (port forwarding/audit)
Key points of shell access without opening SSH/RDP or ports: port forwarding tunnels securely from local to e.g. RDS; all sessions are recorded to CloudTrail/S3/CloudWatch for audit. It replaces a bastion host.
Prerequisites: AWS CloudTrail、Amazon CloudWatch、Session Manager
Subnet reserved addresses
A rule where AWS reserves five addresses per VPC subnet—the first four (network address, VPC router, DNS, future use) and the last one (broadcast, unused in practice)—so they can't be assigned. A /24 subnet therefore has 251 usable addresses out of 256.
Prerequisites: Broadcast、Subnet
Related: VPC/subnet quotas
Synchronous replication
Replication that waits for the replica to commit before acknowledging a write; zero data loss on failure (RPO 0) at the cost of higher write latency. Used by RDS Multi-AZ, etc.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、RDS Multi-AZ and read replicas
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Managed services (management boundary)
Related: HTTPS
PrivateLink endpoint service
Exposes your own service behind an NLB privately to other VPCs/accounts via PrivateLink; traffic stays inside AWS, enabling SaaS-style offerings without the internet or VPC peering.
Prerequisites: SaaS (Software as a Service)、AWS PrivateLink、VPC peering
Secondary CIDR block
A capability that assigns an additional CIDR block to an existing VPC after creation, expanding the available IP address space. The new range must not overlap the primary CIDR, and it is a common remedy for IP address exhaustion when there is no room to add subnets.
Prerequisites: CIDR notation、Subnet
VPC sharing
A mechanism using AWS Resource Access Manager (RAM) to share one VPC's subnets across multiple accounts in an organization. Participant accounts can create resources in that subnet, centralizing network management with the owner account while still keeping account-level separation.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Resource Access Manager (RAM)、Subnet
WAF Bot Control
An AWS Managed Rules rule group that identifies and controls known good bots (e.g., search crawlers) and bad bots (e.g., scrapers, credential-stuffing tools). It is recommended to deploy first in count mode to assess impact before blocking.
Prerequisites: Glue crawler、WAF rules (managed/rate-based)
Related: WAF logging
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON
Related: AWS CloudFormation
Bedrock model customization
Adapting a foundation model with your data: fine-tuning (labeled data) and continued pre-training (large unlabeled data), both producing a private custom model.
Prerequisites: Amazon Bedrock
Related: Model customization (fine-tuning / continued pre-training / distillation)
Bedrock Guardrails
Applies safety controls to generative-AI input/output: denied topics, content filters, PII masking, and contextual grounding checks to suppress harmful/inappropriate responses.
Prerequisites: Amazon Bedrock
Related: PII masking (generative AI)
Model transparency (AI Service/Model Cards)
AWS AI Service Cards / SageMaker Model Cards document a model’s intended use, performance, limitations, and training-data considerations, supporting accountability and governance.
Prerequisites: Amazon SageMaker
Cross-Region Inference
An Amazon Bedrock inference-profile feature that auto-routes inference requests across Regions, absorbing single-Region capacity shortfalls and Region failures to raise availability (routing of inference, not data replication).
Prerequisites: Amazon Bedrock
GenAI gateway
A central abstraction layer for FM consumption that unifies auth, rate limiting, cost allocation, observability, and policy—enabling secure, governed enterprise GenAI usage.
Prerequisites: Cost allocation (chargeback/showback)、Rate limiting
LLM-as-a-Judge
Using another FM as an evaluator to auto-score output quality (relevance, factual accuracy, etc.) and fairness at scale and consistently—complemented by human evaluation for critical judgments.
Bedrock Model Evaluations
An Amazon Bedrock capability that systematically compares multiple models or prompt configurations using automated metrics (accuracy, toxicity, robustness, etc.) or human evaluation. Used as a pre-production benchmark to select the best model or parameters for a use case.
Prerequisites: Amazon Bedrock
Prompt caching
A caching technique that skips recomputing common prefixes (e.g., system prompts) to lower token cost and latency—distinct from semantic caching, which reuses results for semantically identical queries.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Semantic caching
Amazon Bedrock Prompt Management
A Bedrock capability to create and test prompts as parameterized templates and manage/deploy them via versions and aliases—treating prompts as versioned, comparable, reusable assets.
Prerequisites: Amazon Bedrock
Application Load Balancer (ALB)
An L7 load balancer supporting host/path-based routing, target groups, sticky sessions, and auth integration (OIDC/Cognito), used to route HTTP apps.
Prerequisites: Amazon Cognito、ALB features (routing/sticky/target group)
AWS Cloud WAN
A service to centrally manage a global network by policy. A core network with segments (isolated routing domains) unifies multiple Regions, accounts, and on-prem.
Prerequisites: X-Ray sampling and subsegments
Centralized egress and egress-only IGW
Consolidates internet egress into one VPC, sharing NAT gateways via TGW to cut cost. For IPv6, an egress-only internet gateway allows outbound only.
Related: Internet gateway (IGW)
Amazon VPC IP Address Manager (IPAM)
A service to plan, allocate, track, and monitor IP address space across an organization. It prevents overlapping CIDRs and auto-allocates from hierarchical pools to accounts/Regions.
Prerequisites: Amazon VPC、CIDR notation
Network Access Analyzer
Statically analyzes configuration (without sending packets) to surface paths that can reach resources that should not be reachable, defined via a scope. Used to detect unintended network exposure (overly open paths). Reachability Analyzer determines reachability and the blocking point, while CloudWatch handles trend monitoring—distinct roles.
Prerequisites: Amazon CloudWatch、IAM Access Analyzer
Network Load Balancer (NLB)
An ultra-high-performance L4 load balancer. It has static IPs (per AZ), can preserve client IP, and is used for cross-zone load balancing and exposing services via PrivateLink.
Prerequisites: Cross-zone load balancing、AWS PrivateLink
Transit Gateway Connect
An attachment type connecting SD-WAN appliances or virtual routers to a Transit Gateway at high throughput via GRE tunnels + BGP.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、Transit Gateway
Auto Scaling capacity settings (min/desired/max)
Auto Scaling group sizing: minimum (floor), maximum (ceiling), and desired capacity (the count to maintain now). Scaling adjusts desired capacity within the min–max range.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)
Auto Scaling termination policies
Rules deciding which instances to terminate on scale-in: choose from OldestInstance, NewestInstance, OldestLaunchTemplate (formerly OldestLaunchConfiguration), AllocationStrategy, or Default (ClosestToNextInstanceHour matters little under per-second billing). Scale-in protection can exclude specific instances.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)
Athena (partitions/workgroups/CTAS)
Key Athena concepts for SQL over S3: partitioning + columnar formats (Parquet) cut scanned data (and cost); workgroups isolate queries with cost limits and separate billing; CTAS creates a table from results, and Federated Query spans other data sources.
Prerequisites: Amazon Athena、Partitioning (S3/data lake)
AWS CloudShell
A pre-authenticated browser shell opened from the Management Console. AWS CLI, common runtimes, and persistent storage are preconfigured, letting you run ops commands and scripts quickly without storing keys locally.
Prerequisites: AWS CLI、AWS Management Console
AWS Fault Injection Simulator (FIS)
A managed chaos-engineering/fault-injection service. You define experiments (CPU stress, instance stop, API throttling, AZ impairment, etc.) as templates with stop conditions (guardrails) to validate resilience in production-like environments—the DevOps "break it to learn" resilience testing.
Prerequisites: API Gateway features (stages, throttling, integrations)
Game day
An event where failures are deliberately injected so a team can rehearse real incident response. AWS Fault Injection Service (FIS) is used to safely automate chaos experiments—such as stopping instances or cutting network access—to validate the effectiveness of runbooks and alerts.
Prerequisites: AWS Fault Injection Simulator (FIS)、Incident response and forensics
AWS Health (events / organizational view)
Notifies of AWS-side events affecting your resources (maintenance, outages, scheduled changes, certificate expirations). Integrate via the Health API/EventBridge for automated response, and use the Organizational View to see all accounts centrally.
Prerequisites: Certificate revocation (CRL / OCSP)、AWS Health (Personal Health Dashboard)
Amazon Managed Service for Prometheus (AMP)
A managed, Prometheus-compatible metrics ingestion/storage service. You query container-environment metrics (EKS/ECS, etc.) with PromQL while AWS handles scale and retention—commonly paired with Managed Grafana for visualization.
Prerequisites: Amazon Managed Grafana、Managed services (management boundary)
AWS STS
The Security Token Service that issues temporary credentials; it handles AssumeRole and federation requests and returns short-lived credentials, central to avoiding long-term key distribution.
Prerequisites: AssumeRole、Temporary credentials
AWS Well-Architected Framework
Best practices for cloud design, reviewed across six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability).
Prerequisites: Reliability
Related: Six pillars of Well-Architected
Bedrock streaming (InvokeModelWithResponseStream)
A streaming API that returns generated tokens incrementally, so output appears from the first token without waiting for the full response—improving perceived latency (time to first token, TTFT). Enhances UX for chat UIs and long generations.
Prerequisites: Amazon Bedrock、Performance metrics (IOPS/throughput/bandwidth/latency)
CapEx (capital expenditure)
Spending to buy and own equipment or facilities up front—like building an on-prem data center—requiring a large initial outlay that is depreciated as an asset over years. It was the center of the traditional pre-cloud IT investment model.
DeletionPolicy (Retain/Snapshot)
A CloudFormation attribute specifying what happens to a resource on stack delete/replace: Retain (keep), Snapshot (snapshot then delete), or Delete (default). Used to protect databases/buckets from accidental deletion.
Prerequisites: AWS CloudFormation、IAM policy structure (Effect/Action/Resource/Condition)
CloudFormation intrinsic functions (Ref/GetAtt/Sub)
Functions that resolve values dynamically in templates: Ref (reference a parameter/resource), Fn::GetAtt (get a resource attribute—ARN, endpoint, etc.), Fn::Sub (interpolate variables into strings), plus Fn::Join/Fn::If, and more. They avoid hard-coding and improve portability.
Prerequisites: AWS CloudFormation、IAM policy structure (Effect/Action/Resource/Condition)
CloudFront cache policy
A setting that defines the TTLs (min/default/max) CloudFront uses when caching an object and which elements (headers, query strings, cookies) are included in the cache key. Narrowing the cache key raises the hit ratio and reduces origin load, trading off against how finely responses need to vary per request.
Prerequisites: Amazon CloudFront
Field-level encryption
Encrypts specific form fields (e.g., credit-card numbers) with a public key at the CloudFront edge and carries them confidentially to the origin; only the final processing point with the matching private key decrypts them.
Prerequisites: Amazon CloudFront、Public-key cryptography (asymmetric)
CloudWatch Internet Monitor
A service that visualizes the availability and performance of internet paths between AWS resources and end users, broken down by city and network provider. It draws on AWS's large-scale traffic observations to surface problems visible only from the end-user's vantage point, such as ISP-side outages.
Prerequisites: Amazon CloudWatch
Related: CloudWatch Network Monitor
Connection tracking
How a stateful firewall (e.g., a security group) remembers established connections in a state table and automatically allows their return traffic. Unlike stateless rules, it removes the need to separately open the ephemeral-port range for the return leg.
Prerequisites: Ephemeral port
CloudWatch cross-account observability (OAM)
Via the Observability Access Manager (OAM), aggregates metrics, logs, and traces from multiple source accounts into one monitoring account for centralized observation—simplifying operations in multi-account setups.
Prerequisites: Amazon CloudWatch、Three pillars of observability (metrics/logs/traces)
Custom metrics
Application-defined metrics sent to CloudWatch via the PutMetricData API, the CloudWatch agent, or the Embedded Metric Format (EMF) extracted from logs.
Prerequisites: CloudWatch agent
Related: Amazon CloudWatch
Log retention
A per-log-group setting in CloudWatch Logs controlling how long log events are kept before automatic deletion (1 day to 10 years, or never). The default is never-expire, so explicitly setting a retention period is a frequent practical and exam gotcha for cost control.
Prerequisites: CloudWatch Logs、Amazon CloudWatch
CloudWatch Logs Insights
Interactively analyzes logs stored in CloudWatch Logs with a purpose-built query language (fields/filter/stats/sort/limit) to filter and aggregate—e.g., error counts or top IPs. Billed by the volume of data scanned.
Prerequisites: CloudWatch Logs
Related: Amazon CloudWatch
Amazon Neptune
A fully managed graph database optimized for relationship queries (social graphs, recommendations, fraud detection, knowledge graphs), supporting Gremlin/openCypher/SPARQL.
Prerequisites: Managed services (management boundary)
DynamoDB capacity behavior (hot partitions/adaptive capacity)
Skewed access to certain keys causes hot partitions and throttling. Adaptive capacity automatically absorbs skew, and burst capacity tolerates short spikes. The design basic is a high-cardinality partition key to spread load.
Prerequisites: Amazon DynamoDB
Amazon AppFlow
A fully managed integration service that securely transfers data between SaaS apps (Salesforce, SAP, Zendesk, etc.) and AWS, configuring flows with no code.
Prerequisites: Managed services (management boundary)、SaaS (Software as a Service)
Managed Service for Apache Flink
A real-time service that performs in-flight windowed aggregation/transformation on streams, used for low-latency continuous stream analytics.
Prerequisites: Managed services (management boundary)、Performance metrics (IOPS/throughput/bandwidth/latency)
Glue Data Quality (DQDL)
Validates and scores data quality on the catalog or in pipelines against rules expressed in DQDL (a rule definition language).
Related: AWS Glue
Partitioning (S3/data lake)
Splits data into folders by keys like date or region so queries skip irrelevant partitions (pruning), cutting scan and cost.
Redshift Serverless
Redshift without cluster management. It auto-scales by usage (RPUs), optimizing cost for intermittent or unpredictable analytics workloads.
Prerequisites: Amazon Redshift、Serverless (FaaS)
Decision tree
An interpretable model that repeatedly branches on feature thresholds and predicts at the leaf nodes. Used alone, it tends to overfit the training data and needs depth limits or pruning to control—but it works for both regression and classification.
AWS Chatbot
A service that relays ops notifications and alarms to Slack or Microsoft Teams (now renamed 'Amazon Q Developer in chat applications'). It pushes SNS notifications and CloudWatch graphs into chat and can run approved commands from chat (ChatOps).
Prerequisites: Amazon Q、Amazon CloudWatch
Config aggregator and org compliance
Aggregates AWS Config data across multiple accounts/Regions into one place to centrally evaluate and visualize org-wide resource configuration and compliance.
Prerequisites: AWS Config、IAM policy structure (Effect/Action/Resource/Condition)
Amazon ECR (Elastic Container Registry)
A registry that stores and versions container images. Image scanning (Basic/Enhanced = Amazon Inspector integration) detects vulnerabilities, lifecycle policies prune old images, and immutable tags prevent overwrites. It is the deployment source for ECS/EKS.
Prerequisites: Amazon Inspector
API Gateway types (REST/HTTP/WebSocket)
REST APIs are feature-rich (usage plans, API keys, request validation), HTTP APIs are low-latency/low-cost and simple, and WebSocket APIs support bidirectional real-time communication.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon API Gateway
Lambda versions and aliases
Published versions are immutable, and an alias is a mutable pointer to a specific version. Weighted routing on an alias enables canary/linear traffic shifting.
Prerequisites: AWS Lambda、Route 53 routing policies
Step Functions (Standard/Express, ASL)
Defines workflows in Amazon States Language (ASL). Standard suits long-running, exactly-once with full history; Express suits high-volume, short-duration event processing, differing in billing and semantics.
Prerequisites: Delivery semantics (at-least-once/exactly-once)、AWS Step Functions
EBS snapshot sharing
A feature that shares an EBS snapshot with another AWS account. Sharing an encrypted snapshot requires not only the snapshot's own share setting but also granting the target account usage permission in the key policy of the customer-managed key (CMK) used to encrypt it.
Prerequisites: EBS snapshots、KMS key policies and grants
EC2 Fleet
A feature that launches a set of instances meeting a target capacity in one request, spanning multiple instance types, purchase options (On-Demand/Reserved/Spot), and AZs. Unlike Spot Fleet, it can mix On-Demand and Spot in the same request. The request type is instant (synchronous, one-time), request (asynchronous, one-time), or maintain (keeps target capacity and auto-replenishes interruptions); the default is maintain.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、Spot Fleet
AWS Graviton (ARM instances)
AWS-designed ARM-based processors offering lower price and higher power efficiency than x86 at comparable performance (helping cost optimization and sustainability). Migrating supported workloads (much of Linux, containers, managed services) improves price-performance.
Prerequisites: Managed services (management boundary)、Six pillars of Well-Architected
Placement groups (cluster/spread/partition)
Strategies for physical placement. Cluster packs instances on the same rack for low latency/high throughput (HPC); spread separates them across hardware to avoid simultaneous failure (a few critical instances); partition isolates failures by group (distributed systems like HDFS).
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Spot Fleet
A mechanism that maintains a target capacity of Spot Instances (optionally mixed with On-Demand) across multiple instance types and AZs. An allocation strategy (e.g., capacity-optimized, lowest-price) auto-selects pools less likely to be interrupted, and automatically replaces capacity in another pool on interruption.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)
EC2 status checks and auto recovery
System status check = AWS-side infrastructure issues (host/network); instance status check = internal causes (OS/config); there is also an attached-EBS status check. A CloudWatch alarm’s EC2 action (recover/reboot/stop/terminate) configures auto recovery.
Prerequisites: Amazon CloudWatch
Cross-zone load balancing
Each node distributes evenly to targets in all AZs; when off, uneven target counts per AZ cause skew. ALB enables it by default (free); NLB disables it by default (enabling incurs inter-AZ data charges).
Prerequisites: Data transfer costs (intra/inter-Region, egress)
Embedding model selection
Choosing the embedding model that drives RAG retrieval accuracy—by dimensionality (accuracy vs storage/cost trade-off), domain fit, languages, and latency. Embed queries and documents with the same model; changing it requires re-embedding everything.
Prerequisites: FM selection、Performance metrics (IOPS/throughput/bandwidth/latency)
EventBridge cross-account integration
Forwards events from one account’s event bus to another’s, enabling cross-organization event-driven flows; a resource-based policy authorizes the source. Used for centralized auditing and aggregating security events.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Resource-based policy
EventBridge Scheduler
An EventBridge capability that runs cron, rate, or one-time schedules at scale with timezone support. It can manage millions of individual schedules and is positioned as the successor to scheduling via legacy CloudWatch Events rules.
Prerequisites: Amazon CloudWatch
Related: EventBridge Pipes
FM selection
Choosing the best foundation model for a use case by evaluating benchmarks, capabilities/limits (modality, context length, languages), cost, latency, and licensing—piloting comparisons when needed. The largest model isn’t always best; choose by task fit.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Data validation and processing (pre-ingestion)
Ensuring data quality before ingestion into RAG/training: dedup, format normalization, PII detection/masking, harmful-content removal, and metadata tagging, validated with (e.g.) Glue Data Quality. Preventing garbage-in underpins answer quality.
Prerequisites: AWS Glue、Glue Data Quality (DQDL)
Governed rollout
Safely releasing generative AI to production: centralize the entry via an API gateway/proxy (auth, rate limiting, logging, model switching), embed evaluation gates in CI/CD, and roll out in stages with A/B and canary—rolling back instantly on issues.
Prerequisites: Amazon API Gateway、Rate limiting
Access Advisor (last-accessed info)
An IAM feature showing when a user/role/policy last accessed each service (last-accessed info). Used to identify unused, excessive permissions and tighten toward least privilege.
IAM condition keys
Keys used in a policy’s Condition: aws:SourceIp (source IP), aws:MultiFactorAuthPresent (require MFA), aws:PrincipalTag/ResourceTag (ABAC), aws:SourceVpce (via a specific endpoint), etc. The crux of fine-grained access control.
Prerequisites: ABAC (attribute-based access control)
IAM group
A container that bundles multiple IAM users so policies can be attached in bulk. A group is not itself a principal and cannot assume a role—it only simplifies distributing permissions to users. Groups cannot be nested inside other groups.
IAM managed policy
A standalone policy object that can be attached to and reused across multiple IAM users, groups, and roles. It splits into AWS managed policies (created/updated by AWS—quick but coarse-grained) and customer managed policies (self-authored and versioned—recommended, and easier to make least-privilege).
Prerequisites: AWS IAM
Related: IAM inline policy
Password policy
Account-wide rules applied to IAM user passwords, enforcing minimum length, character-type requirements, expiration, and prevention of reusing prior passwords. Combined with periodic access-key rotation, it keeps credential hygiene in check.
Prerequisites: IAM user、S3 lifecycle (transition and expiration)
IAM Policy Simulator
A tool that evaluates whether a given principal would be allowed an action—without making the real request—for pre-deployment permission testing.
Prerequisites: Principal、IAM policy evaluation logic
Session policy
A temporary inline policy passed programmatically during AssumeRole that further narrows the assumed role permissions for that session (it can only restrict, never expand).
Prerequisites: IAM inline policy、AssumeRole
Immutable infrastructure
An operating model that never modifies running servers—instead it rebuilds and replaces them from a new image (AMI/container). It eliminates configuration drift, and rollback is just reverting to the prior version; pairs well with blue/green and Auto Scaling.
Prerequisites: Auto Scaling、ML data preparation (encoding/scaling/imbalance)
Knowledge Bases multi-source
Integrating multiple sources (S3, web crawler, databases, etc.) into one knowledge base for cross-source retrieval—tagging metadata per source for filtering and access control, and handling differently-sourced evidence consistently.
Prerequisites: Amazon Bedrock Knowledge Bases、Glue crawler
KMS encryption context
Additional key/value pairs supplied at encryption; requiring the same context at decryption binds “decrypt only in the right context,” and it’s logged in CloudTrail for auditability. S3, Secrets Manager, etc. use it internally.
Prerequisites: AWS CloudTrail、AWS Secrets Manager
Lambda runtime config (memory/timeout//tmp)
Memory allocation (128 MB–10 GB; more memory also adds CPU proportionally—sometimes faster and cheaper), timeout (up to 15 minutes), and ephemeral /tmp (up to 10 GB). Tuning these drives performance and cost.
Prerequisites: AWS Lambda、Lambda configuration (layers, env vars, ephemeral storage)
k-means clustering
A classic unsupervised method that partitions data into k clusters by iterating assign-to-nearest-centroid then update-centroids. Choose k via the elbow method/silhouette; sensitive to scale, so standardize first. Used for customer segmentation, etc.
Prerequisites: ML data preparation (encoding/scaling/imbalance)
One-hot encoding
Converting a categorical variable into 0/1 flag columns, one per category—used for unordered categories (color, region) instead of label encoding (integers, which impose a false order). It increases dimensionality, so for high cardinality consider alternatives (embeddings).
Prerequisites: DynamoDB capacity behavior (hot partitions/adaptive capacity)、ML data preparation (encoding/scaling/imbalance)
Automatic Model Tuning (HPO)
Automatically searches hyperparameters. With Bayesian, random, grid, and Hyperband strategies it finds the configuration that maximizes/minimizes the objective metric.
Prerequisites: Key hyperparameters
SageMaker Autopilot
An AutoML feature that automates preprocessing, algorithm selection, and tuning from tabular data, producing explainable candidate models.
Prerequisites: Amazon SageMaker
SageMaker Feature Store
A repository to store, share, and reuse features; provides an online store for low-latency inference and an offline store (S3) for training, sharing one definition across both to prevent training-serving skew.
Prerequisites: Amazon SageMaker、Performance metrics (IOPS/throughput/bandwidth/latency)
SageMaker JumpStart
A hub to deploy and fine-tune pretrained models (including foundation models) and solution templates with one click.
Related: Amazon SageMaker
SageMaker Model Registry
A catalog that versions models in model package groups and gates deployment via approval status (approved/rejected).
Prerequisites: Amazon SageMaker、Model registry (generative-AI versioning)
Amazon Mechanical Turk
A crowdsourcing marketplace to dispatch human tasks (data labeling, validation) to many workers, used to create labeled data for ML training.
Prerequisites: AWS Marketplace
Ensemble learning (bagging/boosting)
Combining multiple models to improve accuracy: bagging (parallel, variance reduction, random forest) and boosting (sequential, bias reduction, XGBoost).
Ground Truth and build-vs-buy
SageMaker Ground Truth labels training data, ensuring quality via workforces (Mechanical Turk = public, cheap but not for confidential / vendor-managed / private = internal for confidential), automated labeling (active learning sends only ambiguous examples to humans to cut cost), and annotation consolidation (majority vote). Choose the build strategy on a spectrum: AI service (common tasks, no training, fastest) → each service’s Custom → full-custom SageMaker (unique requirements).
Prerequisites: Amazon SageMaker、Amazon Mechanical Turk
SageMaker training input modes and data delivery
Choose data delivery for large-scale training. File mode copies all data to EBS before training (small/simple but slow start); Pipe mode streams directly from S3 (large data, fast start); Fast File mode lazy-loads POSIX-like (ease + speed). For reusing the same data across many jobs/HPO, use FSx for Lustre (S3-integrated parallel FS). Built-ins handle RecordIO-protobuf efficiently (good for sparse data).
Prerequisites: Amazon SageMaker
Recommendation systems (collaborative filtering)
Predicts preferences from user-item interactions. Collaborative filtering uses behavior of similar users/items; in SageMaker, Factorization Machines is typical.
Prerequisites: Amazon SageMaker、Choosing SageMaker built-in algorithms
Transfer learning and data augmentation
Adapt a pretrained model on little data. Degree: tiny/near-domain = freeze as a feature extractor (final layer only), moderate = partial fine-tune of top layers, ample/distant-domain = full fine-tune at a low LR. Overfitting control: data augmentation (rotate/flip/crop), batch normalization, dropout, early stopping. Fine-tune pretrained models via SageMaker JumpStart.
Prerequisites: Amazon SageMaker、SageMaker JumpStart
Monolith
An architectural style that bundles all of an application's functionality into one large codebase and deployment unit. Simple early on, but as it grows the deployment unit becomes coarse, often forcing a full redeploy for even a small change.
Related: Microservices
Option group
A collection of settings that enable engine-specific add-on features (e.g., Oracle Transparent Data Encryption, SQL Server Native Backup). Where a parameter group covers general engine settings, an option group is scoped to plugin-like engine extensions. It applies mainly to engines like Oracle and SQL Server; some engines, such as Aurora (MySQL/PostgreSQL-compatible), don't use the option group concept at all.
Prerequisites: Amazon Aurora、DB parameter group
DB parameter group
A template that groups DB engine settings (max connections, timeouts, character set, etc.). Dynamic parameters apply immediately, but changing a static parameter requires an instance reboot to take effect—a common exam distinction.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)
Read-write splitting
A database access pattern that always sends writes to the primary instance and routes reads to read replicas to spread load. The split happens at the app layer or via a proxy layer such as RDS Proxy. Because replicas use asynchronous replication, a read immediately after a write can miss the update (replication lag).
Prerequisites: Asynchronous replication、Amazon RDS Proxy
Redshift performance (RA3/WLM/dist keys)
RA3 separates compute and storage (managed storage); concurrency scaling temporarily adds clusters for concurrency peaks; workload management (WLM) controls priority/memory via queues; distribution keys (DISTKEY) and sort keys (SORTKEY) optimize joins and scans.
Prerequisites: Amazon Redshift、ML data preparation (encoding/scaling/imbalance)
AWS Resource Explorer
A service to search and discover resources across Regions; by default it searches within a single account, and organization-wide search requires multi-account search setup. Find quickly by tag/type for inventory. Where Resource Groups is about grouping, this focuses on search.
Prerequisites: AWS Resource Groups、IAM policy structure (Effect/Action/Resource/Condition)
Reserved Instance types
Standard RIs give the deepest discount with limited changes; Convertible RIs allow changing family/OS, etc. (lower discount). Regional RIs are flexible across AZs, while Zonal RIs add a capacity reservation in a specific AZ. Payment: all/partial/no upfront.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、On-Demand Capacity Reservation
Root user protection
The root user (created with the account) has near-unlimited power, so it must be protected and not used daily: enable MFA, avoid/delete access keys, use a strong password, and reserve it for the few actions that require it (billing/closure). Monitor via Organizations.
Prerequisites: AWS Organizations (consolidated billing)、Root user
S3 Batch Operations
A managed job that performs operations (copy, tagging, ACL changes, Lambda invoke, restore) across billions of objects at once; targets are specified via an S3 Inventory or manifest.
Prerequisites: AWS Lambda
S3 replication rules (CRR/SRR/bidirectional)
CRR = cross-Region (DR, geo-proximity); SRR = same-Region (log aggregation, account separation). Bidirectional replication supports multi-Region read/write. Scope by prefix/tag, and configure owner override and batch replication of existing objects.
Prerequisites: Multi-Region (active-active / active-standby)
Amazon FSx
Managed file systems: FSx for Windows File Server (SMB/AD), FSx for Lustre (HPC, high-speed), FSx for NetApp ONTAP, and FSx for OpenZFS—chosen by workload.
Prerequisites: SageMaker training input modes and data delivery
S3 performance features (Transfer Acceleration / S3 Select)
Transfer Acceleration speeds long-distance uploads via edge, and multipart upload parallelizes large objects. S3 Select (SQL to retrieve part of an object) is deprecated for new use; query S3 with Athena, etc. instead.
Prerequisites: Amazon Athena
Migration strategies (the 7 Rs)
A taxonomy of migration approaches chosen per workload: rehost (no change), replatform (minor optimization), refactor (rebuild), repurchase (go SaaS), retire (decommission), retain (keep), relocate (move as-is). Choose by the effort-vs-value trade-off.
Prerequisites: SaaS (Software as a Service)
Amazon Fraud Detector
A managed service that uses machine learning to detect online fraud (fake accounts, fraudulent transactions).
Prerequisites: GuardDuty detector / threat lists、Managed services (management boundary)
Strangler fig pattern
An incremental technique to safely modernize a monolith. Place an API Gateway or ALB facade, carve out features one at a time into new services and re-point routing, then retire the monolith last—avoiding the high risk of a big-bang rewrite.
Prerequisites: Amazon API Gateway、Monolith
SCP deny-list strategy
An SCP approach that keeps the default FullAWSAccess and only Denies the actions you want to forbid—flexible and the most common. SCPs are a permission ceiling and grant nothing (effective = SCP ∩ IAM).
Certificate revocation (CRL / OCSP)
Mechanisms to invalidate a compromised certificate before expiry: CRL distributes a revocation list; OCSP queries revocation status online (OCSP stapling improves efficiency). Managed when running a private CA via ACM Private CA (PCA).
Prerequisites: AWS Private Certificate Authority
SNS message filtering
Sets a filter policy on a subscription so only messages matching message attributes reach each subscriber—routing from one topic by condition and reducing unneeded downstream processing.
AWS Backup
Centralized backup across services (EBS/RDS/DynamoDB/EFS, etc.). Backup plans define schedule and retention, with cross-region/cross-account copy and Backup Vault Lock (WORM) to prevent deletion.
Prerequisites: Amazon DynamoDB
CloudWatch agent
An agent required to collect in-guest OS metrics like EC2 memory usage and disk free space, which are not available by default (a common SOA gotcha); it also collects logs.
Prerequisites: Amazon CloudWatch
Amazon Application Recovery Controller (ARC)
A service to control availability and disaster recovery of multi-Region/multi-AZ applications. It continuously checks each cell’s readiness and provides routing controls to perform failover (traffic shifting) safely, giving governance to execute complex recovery actions reliably.
Prerequisites: Multi-Region (active-active / active-standby)、RDS Multi-AZ and read replicas
Spot interruption notice
A notice issued about 2 minutes before AWS reclaims a Spot instance's capacity. It can be received via an EventBridge event or instance metadata (instance-action), giving a grace window to checkpoint state or hand off work safely before interruption.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、Instance metadata (IMDSv2)
SQS long polling
An SQS receive mode that waits up to 20 seconds for a message before responding; it reduces empty receives, lowering request cost and noise, and is generally recommended. Set via WaitTimeSeconds.
Prerequisites: Polling vs. webhook (push/pull)
Related: SQS short polling
SQS short polling
The default SQS receive mode that responds immediately even when no message is available; fast to return but produces more empty receives, raising request count and cost.
Prerequisites: Polling vs. webhook (push/pull)
Related: SQS long polling
Toil
An SRE term for repetitive, manual operational work that could be automated. It creates no lasting value and, left unchecked, erodes engineers' capacity for other work. SRE practice sets a target share of operational time to spend automating toil away.
Related: Error rate
SSM Change Calendar
Defines open/closed windows for automation and patching on a calendar—blocking changes during peak or freeze periods (change freeze) and gating Automation/Run Command execution.
Prerequisites: Run Command
Patch compliance
A capability that, after Patch Manager runs a scan or install, aggregates each instance's adherence to the patch baseline's approval rules. It surfaces instances with missing patches and integrates with the Compliance dashboard or Config rules to identify remediation targets.
Prerequisites: AWS Config rules and remediation
Related: Patch Manager
SSM State Manager
A Systems Manager capability that defines an instance's desired configuration (OS settings, agents, scheduled tasks, etc.) and continuously, automatically enforces and remediates it. Defined as an association that runs on a schedule, reverting drift back to the declared state.
Prerequisites: AWS Systems Manager (SSM)
Related: SSM Inventory
Strong consistency
A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Eventual consistency
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
Prerequisites: CIDR notation、Subnet
ECMP (equal-cost multi-path)
A generic routing technique that spreads traffic evenly across multiple paths of equal cost/metric. It's a broadly used networking concept, not tied to any one vendor; a representative application is distributing traffic across multiple VPN tunnels attached to an AWS Transit Gateway. When a workload needs to exceed a single tunnel's bandwidth ceiling (about 1.25 Gbps), Transit Gateway lets you bundle multiple tunnels and use ECMP to raise aggregate throughput.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、Transit Gateway
Unicast
The most common one-to-one communication mode, sending from a single source to a single destination. Ordinary client–server traffic and most API calls are designed around this mode.
Related: Anycast
Bedrock foundation models (providers)
Amazon Bedrock offers foundation models from multiple providers via one API: Anthropic Claude, Amazon Titan/Nova, Meta Llama, Mistral, Cohere, Stability AI—chosen by use case.
Prerequisites: Amazon Bedrock
PartyRock
A learning-oriented playground built on Amazon Bedrock to prototype generative-AI apps with no code.
Prerequisites: Amazon Bedrock
Strands Agents
An open-source SDK to build AI agents with minimal code, wiring models, tools, and prompts so an agent can reason and call tools.
AWS Agent Squad
An open-source orchestration framework (formerly Multi-Agent Orchestrator) that coordinates multiple AI agents. A Classifier dynamically selects the best agent from input and history; a SupervisorAgent coordinates them in parallel.
Prerequisites: Conversation history / session memory
Bedrock agent tracing
A capability that records and visualizes an agent reasoning steps for auditing, debugging, and transparency about why it reached a conclusion.
Prerequisites: Amazon Bedrock
Amazon Bedrock Data Automation
An automated processing workflow that generates structured output from unstructured data (documents, images, audio, video), automating data preparation for GenAI apps.
Prerequisites: Amazon Bedrock
Reranker
A later-stage component that reorders retrieved candidates by relevance to improve top results. Applied after hybrid search, it does not replace retrieval (embeddings/vector search).
Semantic caching
A caching technique that reuses results for semantically identical queries (even if phrased differently) to cut unnecessary FM calls. A cache hit is determined by **the similarity of the query embedding vector**, unlike exact-match caching keyed on string match or deterministic hashes (e.g., prompt caching).
Related: Prompt caching
BGP path control (AWS)
Controls hybrid routing over Direct Connect/VPN via BGP attributes. AS-PATH prepending de-prioritizes a path, local preference sets outbound preference, and BGP communities control route advertisement scope.
Prerequisites: AWS Direct Connect
Route 53 DNSSEC
Signs DNS responses so tampering and cache poisoning are detected via validation. In Route 53 it is enabled via zone signing with a KMS key.
Prerequisites: Amazon Route 53
Direct Connect resiliency (BFD)
For production, use high/maximum resiliency models with multiple locations and devices. BFD (Bidirectional Forwarding Detection) speeds failure detection and shortens failover.
Prerequisites: AWS Direct Connect
Gateway Load Balancer (GWLB)
An L3 gateway for transparently inserting third-party virtual appliances (NGFW, IDS/IPS) into the traffic path. It encapsulates packets with GENEVE (port 6081) to the appliance fleet, and inserting a GWLB endpoint (GWLBe) into route tables routes a source VPC’s traffic to an inspection VPC.
Prerequisites: Route table
Route 53 hosted zones (public/private)
Containers holding a domain’s records. Public hosted zones serve the internet; private hosted zones serve within VPCs. You can build split-view DNS with both for the same name.
Prerequisites: Amazon Route 53
Traffic Mirroring
Copies actual packets passing through a source ENI and sends them to a monitoring ENI or NLB for deep inspection via IDS or packet capture. Whereas VPC Flow Logs are metadata only, Traffic Mirroring captures the payload (packet contents). Filters narrow the mirrored traffic, but mirrored bandwidth and cost apply.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Aurora endpoints (cluster/reader/custom)
Aurora connection targets: the cluster (writer) endpoint for writes (follows failover automatically); the reader endpoint to load-balance reads across replicas; and custom endpoints to group an arbitrary set of instances (e.g., for analytics). Use by purpose.
Prerequisites: Amazon Aurora
AWS App2Container (A2C)
A migration tool that analyzes existing Java/.NET applications and containerizes them—generating a Dockerfile, ECS/EKS deployment artifacts, and a CI/CD pipeline template. It automates modernizing (containerizing) legacy apps.
Prerequisites: Containerization
Data transfer costs (intra/inter-Region, egress)
An often-overlooked AWS cost. Egress to the internet is charged, ingress is free; within an AZ is free, while inter-AZ/inter-Region is billed. Traffic via NAT gateways or across AZs drives cost; VPC endpoints can cut NAT-bound transfer.
AWS Resilience Hub
A service to assess and track application resilience. You define RTO/RPO targets; it analyzes the architecture to surface gaps against targets and single points of failure, then offers remediation recommendations and continuous assessment—used to validate DR/availability design.
Prerequisites: Single point of failure (SPOF)
AWS SDKs and Tools
Official libraries for calling AWS APIs from each language (Python = boto3, JavaScript, Java, Go, etc.). They handle credential resolution, automatic retries (exponential backoff), pagination, and Region configuration under a common spec—the foundation for operating AWS from apps and Lambda.
Prerequisites: AWS Lambda
AWS Serverless Application Repository (SAR)
A repository to find, deploy, and publish prebuilt serverless applications defined with SAM. It lets you share reusable apps/components (functions, APIs, integrations) inside and outside an organization and deploy them in near one-click fashion.
Prerequisites: Serverless (FaaS)
Signature Version 4 (SigV4)
The standard way to sign AWS API requests with access keys: a signature computed from the request, timestamp, Region, and service detects tampering and prevents replay. SDKs/CLI handle it automatically; presigned URLs build on it.
Prerequisites: S3 developer features (presigned URLs, encryption)
Backpropagation
A technique that propagates a neural network's output error backward from the output layer to the input layer, computing each weight's gradient along the way. Paired with gradient descent to update the weights, it's the core algorithm underlying deep-learning training.
Prerequisites: Gradient descent
Agent evaluations
An evaluation capability that measures an agentic application's task completion rate, appropriateness of tool calls, and reasoning quality. It continuously checks response quality—including for RAG-backed agents—via human or automated metrics, informing improvements to prompts and tool definitions.
Prerequisites: Function calling
Billing alarm
A mechanism that sets a threshold on CloudWatch's EstimatedCharges metric to catch unexpected charges early. Because that metric is recorded only in us-east-1 (N. Virginia), the billing alarm itself must also be created in us-east-1.
Prerequisites: Amazon CloudWatch
Stack policy
A JSON policy that protects specific resources from update/replace/delete during a stack update—guarding e.g. production databases from unintended changes. Distinct from IAM policies.
Prerequisites: JSON
CloudFormation validation (Hooks/Guard/Linter)
Tools for template quality and governance: cfn-lint (syntax/best-practice checks), CloudFormation Guard (cfn-guard) for policy-as-code compliance, and Hooks to enforce custom checks before provisioning—combined with drift detection to maintain control.
Prerequisites: AWS CloudFormation
CloudFormation template anatomy
Key sections of a template: Parameters (inputs), Mappings (env/Region lookup tables), Conditions (conditional creation), Resources (what’s created—required), and Outputs (exports to other stacks). Together they make reusable IaC that absorbs environment differences.
Prerequisites: AWS CloudFormation
CloudFront origin groups (origin failover)
Bundles a primary and secondary origin and fails over to the secondary on specified error responses—providing origin redundancy by pairing, e.g., S3 with a cross-Region S3 or ALB.
Prerequisites: Amazon CloudFront
Conformance pack
A mechanism that bundles multiple Config rules and remediation actions into one template for bulk deployment across an account or an entire organization. It is used to apply common baselines like PCI DSS or CIS benchmarks at once, avoiding configuring each rule individually.
Prerequisites: AWS Config rules and remediation
Cost Anomaly Detection
Uses machine learning to learn normal usage patterns and automatically detects/alerts on unexpected cost spikes—catching anomalies earlier than after-the-fact budget alerts.
Prerequisites: CloudWatch alarms (composite/anomaly)
CloudWatch Contributor Insights
Ranks “top contributors” from logs by rule (e.g., IPs causing the most errors, slowest APIs, most-accessed items)—used to find load skew or anomalous sources.
Prerequisites: Amazon CloudWatch
Metric math
Combines multiple metrics with expressions to derive new time series—e.g., error rate (errors ÷ total), sums, or anomaly-detection bands—for use in alarms and dashboards.
Prerequisites: Error rate
Compaction (small-file consolidation)
Consolidates many small files into fewer large ones, reducing metadata load and scan overhead to improve read performance.
Data lineage
The provenance of how data was produced from sources through transformations, used for impact analysis, auditing, troubleshooting, and trust.
Prerequisites: Reliability
Amazon DataZone
Provides org-wide data catalog, governance, and data sharing—discover assets via a business catalog and control access via subscription flows. Its capabilities are being integrated into the next-generation Amazon SageMaker (unified studio).
Prerequisites: Amazon SageMaker
AWS Glue DataBrew
A no-code visual data-preparation tool. Apply 250+ transforms (cleansing, normalization) via GUI and reuse them as recipes.
Prerequisites: AWS Glue
AWS Glue Studio
A visual authoring environment to build, run, and monitor Glue ETL jobs as a node graph, with the option to edit the generated Spark code.
Prerequisites: AWS Glue
Job bookmarks
A Glue feature that remembers processed data position to incrementally process only new data on reruns, preventing duplicates.
Related: AWS Glue
Amazon Keyspaces
A managed Apache Cassandra-compatible wide-column database. Serverless, it fits workloads using Cassandra’s CQL.
Prerequisites: Serverless (FaaS)
Schema registry
Centrally manages stream/message schemas and enforces compatibility (backward/forward) to prevent breaking changes between producers and consumers. Glue Schema Registry is the typical one.
Prerequisites: AWS Glue
AWS CDK (Cloud Development Kit)
An IaC framework to author infrastructure in programming languages (TypeScript/Python, etc.) that synthesizes CloudFormation templates. Constructs (L1 = raw CFn, L2 = higher-level, L3 = patterns) enable modular reuse, and CDK Pipelines build self-mutating CI/CD.
Prerequisites: AWS CloudFormation
AWS CodeArtifact
An artifact repository centralizing dependency packages (npm/pip/Maven/NuGet, etc.). Public repositories can be set as upstreams to transparently proxy and cache them, unifying internal and public packages behind one endpoint.
Prerequisites: AWS Artifact
Cold standby / cross-Region DR
AWS’s standard DR has four tiers—backup & restore, pilot light, warm standby, and multi-site (active-active)—chosen by RTO/RPO vs cost. Cold standby is an informal term close to backup & restore (minimal standby). Cross-Region DR recovers in another Region via inter-Region copies of AMIs/snapshots/data plus IaC.
Prerequisites: DR strategies (four)
DynamoDB Accelerator (DAX)
An in-memory cache purpose-built for DynamoDB that speeds reads to microseconds and offloads read traffic, with minimal app code changes.
Prerequisites: Amazon DynamoDB
Envelope encryption and data keys
Encrypts data with a data key, then encrypts that data key with a KMS master key for storage. GenerateDataKey returns plaintext/ciphertext data keys; the plaintext is discarded after use.
Lambda concurrency (provisioned/reserved)
Lambda concurrency controls. Provisioned concurrency keeps environments warm to reduce cold starts; reserved concurrency caps/guarantees a function’s concurrency. Increasing memory also raises CPU proportionally.
Prerequisites: AWS Lambda
Dynamic model routing
Dynamically switching which model handles each request based on input classification or settings—routing simple queries to small models and hard ones to large models to balance cost and quality. Routing rules can be updated without redeploy via AppConfig, etc.
Prerequisites: AWS AppConfig
Bootstrapping
Automatically running initial setup (installing packages, fetching config, starting services) the first time an instance boots; on EC2 done via the user-data script processed by cloud-init.
Related: User data
Dedicated Instance
An EC2 instance placement that runs on hardware not shared with other AWS accounts' tenants. It is physically isolated but, unlike a Dedicated Host, gives no host-level visibility (socket/core IDs). Chosen when compliance requires physical isolation but licensing doesn't require host visibility.
Related: Dedicated Host
Enhanced networking (ENA / EFA)
High-throughput, low-latency networking. ENA (Elastic Network Adapter) reaches ~100 Gbps; EFA (Elastic Fabric Adapter) provides OS-bypass ultra-low latency for tightly coupled HPC/ML workloads.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Instance store
Temporary storage physically attached to the host: very fast but ephemeral—data is lost on stop/terminate. Suited for caches/scratch; use EBS when persistence is needed (a common SOA contrast).
Prerequisites: Lambda configuration (layers, env vars, ephemeral storage)
EFS modes (performance/throughput/storage class)
EFS configuration axes: performance mode (General Purpose for low latency / Max I/O for high parallelism); throughput mode (Bursting / Elastic—auto-scales to demand / Provisioned); storage classes Standard and Infrequent Access (IA), with lifecycle management to auto-tier and cut cost.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
ALB features (routing/sticky/target group)
ALB listener rules route by path (/api/*) or hostname to a target group. Sticky sessions pin a client to the same target (via cookie); X-Forwarded-For is the header that conveys the original client IP.
SNI (multiple certificates)
Server Name Indication: a TLS-handshake extension where the client presents the target hostname, so an ALB (and NLB TLS listener) can serve different ACM certificates by hostname—offering HTTPS for many domains from one load balancer.
Prerequisites: HTTPS
Target group attributes / deregistration delay
Settings for a target group’s behavior. Deregistration delay (connection draining) waits for in-flight requests to finish before removing a target; you also tune stickiness duration, slow start, healthy/unhealthy thresholds, and health-check interval.
Prerequisites: Health check types and thresholds
Encryption in transit
Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.
Prerequisites: Encryption at rest
Factuality verification (anti-hallucination)
Verifying that generated content matches its evidence: grounding answers on sources via RAG, similarity/confidence scoring against sources, requiring citations, and verification by another model (LLM-as-a-judge)—reducing hallucinations (plausible-sounding errors).
Prerequisites: LLM-as-a-Judge
API request validation (input guarding)
Defense that validates input before calling generative AI—API Gateway request validation/schema checks, length/format checks, and Guardrails input filters—rejecting oversized, malformed, or prompt-injection inputs pre-call. Reduces cost and attack surface.
Prerequisites: Amazon API Gateway
Model registry (generative-AI versioning)
A registry that versions models, prompt configurations, and customized FMs—enabling approval, staging, and rollback. It links the provenance and evaluation results of production models so you can instantly revert to a prior version on issues.
User-centered evaluation
Evaluating quality continuously using real-user feedback (👍/👎, free-text, implicit signals)—not just automatic metrics—combined with golden-dataset automatic evaluation to improve models/prompts by real-world satisfaction and task success.
Prerequisites: GenAI monitoring (specific metrics / golden dataset)
Gradient descent
An optimization algorithm that minimizes a loss function by repeatedly stepping the parameters opposite the loss gradient, with step size set by the learning rate. Variants include full-batch, per-example stochastic gradient descent (SGD), and mini-batch processing.
Idempotent HTTP methods
A property of HTTP methods: GET/PUT/DELETE are idempotent (same result no matter how many times called); POST is non-idempotent (may create on each call). Important for retry design—idempotent operations can be safely resent; non-idempotent ones use an idempotency key to prevent duplicates.
Prerequisites: Retry design
Credential report
A CSV report listing, for every IAM user in the account, whether a password exists, MFA status, and each access key's creation and last-used date. It can be generated at most once every 4 hours and is the starting point for auditing and deactivating unused credentials.
Prerequisites: IAM user
KMS key types and rotation
KMS key categories: AWS-managed keys (service-managed, auto annual rotation), customer-managed keys (you control policy/rotation/disable), and AWS-owned keys (invisible). Grants and key policies authorize use; automatic key rotation refreshes key material.
Prerequisites: KMS key policies and grants
Linear regression
A foundational supervised-learning model that predicts a continuous target as a weighted linear combination of features. It's easy to interpret and is often the first baseline tried for a regression problem.
Logistic regression
A model that passes a linear combination of features through a sigmoid function to output a probability between 0 and 1, performing binary classification. Despite the name, it's a classifier—and like linear regression, it's interpretable and commonly used as a classification baseline.
Prerequisites: Linear regression
MFA device types
Second factors for MFA: virtual MFA (authenticator TOTP), hardware MFA (physical token), and FIDO security keys (passkeys, strong phishing resistance). Required for root and privileged users; enforce critical actions with the aws:MultiFactorAuthPresent condition.
Prerequisites: IAM condition keys
Principal component analysis (PCA / dimensionality reduction)
A dimensionality-reduction method that compresses many correlated features into a few synthetic axes (principal components) maximizing variance—used for visualization, noise reduction, and cutting compute. Unsupervised, with reduced interpretability; t-SNE/UMAP are non-linear alternatives for visualization.
Prerequisites: Principal
SageMaker Clarify (bias/explainability)
Detects bias in training data and models and explains each feature’s contribution to predictions via SHAP values, used to assess fairness and transparency.
Prerequisites: Amazon SageMaker
SageMaker Data Wrangler
A largely GUI tool to import, analyze, preprocess, and transform features. It applies 300+ built-in transforms and exports the flow as a pipeline.
Prerequisites: Amazon SageMaker
SageMaker Debugger
Captures tensors and metrics during training and uses rules to detect issues like vanishing gradients, overfitting, and idle resources to optimize training.
Prerequisites: Amazon SageMaker
SageMaker Experiments
Records, organizes, and compares training trials (parameters, metrics, artifacts) for reproducible experiment management.
Prerequisites: Amazon SageMaker
SageMaker Neo
Compiles and optimizes trained models for specific edge/cloud hardware to make inference faster and lighter.
Prerequisites: Amazon SageMaker
SageMaker Pipelines
CI/CD orchestration that automates the ML lifecycle (process→train→evaluate→register→deploy) as a reproducible DAG, with condition steps for quality gates.
Prerequisites: Amazon SageMaker
SageMaker Processing jobs
Jobs that run preprocessing, postprocessing, and model evaluation at scale on managed compute, executing arbitrary containerized processing in a distributed way.
Prerequisites: Amazon SageMaker
Inference pipeline (multi-container)
A SageMaker setup chaining preprocessing → inference → postprocessing as multiple containers behind one endpoint, reusing the same transforms at inference as in training.
Prerequisites: Amazon SageMaker
Text preprocessing (tokenization/TF-IDF/n-gram)
Preprocessing to turn text into features: tokenization and stemming/lemmatization to normalize, then vectorization via bag-of-words, TF-IDF, n-grams, or Word2Vec.
Model customization (fine-tuning / continued pre-training / distillation)
Ways to adapt an FM. Fine-tuning adjusts behavior with labeled examples (small data, task-specific); continued pre-training injects knowledge from large unlabeled domain data; distillation trains a small model on a large model’s outputs to cut cost. Often first check whether RAG/prompting suffices before customizing.
Related: Bedrock model customization
Multi-cloud
Using two or more public cloud providers together; to avoid lock-in or pick best-of-breed.
Prerequisites: Public cloud
Private IP ranges (RFC 1918)
Private address blocks not routed on the internet: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. VPC CIDRs are typically chosen from these; when connecting multiple VPCs, avoid overlapping ranges (overlap breaks peering/TGW reachability).
Prerequisites: CIDR notation
AI services opt-out policy
An AWS Organizations-level policy that stops Amazon from using customer data to improve AI/ML services, applied across the whole organization at once. It is a type of Organizations policy that avoids configuring each account individually and helps meet data governance requirements.
Prerequisites: AWS Organizations (consolidated billing)
Delegated administrator
A mechanism that delegates organization-wide administrative rights for supporting services (GuardDuty, Config, Security Hub, etc.) to a member account other than the management account. It minimizes use of the management account and lets a security operations team hold separated duties; it must be configured per service.
Prerequisites: Amazon GuardDuty
PaaS (Platform as a Service)
Renting a platform to run apps; the provider manages OS/runtime and you focus on app and data (e.g., App Service).
Circuit breaker
A pattern that temporarily “opens” (cuts off) a repeatedly failing dependency to stop wasteful retries and cascading failure; after a cooldown it half-opens to test, then closes on recovery. Combined with timeouts, retries, and backoff.
Prerequisites: Cooldown and warmup
Public-key cryptography (asymmetric)
Encrypt with a public key and decrypt with a private key (or sign with the private key and verify with the public key). It solves key distribution and underpins TLS, SSH, code signing, and certificates; slower than symmetric, so data is encrypted with a symmetric key that is itself protected by the public key (envelope).
Metadata filtering (RAG)
Attaching attributes (source, date, department, sensitivity, etc.) to chunks and filtering at retrieval to improve relevance and access control—enabling tenant isolation, recency preference, and permission-based visibility together with vector search.
Prerequisites: Chunking (splitting strategy)
Retrieval-layer diagnosis
When RAG answer quality is poor, diagnosing the cause at the retrieval layer—checking embedding fit, data drift, chunking strategy, search recall/precision, and metadata filters in turn, and fixing it distinctly from the generation side (prompt/model).
Prerequisites: Chunking (splitting strategy)
RAG retrieval mechanism (semantic/hybrid)
How RAG retrieves relevant documents. Semantic search fetches by embedding similarity (meaning); hybrid search combines keyword (e.g., BM25) and vector to improve recall; a reranker reorders top results, and only the needed evidence is passed to the context.
Related: Reranker
RDS Performance Insights
A performance-monitoring feature that visualizes DB load by wait events and top SQL to pinpoint bottlenecks, tracking DB load (average active sessions) on a dashboard; complements CloudWatch metrics.
Prerequisites: Amazon CloudWatch
Retry design
A design that retries after a transient failure using exponential backoff with jitter. A naive immediate retry can cause a retry storm—many clients retrying in sync and worsening the outage—so random jitter spreads retries out over time. It is safe to use only for idempotent operations.
S3 Access Points
Creates multiple named entry points to a single bucket—one per app/team—each with its own access policy, splitting up large, complex bucket policies for easier management.
Prerequisites: S3 access control (bucket policy/ACL/ownership)
S3 Event Notifications
Sends object create/delete events to SNS, SQS, Lambda, or EventBridge to trigger processing automatically—used for upload-driven thumbnailing or ingestion pipelines.
Prerequisites: AWS Lambda
S3 lifecycle (transition and expiration)
Rules that auto-manage objects by age. Transition moves to cheaper storage classes (e.g., Standard-IA at 30 days, Glacier at 90); expiration auto-deletes old objects, noncurrent versions, and incomplete multipart uploads to control cost.
S3 Object Lock
Protects objects as WORM (write-once-read-many), blocking delete/overwrite during retention. Modes: governance (privileged override), compliance (no one can remove), plus legal hold (indefinite). Used for regulatory compliance and tamper-proofing.
S3 replication features (RTC/batch/inventory)
Replication Time Control (RTC) guarantees replication within 15 minutes with an SLA; batch replication copies pre-existing objects after the fact; S3 Inventory periodically lists objects with encryption/replication status as input for audits and batch operations.
Related: S3 Batch Operations
EBS volume types (gp3/io2/st1/sc1)
Choose by workload: gp3 general-purpose SSD (IOPS/throughput set independently), io2/io2 Block Express for durable high-IOPS, st1 throughput-optimized HDD, and sc1 cold HDD.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
AWS Data Exchange
A data marketplace to find and subscribe to third-party data products and receive/use them securely on AWS, ingesting external datasets into your analytics.
Prerequisites: AWS Marketplace
AWS DataSync
Transfers files and objects over the network—fast, incremental, and integrity-checked—across NFS/SMB/S3/EFS/FSx. Suited to online migration when bandwidth is adequate.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Amazon MQ
A managed message broker compatible with ActiveMQ/RabbitMQ, suited to migrating apps that use standard protocols (JMS/AMQP/MQTT); new decoupling typically uses SQS/SNS.
Prerequisites: Loose coupling (decoupling)
Amazon Personalize
A managed service providing real-time recommendations powered by machine learning.
Prerequisites: Managed services (management boundary)
Service Control Policy (SCP)
An organization-wide guardrail applied to accounts or OUs in AWS Organizations. It sets a permission ceiling so member-account IAM cannot exceed it (a maximum permission boundary).
Prerequisites: AWS Organizations (consolidated billing)
AWS Transfer Family
A managed service for ongoing file exchange with external partners over SFTP/FTPS/FTP against S3/EFS, moving the backend to the cloud while preserving existing transfer protocols.
Prerequisites: Managed services (management boundary)
SCP allow-list strategy
An SCP approach that removes the default FullAWSAccess and explicitly enumerates only allowed actions—strict, but heavier to manage since a missing allow can block legitimate actions.
Prerequisites: SCP deny-list strategy
IAM policy evaluation logic
The order for deciding access: an explicit Deny always denies (highest precedence); otherwise check for an explicit Allow; allow if Allowed and not Denied; with no Allow anywhere it is implicitly denied. Precedence: explicit deny > allow > implicit deny.
Permissions boundary
A policy that sets the maximum permissions an IAM user/role can have. It does not grant; it limits effective permission to "identity policy ∩ boundary." Used to prevent over-permissioning when delegating administration.
Prerequisites: IAM user
Amazon Data Lifecycle Manager (DLM)
A service that automates creation, retention, and deletion of EBS snapshots and EBS-backed AMIs via policies. It manages scheduled backups and retention, supporting compliance and data protection (lifecycle of encrypted snapshots).
Related: EBS snapshots
AWS User Notifications
A service to centrally configure and aggregate AWS notifications from multiple sources (CloudWatch alarms, Health, Security Hub findings, etc.) and deliver them to the console, email, and more—improving visibility and reach of security events.
Prerequisites: Amazon CloudWatch
Amazon Verified Permissions
A managed service that externalizes application authorization (who can do what). Define fine-grained access control with the Cedar policy language, decoupled from app code for centralized management and auditing.
Prerequisites: Managed services (management boundary)
Step Functions states (Map/Parallel/Choice)
Building blocks of a state machine: Task (work), Choice (branch), Parallel (concurrent branches), Map (iterate over array items; Distributed Map for large-scale parallelism), plus Wait/Pass/Succeed/Fail. Callbacks (.waitForTaskToken) wait for external completion.
Prerequisites: AWS Step Functions
S3 versioning and replication
Versioning enables recovery from overwrites/deletes, cross-/same-Region replication auto-copies to another location, and MFA Delete protects deletions.
Prerequisites: S3 replication rules (CRR/SRR/bidirectional)
SQS redrive (reprocessing from DLQ)
Moves failed messages parked in a dead-letter queue back to the source queue for reprocessing after fixing the cause (DLQ redrive). Messages exceeding maxReceiveCount move to the DLQ; used to isolate and recover from poison messages.
Related: Dead-letter queue (DLQ)
Amazon Titan Text Embeddings
A Bedrock embedding model that converts text into semantic vectors—used in RAG to embed documents/queries; dimensionality and normalization affect retrieval accuracy, cost, and storage. As a rule, embed queries and documents with the same model.
Prerequisites: Amazon Bedrock