AWS Certified CloudOps Engineer – Associate — knowledge map
The 503 core concepts of AWS Certified CloudOps Engineer – Associate and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (503)
Performance metrics (IOPS/throughput/bandwidth/latency)
Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.
Amazon CloudWatch
The observability core: Logs aggregates logs (query with Logs Insights); metrics are numeric time-series (including custom); alarms notify/auto-respond on threshold breaches (SNS/Auto Scaling). Lambda logs flow to Logs automatically.
Related: Custom metrics、CloudWatch Logs Insights
AWS Lambda
Serverless (FaaS): event-driven function execution billed only for what runs; no server management.
Related: Serverless (FaaS)
Encryption
Transforming data with a key so only authorized parties can decrypt; symmetric/asymmetric, at rest/in transit.
Related: Encryption in transit、Encryption at rest
Auto Scaling
Automatically adjusts the number of EC2 (and more) with demand or failures (elasticity); combine with ELB for HA.
Prerequisites: Elasticity
Amazon DynamoDB
A serverless NoSQL key-value/document DB with a flexible schema and low latency at scale.
Pricing models (On-Demand / Savings Plans·RI / Spot)
On-Demand = pay-as-you-go, most flexible; Savings Plans/RI = discount for a 1–3 year commitment; Spot = spare capacity up to ~90% off (interruptible).
Prerequisites: Consumption-based pricing
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
Prerequisites: Shared responsibility model
AWS CloudTrail
Records an audit log of API activity (who did what, and when) in the account.
CIA triad
The three pillars of information security: Confidentiality, Integrity, Availability.
Prerequisites: Three pillars of observability (metrics/logs/traces)
Amazon CloudFront
A CDN that caches content at edge locations for low-latency delivery to users.
Related: Edge location
IAM policy structure (Effect/Action/Resource/Condition)
Elements of a JSON policy: Effect (Allow/Deny), Action (APIs like s3:GetObject), Resource (target ARNs), Condition (IP, MFA, tags, etc.), and Principal (who—resource policies only). Least privilege narrows these to specifics.
Serverless (FaaS)
No server management; code runs only on events and bills only for execution (e.g., AWS Lambda).
Related: AWS Lambda
Subnet
A smaller network range carved out of a virtual network address space; groups resources by purpose or public/private and serves as a unit for routing and access control.
Amazon API Gateway
A fully managed service to create, publish, and manage REST/HTTP/WebSocket APIs, with throttling, authorization (Cognito/Lambda authorizers), stages, usage plans, and caching; backed by Lambda and more.
Prerequisites: Amazon Cognito、Managed services (management boundary)
Amazon Route 53
DNS (name resolution) and domain registration, with health checks and routing policies.
Related: Route 53 routing policies
Route table
A set of rules deciding where a subnet’s traffic goes: each destination CIDR maps to a target (IGW, NAT GW, peering, endpoint, etc.). Longest-prefix match wins; the local (in-VPC) route cannot be removed.
AWS Systems Manager (SSM)
A unified toolset to operate fleets at scale without opening SSH/RDP: Run Command (commands at scale), Session Manager (shell without open ports), Patch Manager (patch baselines + maintenance windows), Automation (runbooks for auto-remediation), and Parameter Store (config/SecureString). Requires the SSM agent and an IAM role.
Prerequisites: AWS Config rules and remediation、Patch Manager、Session Manager、SSM Automation (runbooks)
Related: Parameter Store、Run Command
AWS CloudFormation
An IaC service that deploys resource groups (stacks) reproducibly from declarative templates (YAML/JSON); change sets preview diffs before apply and drift detection finds divergence from reality. Nested stacks and StackSets modularize and deploy across accounts.
Related: AWS Resource Groups、YAML
AWS IAM
Identity and access management—users/groups/roles/policies control "who can do what" with least privilege; roles grant temporary permissions (no keys).
Amazon Athena
A serverless service running Presto/Trino-based SQL on S3 data. Billed per data scanned, so Parquet conversion + partitioning greatly cuts cost. Uses the Glue Data Catalog for metadata.
Prerequisites: Partitioning (S3/data lake)
Related: Glue Data Catalog
Transit Gateway
A router that consolidates many VPCs and on-premises into a single hub. It avoids full-mesh VPC peering, simplifying large-scale connectivity with a hub-and-spoke model.
Related: VPC peering
CloudWatch Logs
Aggregates and stores logs: log streams sit under a log group (which sets retention). Metric filters extract numeric metrics from logs, and subscription filters stream logs in real time to Kinesis/Lambda/OpenSearch. Logs from Lambda and many services arrive automatically.
Prerequisites: Amazon OpenSearch Service、SNS message filtering
AWS Glue
The core of serverless ETL. Crawlers infer schema into the Data Catalog (central metadata shared by Athena/Redshift Spectrum/EMR); ETL jobs transform/cleanse on serverless Spark; Glue Data Quality (DQDL) validates data; job bookmarks prevent reprocessing.
Related: Glue Data Quality (DQDL)、Job bookmarks、Glue crawler、Redshift Spectrum
Amazon GuardDuty
Analyzes logs to detect threats automatically; Security Hub aggregates findings, Inspector scans vulnerabilities, Macie finds sensitive data.
Prerequisites: Amazon Inspector、Amazon Macie
AWS Fargate
A serverless compute engine for ECS/EKS: no EC2 instances to manage (patching, scaling)—you just specify vCPU/memory per task. The default choice to reduce operational overhead.
Cost allocation (chargeback/showback)
Allocating cloud spend to teams/projects. Chargeback bills each unit for actual cost (accountability); showback only shows usage without billing (awareness). Implemented via cost allocation tags, Cost Categories, and Cost Explorer.
Prerequisites: AWS Cost Explorer
AWS Cost Explorer
Visualizes cost and usage over time, by service, and by tag for trend analysis and forecasting; also provides RI/Savings Plans recommendations and reserved utilization/coverage reports.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)
Related: AWS Budgets
Amazon Data Firehose
Delivers streams to S3/Redshift/OpenSearch with no code. It supports buffering, Lambda transforms, and Parquet conversion, but keeps no retention for replay.
Prerequisites: Amazon OpenSearch Service
Related: Kinesis Data Streams、Data Firehose features (buffering/transform/dynamic partitioning)
Resource-based policy
A policy attached to a resource itself—such as an S3 bucket policy or SQS queue policy—that defines who can access that resource. Because it includes a Principal element, it can grant access to a principal in another account that doesn't own the resource, making it the standard way to enable cross-account access.
Prerequisites: Cross-account access、S3 access control (bucket policy/ACL/ownership)
Related: Principal、Identity-based policy
S3 encryption and public-access prevention
S3 data protection. Choose encryption from SSE-S3 (AWS-managed key), SSE-KMS (CMK control, CloudTrail audit), or DSSE-KMS (double encryption). Prevent accidental exposure with Block Public Access (account & bucket) + restrictive bucket policy + ACL disablement.
Prerequisites: Encryption
Related: DSSE-KMS (dual-layer server-side encryption)、S3 access control (bucket policy/ACL/ownership)
Temporary credentials
Short-lived credentials issued by STS (access key, secret key, and session token); they auto-expire, so leak risk is lower than embedded long-term keys.
Prerequisites: DynamoDB TTL (auto-expiry)
VPC endpoint implementation (private DNS / endpoint policy)
Enabling private DNS on an interface endpoint resolves the service’s normal name to the ENI’s private IP, switching to the private path with no code change. An endpoint policy (resource-based IAM) limits which APIs/resources are allowed through the endpoint and, combined with an S3 bucket policy aws:sourceVpce condition, can restrict access to a specific endpoint only. A gateway VPC endpoint is for S3/DynamoDB only—free, via the route table.
Prerequisites: Amazon DynamoDB、Resource-based policy、Route table、S3 access control (bucket policy/ACL/ownership)
Related: VPC endpoint types and private DNS
API keys and usage plans
An API key is a token that identifies a client; alone it does not authenticate, but paired with a usage plan it enforces rate limits (requests per second) and quotas (e.g., monthly caps). Authentication itself is handled separately by a Lambda authorizer, IAM, or a Cognito authorizer.
Prerequisites: AWS Lambda、Amazon Cognito、Rate limiting
Related: API Gateway caching、API Gateway stage
Network ACL (NACL)
Traffic control at the subnet level; stateless (return traffic must be explicitly allowed), supports both allow and deny rules, and is the place to block a specific IP.
Prerequisites: Subnet
Related: Security group (AWS)
AWS Organizations (consolidated billing)
Groups multiple accounts for consolidated billing (volume discounts, central management) and SCPs for org-wide guardrails.
Amazon Aurora
A cloud-native, MySQL/PostgreSQL-compatible database. Storage is 6-way replicated across 3 AZs with self-healing and auto-growth (up to 128 TiB); up to 15 read replicas, failover usually under 30s—higher availability/performance than RDS.
Amazon RDS Proxy
A fully managed proxy that pools and shares connections to RDS/Aurora, preventing connection exhaustion for Lambda-heavy apps and shortening failover; integrates IAM auth and Secrets Manager.
Prerequisites: AWS Lambda、Amazon RDS、Managed services (management boundary)、AWS Secrets Manager
Kinesis Data Streams
Durable streaming ingestion. It retains data for replay, parallelizes via shards, and lets multiple custom consumers read the same stream.
Prerequisites: Durability and availability (nines)
Related: Amazon Data Firehose
ECS task execution role
The IAM role the ECS agent itself uses to launch containers—pulling images from ECR, shipping logs to CloudWatch Logs, and fetching secrets from Secrets Manager/SSM Parameter Store for environment variables. It is distinct from the task role and is never exposed to the application code.
Prerequisites: AWS IAM、CloudWatch Logs、Amazon CloudWatch、ECS task role
IAM user
A long-lived identity representing a person or application that can hold long-term credentials such as a password or access keys. Best practice favors roles with temporary credentials for people, keeping the number of IAM users and long-term keys to a minimum.
Prerequisites: Temporary credentials
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Prerequisites: S3 access control (bucket policy/ACL/ownership)
Multi-Region (active-active / active-standby)
Deploying across Regions for regional-failure resilience and low latency. Active-active = both Regions serve traffic (highly available, costlier, data-consistency challenges); active-standby = one stands by (promoted on failover). Built with Route 53, Global Accelerator, and global tables.
Prerequisites: AWS Global Accelerator
AWS Site-to-Site VPN
An IPsec VPN connecting on-premises to a VPC over the internet—quick and cheap, with two redundant tunnels per connection. Lower bandwidth than Direct Connect but also used as its backup.
Prerequisites: IPsec
Related: AWS Direct Connect
Route 53 Resolver DNS Firewall
A service that evaluates DNS queries issued from a VPC against domain lists and blocks resolution of malicious or unapproved domains. It is used to detect and stop malware C2 communication and data exfiltration via DNS tunneling; query logs can be exported as DNS logs to CloudWatch Logs or S3.
Prerequisites: Route 53 Resolver、Amazon Route 53、CloudWatch Logs、DNS / name resolution (record types)
S3 access control (bucket policy/ACL/ownership)
A bucket policy is a bucket-level resource policy (the recommended control); ACLs are legacy object/bucket permissions (now recommended to disable). Object Ownership’s “bucket owner enforced” disables ACLs to consolidate on policies; Block Public Access is the backstop.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)
AssumeRole
An STS API operation that assumes a specified IAM role to obtain temporary credentials; a trust policy restricts who may assume it. The basis for cross-account and third-party access.
Prerequisites: AWS IAM、Temporary credentials
Related: Trust policy
Route 53 routing policies
Policies that control how DNS responds: failover routing (to standby via health checks), latency routing (to the nearest region), weighted routing (proportional split), geolocation routing, and more—improving availability and performance.
Prerequisites: CIA triad、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon Route 53
AWS Secrets Manager
Securely stores secrets (DB credentials, API keys) with automatic rotation via Lambda. More feature-rich than SSM Parameter Store (rotation, cross-account sharing) and billed per secret/use.
Prerequisites: API keys and usage plans、Parameter Store
Related: Secrets Manager automatic rotation
AWS Config rules and remediation
Config rules (managed/custom) continuously evaluate resource configuration for compliance, bundled by conformance packs, with non-compliance auto-remediated via SSM Automation.
Prerequisites: AWS Config
Related: SSM Automation (runbooks)
Internet gateway (IGW)
A horizontally scaled, redundant VPC component that enables communication between a VPC and the internet. When a public subnet’s route table points to the IGW and resources have public IPs, two-way internet communication is possible. For outbound-only, use a NAT gateway (IPv4) or an egress-only internet gateway (IPv6).
Prerequisites: Public IPv4 address behavior、Route table、Subnet
Related: Public / private subnet、Centralized egress and egress-only IGW
AWS Global Accelerator
Provides two static anycast IPs and gets users onto the AWS backbone from the nearest edge to reach the optimal Region with low latency. It supports TCP/UDP on any port and enables second-scale regional failover based on health checks (no caching). A traffic dial on the endpoint group throttles flow.
Prerequisites: Anycast、Performance metrics (IOPS/throughput/bandwidth/latency)
Route 53 Resolver
The mechanism handling hybrid DNS resolution for a VPC. An inbound endpoint accepts queries from on-premises into VPC resources (Amazon-provided DNS), while an outbound endpoint forwards queries from the VPC to on-premises DNS servers according to conditional forwarding rules. Used when on-prem and cloud need to share a single namespace.
Prerequisites: Amazon Route 53、DNS / name resolution (record types)
Related: Route 53 Resolver endpoints
Cooldown and warmup
Cooldown suppresses the next scaling evaluation for a set period right after Auto Scaling takes a scaling action, preventing excessive back-to-back scaling (flapping) while metrics catch up. Warmup is the grace period before a newly launched instance is counted into target tracking scaling's average-value calculation.
Prerequisites: Auto Scaling、Auto Scaling policies and lifecycle hooks
AWS Config
Records resource configuration and evaluates compliance with rules (tracks config changes).
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)
AWS Direct Connect
A network service that connects on-premises infrastructure directly to AWS over a dedicated line. Because it bypasses the public internet, it offers low, consistent latency and stable bandwidth, suiting large data transfers and latency-sensitive workloads. For redundancy, AWS recommends connections from multiple locations or pairing with Site-to-Site VPN as a failover path.
Related: AWS Site-to-Site VPN
AWS WAF
A web application firewall that inspects and blocks malicious HTTP requests (e.g., SQL injection, XSS) using managed rules and rate limits; attaches to CloudFront, ALB, and API Gateway.
Prerequisites: Amazon CloudFront、Amazon API Gateway、Rate limiting
Related: AWS Shield (Standard/Advanced)
Container Insights / Lambda Insights
CloudWatch extensions that automatically collect detailed operational metrics and logs (CPU, memory, disk, network) for ECS/EKS containers and Lambda functions. They feed dashboards and anomaly-detection alarms, surfacing bottlenecks specific to container and serverless platforms.
Prerequisites: AWS Lambda、Amazon CloudWatch、Serverless (FaaS)
Amazon Redshift
A petabyte-scale data warehouse (OLAP) using columnar storage and MPP for fast large aggregations; Redshift Spectrum queries S3 directly, and Serverless removes provisioning.
Related: Redshift Spectrum
Amazon QuickSight
A serverless BI dashboard service. Visualizes from Athena/Redshift/RDS sources, accelerated by SPICE (in-memory), with row/column-level security, natural-language Q, and embedding. Its role is visualization—not a query engine itself.
Prerequisites: Amazon Redshift、Amazon Athena、Serverless (FaaS)
DynamoDB capacity and TTL
Capacity is on-demand (auto, pay-per-request) or provisioned (RCU/WCU, Auto Scaling). TTL auto-deletes expired items, PartiQL gives SQL-like access, and throttling is retried with exponential backoff.
Prerequisites: Auto Scaling、Amazon DynamoDB、Pricing models (On-Demand / Savings Plans·RI / Spot)、Throttling (capacity)
S3 developer features (presigned URLs, encryption)
Presigned URLs grant temporary upload/download permission, multipart upload parallelizes large objects, and encryption is chosen among SSE-S3, SSE-KMS, SSE-C, and client-side.
Prerequisites: Encryption、S3 performance features (Transfer Acceleration / S3 Select)、S3 encryption and public-access prevention
AWS Step Functions
Orchestrates multi-step workflows as a state machine, declaratively handling branching, parallelism, retries, error handling, and waits to sequence Lambda and other services.
Prerequisites: AWS Lambda
AWS X-Ray
Distributed tracing: records the segments/subsegments and latency a request passes through and pinpoints bottlenecks/errors via the service map; samples a subset. Complements logs ("what happened").
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: X-Ray sampling and subsegments
Principal
The actor that performs an action in IAM—an IAM user, role, AWS service, another account, or a federated identity. It is what a Principal element in a resource-based or trust policy names when specifying who is granted access.
Prerequisites: Trust policy、IAM user
Related: Resource-based policy
Polling vs. webhook (push/pull)
Two integration styles. Polling (pull) periodically queries (simple but adds latency/waste); webhooks (push) call you on events (immediate, efficient, but the receiver must be available). On AWS, EventBridge/SNS are push; SQS receive is pull.
Amazon EventBridge
A serverless event bus at the core of event-driven architectures. It ingests events from many sources, filters via rules, and routes to targets like Lambda or Step Functions, loosely coupling services.
Prerequisites: AWS Lambda、AWS Step Functions、Loose coupling (decoupling)、SNS fan-out and event-driven
AWS Firewall Manager
A service that centrally applies and enforces WAF, Shield Advanced, security group, Network Firewall, and Route 53 Resolver DNS Firewall rules across the organization (Organizations), auto-applying to new accounts.
Prerequisites: Route 53 Resolver、AWS Organizations (consolidated billing)、Amazon Route 53、Route 53 Resolver DNS Firewall
Secrets Manager automatic rotation
Periodically auto-updates credentials (e.g., for databases) via Lambda to reduce leak risk and toil. RDS/Aurora support built-in rotation.
Prerequisites: AWS Lambda、Amazon Aurora、Toil
Related: AWS Secrets Manager
SSM Automation (runbooks)
Runs operational tasks and auto-remediation via runbooks (defined procedures), automating fixes triggered by EventBridge or Config findings.
Related: AWS Config rules and remediation
Throttling (capacity)
When sustained overuse of capacity causes delays/rejections; identify the cause in Capacity Metrics and resolve via optimization or scaling.
VPC endpoint
The entry point that privately connects a VPC to AWS services; interface endpoints create an ENI (via PrivateLink, for many services) and gateway endpoints serve S3/DynamoDB (via route table, free).
Prerequisites: Amazon DynamoDB、Route table、AWS PrivateLink
VPC endpoint types and private DNS
Gateway type (S3/DynamoDB only, via route table, free) and interface type (PrivateLink, ENI + private IP, many services, hourly cost). Enabling private DNS resolves the public service name through the endpoint transparently.
Prerequisites: Amazon DynamoDB、Route table、AWS PrivateLink、VPC endpoint
Related: VPC endpoint implementation (private DNS / endpoint policy)
Alias records
A Route 53-specific record that resolves to AWS resources (ELB, CloudFront, S3, API Gateway) even at the zone apex. It works like a CNAME at no extra charge.
Prerequisites: Amazon CloudFront、Amazon Route 53、Amazon API Gateway
Related: DNS / name resolution (record types)
CloudFront origin protection (OAC) and edge functions
Origin Access Control (OAC, formerly OAI) keeps S3 private while allowing access only via CloudFront; it is the current recommendation, supporting SSE-KMS, all Regions, and all HTTP methods. For edge compute, choose by use: ultra-light, viewer-only CloudFront Functions (header tweaks/redirects/URL rewrites) versus Lambda@Edge, which can hook origin events and make external calls.
Prerequisites: Amazon CloudFront、AWS Lambda、S3 encryption and public-access prevention
MTU and jumbo frames
The maximum packet size on a path: up to 9001 within a VPC (jumbo frames), 1500 over an IGW/VPC peering, 8500 over Transit Gateway, and up to 1500 over Site-to-Site VPN (less in practice with IPsec). Exceeding a smaller MTU with the DF bit set requires path MTU discovery’s ICMP (Fragmentation Needed); blocking it in an SG/NACL causes the classic failure where connections establish but large transfers hang.
Prerequisites: Network ACL (NACL)、ICMP、IPsec、AWS Site-to-Site VPN
Auto Scaling scaling policies
Auto Scaling adjustment methods: target tracking (keep a metric at a target—recommended, simplest), step scaling (graded steps by breach size), simple scaling (one adjustment then cooldown), scheduled scaling (time-based), and predictive scaling (ML forecast).
Prerequisites: Cooldown and warmup、Auto Scaling、Auto Scaling policies and lifecycle hooks
Audit trail
A traceable record of who did what and when; in AWS, CloudTrail records API calls for tamper detection and incident investigation.
Prerequisites: AWS CloudTrail
Related: Change management、Compliance reporting
AWS KMS
A managed service to create, manage, and rotate encryption keys, called KMS keys (formerly known as CMKs/Customer Master Keys). It encrypts data in S3, EBS, etc. and controls key use through IAM and key policies, auditing via CloudTrail. KMS keys come in types such as AWS managed and customer managed keys—the two terms are not synonymous.
Prerequisites: AWS CloudTrail、Encryption、Managed services (management boundary)
Amazon Managed Grafana
A fully managed Grafana. It visualizes and alerts on metrics/logs/traces from multiple data sources (CloudWatch, Prometheus, X-Ray, etc.) in a single dashboard—an observability "visualization" layer without self-managing Grafana.
Prerequisites: Amazon CloudWatch、AWS X-Ray、Managed services (management boundary)
AWS Resource Groups
A feature that groups resources by conditions such as tags, resource type, or CloudFormation stack into one logical collection. Once grouped, they can be targeted together for Systems Manager Automation, Patch Manager, or monitoring dashboards.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Patch Manager、AWS Systems Manager (SSM)
Related: Tag Editor、AWS CloudFormation
Amazon VPC
Your private network in AWS; divided into public/private subnets, with traffic controlled by security groups/NACLs.
Prerequisites: Network ACL (NACL)、Security group (AWS)、Subnet
CloudFront invalidation
An operation that forcibly removes cached content from CloudFront edge locations before its TTL expires (by path), so the next request fetches fresh content from the origin. The first 1,000 paths per month are free, but frequent invalidation adds cost and slight latency, so cache policies or versioned filenames are the generally recommended alternative.
Prerequisites: Amazon CloudFront、Edge location、CloudFront cache policy、Performance metrics (IOPS/throughput/bandwidth/latency)
CloudTrail event types (management/data/Insights)
Management events = control-plane API actions (recorded by default, free). Data events = high-volume data operations like S3 object access or Lambda invokes (opt-in, paid). Insights events detect unusual API call-rate anomalies.
Prerequisites: AWS CloudTrail、AWS Lambda
Related: CloudTrail advanced configuration
CodeDeploy (deployment groups/agent)
A deployment group bundles targets (EC2 tags, ASG, ECS/Lambda) and method (in-place/blue-green, canary/linear). appspec.yml defines lifecycle hooks to validate and auto-roll back on failure; EC2 needs the CodeDeploy agent.
Prerequisites: AWS Lambda、Auto Scaling policies and lifecycle hooks
Compliance reporting
Assessing and reporting adherence to standards and regulations; continuously surfaced by AWS Config (rule compliance), Audit Manager (evidence collection), and Security Hub (aggregated scores).
Prerequisites: AWS Config、AWS Audit Manager
Related: Audit trail、Change management
Consumption-based pricing
Paying for what you actually use rather than reserved capacity; no up-front investment and less waste.
Prerequisites: DynamoDB capacity modes (on-demand / provisioned + Auto Scaling)
Cost and Usage Report (CUR)
The most granular billing data report AWS provides. It outputs hourly usage, pricing, and discount breakdowns in CSV/Parquet to S3, serving as the source data for advanced analysis and chargeback via Athena or QuickSight.
Prerequisites: Cost allocation (chargeback/showback)、Amazon Athena、Amazon QuickSight
Cost governance
Organizationally governing cloud spend: alert via Budgets and anomaly detection; visualize with cost allocation tags and categories; curb over-provisioning via SCPs/Service Quotas; optimize with purchase options (RI/SP/Spot). The operational basis of FinOps.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、Cost allocation (chargeback/showback)、AWS Budgets、AWS Cost Explorer
Cross-account access
Access where a principal in one account assumes a role in another via AssumeRole; permitted by a trust policy, with ExternalId guarding against the confused-deputy problem for third parties.
Prerequisites: Principal、Trust policy、AssumeRole
CloudWatch Synthetics
A CloudWatch feature that runs canaries (configurable scripts) on a schedule to monitor endpoints and user flows from the outside, mimicking real users. It can detect availability or latency degradation before real traffic is affected, complementing SLA monitoring and health checks.
Prerequisites: CIA triad、Amazon CloudWatch、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Container Insights / Lambda Insights、CloudWatch ServiceLens
Glue Data Catalog
A central metadata store of tables, schemas, and partitions, referenced as shared metadata by Athena, Redshift Spectrum, and EMR.
Prerequisites: Amazon Redshift、AWS Glue
Related: Amazon Athena、Redshift Spectrum
Amazon OpenSearch Service
A managed search engine strong at full-text search and log analytics/observability, visualized via OpenSearch Dashboards (Kibana). Redshift leads for large aggregation analytics; use OpenSearch for search/log use cases.
Prerequisites: Amazon Redshift
DNS / name resolution (record types)
Translates domain names to IPs. Key records: A (IPv4), AAAA (IPv6), CNAME (alias; not at apex), MX (mail), TXT (verification), NS (delegation). AWS Alias records are a CNAME alternative that can point to AWS resources at the apex; TTL controls cache duration.
Related: Alias records
Amazon Inspector
A service that continuously scans and assesses EC2, ECR container images, and Lambda for known vulnerabilities (CVEs). Findings carry severity scores, can aggregate into Security Hub, and can be wired into CI/CD pipelines to block deploys of vulnerable images.
Prerequisites: AWS Lambda
Event source mapping and destinations
Event source mapping polls SQS/Kinesis/DynamoDB Streams to invoke Lambda. Tune batch size/window, and route failures to destinations or a DLQ.
Prerequisites: Amazon DynamoDB、AWS Lambda、Kinesis Data Streams、Polling vs. webhook (push/pull)
EBS encryption
A feature that encrypts EBS volumes at rest with an AWS KMS key. Snapshots and AMIs created from an encrypted volume inherit the encryption, and default encryption can be enforced account/Region-wide. An existing unencrypted volume cannot be converted directly—it must be copied via a snapshot.
Prerequisites: AWS KMS、Encryption、Encryption at rest
EBS snapshots
Incrementally backs up an EBS volume to S3 (only changes after the first). Snapshots can be copied across AZ/Region, turned into AMIs, and shared. Fast Snapshot Restore (FSR) removes first-touch latency; Data Lifecycle Manager automates schedules.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon Data Lifecycle Manager (DLM)
Encryption at rest
Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.
Prerequisites: Object storage
Related: Encryption
EventBridge Pipes
Point-to-point pipes that connect a source (SQS, Kinesis, DynamoDB Streams, etc.) directly to a target. Optional filtering, enrichment (e.g., via Lambda), and transformation steps can sit in between, often removing the need to write a separate Lambda just for integration glue.
Prerequisites: Amazon DynamoDB、AWS Lambda、AWS Glue、Kinesis Data Streams
Related: EventBridge Scheduler
HTTPS
HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.
Prerequisites: Encryption
Related: TLS
Instance profile (IAM role for EC2)
A container that passes an IAM role to EC2: instead of embedding access keys, the instance fetches auto-rotating temporary credentials via instance metadata (lower leak risk). IMDSv2 is recommended.
Prerequisites: AWS IAM、Instance metadata (IMDSv2)、Secrets Manager automatic rotation、Temporary credentials
Trust policy
A special resource policy attached to an IAM role that defines who may assume it (who can call sts:AssumeRole). It is distinct from the identity-based policy that grants the role's own permissions—both must align for the role to actually be assumable.
Prerequisites: AWS IAM、Identity-based policy、IAM policy structure (Effect/Action/Resource/Condition)
Related: AssumeRole
Lambda invocation models (sync/async/stream)
Synchronous waits for the result (e.g., API Gateway); asynchronous queues and runs later, retrying automatically with a dead-letter queue/Destinations on failure; stream/poll uses event source mappings (SQS/Kinesis). Failure handling differs by model.
Prerequisites: AWS Lambda、Kinesis Data Streams、Amazon API Gateway、Polling vs. webhook (push/pull)
CIDR notation
A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.
Fault tolerance
Designing so the service keeps running despite component failures—stronger than high availability (fast recovery): it continues without interruption. Achieved via redundant parallel paths (active/active), N+1, and spreading across AZs (auto-recovery, which involves a brief recovery, is more an HA technique).
Prerequisites: CIA triad
Single point of failure (SPOF)
A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.
Prerequisites: CIA triad、RDS Multi-AZ and read replicas
S3 Bucket Key
A feature that, when encrypting with SSE-KMS, reuses a short-lived bucket-level data key instead of calling KMS per object, sharply cutting the number of KMS API calls. It reduces KMS API cost and request-based throttling, and is recommended whenever a workload stores large volumes of objects under SSE-KMS.
Prerequisites: Envelope encryption and data keys、Encryption、S3 encryption and public-access prevention、Throttling (capacity)
Related: S3 default encryption、DSSE-KMS (dual-layer server-side encryption)
DynamoDB design features (GSI/DAX/Global Tables)
Global secondary indexes (GSI) enable alternate-key queries, DAX adds microsecond caching, Global Tables provide multi-Region active replication, and Streams emit change events. Capacity is on-demand or provisioned.
Prerequisites: Amazon DynamoDB、Pricing models (On-Demand / Savings Plans·RI / Spot)
AWS Compute Optimizer
Uses ML to analyze usage of EC2, EBS, Lambda, Auto Scaling groups, etc., detecting over/under-provisioning and recommending right-sizing. A starting point for cost optimization.
Prerequisites: Auto Scaling、AWS Lambda
AWS Control Tower
Automates setup and governance of multi-account environments. It builds a landing zone and applies guardrails (mandatory/recommended preventive and detective controls) to stand up a best-practice org quickly.
Prerequisites: Amazon Detective
AWS PrivateLink
A way to connect privately from a VPC to AWS services or another account's services without traversing the internet; traffic stays within the AWS network and avoids public routes.
Scalability
Adjusting capacity to demand; scale up = vertical (bigger machine), scale out = horizontal (more machines).
IAM Access Analyzer
A service supporting least privilege via external-access analysis (detect externally exposed S3/roles/KMS/Secrets), unused-access analysis (surface unused roles/permissions/access keys), policy validation, and least-privilege policy generation from CloudTrail.
Prerequisites: AWS CloudTrail
AWS Certificate Manager (ACM)
Provisions and auto-renews SSL/TLS certificates for free, integrated with ELB/CloudFront/API Gateway to prevent expiry-related outages; auto-renewal is most reliable with DNS validation (email validation can also auto-renew conditionally).
Prerequisites: Amazon CloudFront、Amazon API Gateway、TLS
Related: AWS Private Certificate Authority
AWS Shield (Standard/Advanced)
A DDoS protection service. Standard is free and automatic (L3/L4) for all AWS; Advanced (paid) adds L7 protection, 24/7 DRT support, cost protection, and detailed reporting—paired with WAF.
Related: AWS WAF
Auto Scaling policies and lifecycle hooks
Scaling methods: target tracking (hold a metric at target), step, scheduled, and predictive. Lifecycle hooks insert initialization or draining at launch/terminate.
Prerequisites: Auto Scaling
Elastic IP and placement groups
An Elastic IP is a remappable static public IP. Placement groups control physical instance placement: cluster (low latency), spread (fault isolation), or partition (large distributed).
Prerequisites: Placement groups (cluster/spread/partition)、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Public IPv4 address behavior
Parameter Store
A Systems Manager store that holds configuration and secrets (SecureString is KMS-encrypted) hierarchically with versioning, used to centralize app config.
Prerequisites: Encryption
Related: AWS Systems Manager (SSM)
SSM Document
A JSON/YAML definition of actions Systems Manager runs. Types include Command documents (for Run Command), Automation documents (runbooks), and Session documents; both AWS-provided and custom exist.
Prerequisites: JSON、Run Command、AWS Systems Manager (SSM)、SSM Automation (runbooks)
X-Ray sampling and subsegments
Sampling traces only a fraction of requests (rate controlled by rules) to limit overhead and cost. Segments/subsegments are the service spans/internal work (e.g., DB calls) within a trace; annotations add filterable metadata.
Related: AWS X-Ray
API Gateway caching
A per-stage response cache. For a configured TTL it returns a stored response for identical requests instead of invoking the backend (e.g., Lambda), cutting latency and backend load. Cache size is chosen from 0.5GB to 237GB and is billed hourly.
Prerequisites: AWS Lambda、Amazon API Gateway、Performance metrics (IOPS/throughput/bandwidth/latency)
API Gateway stage
A named environment (e.g., dev/prod) bound to a specific deployment of an API. Stage variables let backend targets differ per environment, and canary releases can route a portion of traffic to a new deployment. Each stage can carry its own settings such as throttling and log level.
Prerequisites: Amazon API Gateway、API Gateway features (stages, throttling, integrations)、Throttling (capacity)
Asynchronous replication
Replication that acknowledges first and applies to the replica afterward; low write latency but possible loss of not-yet-replicated data on failure. Used by read replicas and cross-Region replication; chosen vs. synchronous by RPO.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、Synchronous replication
AWS Artifact
Obtain AWS compliance reports and agreements (ISO/SOC audit artifacts) on demand.
Prerequisites: Audit trail、Pricing models (On-Demand / Savings Plans·RI / Spot)、Compliance reporting
Amazon RDS
A managed relational (SQL) database service supporting MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server engines; AWS handles patching, backups, Multi-AZ redundancy, and read replicas.
Prerequisites: RDS Multi-AZ and read replicas
Amazon S3
Object storage for images, backups, and assets with high durability, accessed over HTTP(S); optimize cost via storage classes (Standard/IA/Glacier).
Prerequisites: Durability and availability (nines)、Object storage
AWS Trusted Advisor
Checks/recommends best practices across cost, security, fault tolerance, performance, and service limits (for your environment).
Prerequisites: Fault tolerance
Capacity planning / demand forecasting
Estimating future load to plan needed capacity, cost, and scaling policy. In the cloud, Auto Scaling and predictive scaling follow demand dynamically, avoiding fixed over-provisioning; Compute Optimizer and CloudWatch trend analysis feed it.
Prerequisites: Auto Scaling scaling policies、Auto Scaling、Amazon CloudWatch、AWS Compute Optimizer
CloudWatch Network Monitor
A service that actively probes the network paths of hybrid connectivity between on-premises and AWS (Site-to-Site VPN, Direct Connect), monitoring latency and packet loss. It helps isolate whether a fault lies on the AWS side or the on-premises side.
Prerequisites: AWS Direct Connect、Amazon CloudWatch、AWS Site-to-Site VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: CloudWatch Internet Monitor
Containerization
Packaging an app and its dependencies into one image that runs the same anywhere. Lighter and faster to start than VMs, with higher density and portability. On AWS, run via ECR (registry) + ECS/EKS (orchestration) + Fargate (serverless).
Prerequisites: AWS Fargate、Serverless (FaaS)
Control types (preventive/detective/responsive)
Categories of security controls: preventive (stop it happening—SCPs, IAM, SGs), detective (find what happened—Config, GuardDuty, CloudTrail), and responsive/corrective (auto-fix—SSM Automation, Config remediation). Layered together; Control Tower guardrails follow this model.
Prerequisites: AWS CloudTrail、Amazon GuardDuty、AWS Control Tower、Amazon Detective
AWS Budgets
Sets budget thresholds on cost/usage/RI-SP coverage and alerts on actual or forecast overruns; Budget Actions can auto-apply IAM policies or stop resources.
Related: AWS Cost Explorer
CloudWatch alarm states
An alarm has three states: OK (within threshold), ALARM (breached), and INSUFFICIENT_DATA (not enough data—at startup or on missing metrics). Each transition can trigger actions (SNS notify, Auto Scaling, EC2 action).
Prerequisites: Auto Scaling、Amazon CloudWatch、EC2 status checks and auto recovery
CloudWatch Logs export to S3
A feature that exports logs accumulated in CloudWatch Logs to an S3 bucket for long-term retention, cost optimization (tiering to Glacier), or analysis in another tool. The export runs as a non-real-time batch job; for continuous streaming delivery, a subscription filter to Kinesis Data Firehose is used instead.
Prerequisites: CloudWatch Logs、Amazon Data Firehose、Kinesis Data Streams、Amazon CloudWatch
CloudWatch Metric Streams
Continuously delivers metrics in near real time to S3 or third parties (e.g., Datadog) via Data Firehose—lower latency and load than polling with GetMetricData for integrating external monitoring.
Prerequisites: CloudWatch metrics、Amazon Data Firehose、Amazon CloudWatch、Performance metrics (IOPS/throughput/bandwidth/latency)
CloudWatch ServiceLens
A CloudWatch feature that correlates metrics, logs, and X-Ray traces in a single view. It visualizes where latency or errors occur on a service map, speeding up root-cause analysis (RCA) in distributed systems.
Prerequisites: Amazon CloudWatch、AWS X-Ray、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Container Insights / Lambda Insights、CloudWatch Synthetics
AWS Lake Formation
Centralizes data-lake permissions. Grants column/row/cell-level access on Glue Data Catalog tables, applied consistently to Athena/Redshift Spectrum/EMR. LF-Tags (tag-based access control) enable governance at scale by attribute, covering granularity IAM alone struggles with.
Prerequisites: Amazon Redshift、Amazon Athena、Glue Data Catalog、AWS Glue
Amazon Macie
A service that uses ML to discover and classify sensitive data (PII, credentials, etc.) in S3. It supports data-protection compliance, and findings can aggregate into Security Hub for continuous monitoring.
API Gateway features (stages, throttling, integrations)
Stages (dev/prod) separate deployments with stage variables; throttling and caching protect and speed up; Lambda proxy integration and mapping templates transform requests/responses; CORS is configured.
Prerequisites: AWS Lambda、Amazon API Gateway、Throttling (capacity)
Public IPv4 address behavior
A standard auto-assigned public IPv4 address is dynamic and can change whenever the instance is stopped and started. To keep it fixed, a separately allocated, remappable Elastic IP is required (Elastic IP itself is a distinct concept).
Related: Dual-stack VPC (IPv4/IPv6)、Elastic IP and placement groups
Edge computing
Processing near users/data (the edge) to cut latency. On AWS via CloudFront/Lambda@Edge/CloudFront Functions (delivery edge), Local Zones and Wavelength (low-latency zones), and Outposts (on-premises).
Prerequisites: CloudFront origin protection (OAC) and edge functions、Edge extensions (Local Zones / Outposts / Wavelength)、Amazon CloudFront、AWS Lambda
EventBridge rule
A rule that routes events matching an event pattern (match conditions on source/content) or a schedule to one or more targets (Lambda, SQS, Step Functions, etc.). A single rule can have multiple targets, and retry behavior or a dead-letter queue for failed deliveries can be configured.
Prerequisites: AWS Lambda、AWS Step Functions、Dead-letter queue (DLQ)
Data Firehose features (buffering/transform/dynamic partitioning)
Buffering accumulates by size/time before delivery (avoiding many tiny files); Lambda transformation processes records pre-delivery; format conversion turns JSON into Parquet/ORC; dynamic partitioning splits S3 paths by content to improve Athena query efficiency.
Prerequisites: AWS Lambda、Amazon Athena、JSON
Related: Amazon Data Firehose
AWS SAM (Serverless Application Model)
An extension that lets you write CloudFormation concisely for serverless (Lambda/API Gateway/DynamoDB); its short syntax expands into a CloudFormation template at deploy, and sam local enables local run/test.
Prerequisites: AWS CloudFormation、Amazon DynamoDB、AWS Lambda、Amazon API Gateway
Identity-based policy
A policy attached to an IAM user, group, or role that defines what that principal can do. It comes as managed policies (AWS- or customer-managed) or inline policies, and is the basic form of granting permissions within the same account.
Prerequisites: IAM inline policy、Principal、IAM user
Related: Resource-based policy
IAM inline policy
A policy embedded directly inside a single IAM user, group, or role, tied strictly one-to-one to that identity. It can't be attached to or reused by another identity, and it disappears when its identity is deleted. It's used for narrow cases where exactly one identity needs an exceptional permission.
Prerequisites: AWS IAM、IAM user
Related: IAM managed policy
Idempotency key pattern
A design pattern where the client attaches a unique key to each request and the server caches that key's result so a resend with the same key is not re-executed. It guards against network retries or SQS at-least-once delivery causing the same operation (e.g., a duplicate payment) to run twice; a common implementation checks first-use of the key with a DynamoDB conditional write.
Prerequisites: Amazon DynamoDB、Delivery semantics (at-least-once/exactly-once)、DynamoDB write control (conditional/transactions)
Related: Optimistic locking、Pessimistic locking
Launch template
A versioned definition bundling launch settings (AMI, instance type, user data, networking) used by Auto Scaling and Spot; the older launch configuration is legacy.
Prerequisites: Auto Scaling、Pricing models (On-Demand / Savings Plans·RI / Spot)、User data
Iterative least-privilege tightening
An operating cycle that starts broad, then continuously removes unneeded permissions based on Access Analyzer’s unused access, actual usage in CloudTrail, and Access Advisor’s last-accessed data—tightening safely with generated policies.
Prerequisites: AWS CloudTrail、Access Advisor (last-accessed info)、IAM Access Analyzer
Loose coupling (decoupling)
A design that separates components via queues (SQS), notifications (SNS), or events (EventBridge) instead of direct calls—so failures/load on one side don’t cascade, and parts scale and deploy independently while buffering spikes.
Prerequisites: Data Firehose features (buffering/transform/dynamic partitioning)
Ephemeral port
A temporary high-numbered port (typically 1024–65535) a client uses for the return leg of a connection. Stateless firewall rules (e.g., network ACLs) must explicitly allow this range for return traffic to work—an easily overlooked source of misconfiguration.
Prerequisites: Network ACL (NACL)、Port number
NAT instance vs. NAT gateway
Two ways to provide egress for private subnets. A NAT gateway is managed, highly available (redundant in an AZ), and auto-scaling (recommended). A NAT instance is a self-run EC2 (requires disabling source/destination check, is a single point of failure, cheap/special-purpose).
Prerequisites: Single point of failure (SPOF)、Subnet、Public / private subnet
Three pillars of observability (metrics/logs/traces)
Three signals to understand a system from outside: metrics (numeric time-series for trends/alerts), logs (records of discrete events for root cause), and traces (a request’s path and latency for bottlenecks). On AWS, CloudWatch + X-Ray provide these.
Prerequisites: Amazon CloudWatch、AWS X-Ray、Performance metrics (IOPS/throughput/bandwidth/latency)
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: HTTPS
S3 default encryption
A setting that automatically encrypts newly stored objects in a bucket. Today it is on by default for every S3 bucket (SSE-S3) and cannot be turned off; switching to SSE-KMS or DSSE-KMS lets you meet stronger key-management or compliance requirements.
Prerequisites: EBS encryption、Encryption、DSSE-KMS (dual-layer server-side encryption)、S3 encryption and public-access prevention
Related: S3 Bucket Key
Aurora features (Serverless / Global Database)
Aurora is a durable DB replicating 6 copies across 3 AZs. Aurora Serverless v2 auto-scales to load, and Global Database replicates to multiple Regions at low latency for DR and reads.
Prerequisites: Amazon Aurora、Performance metrics (IOPS/throughput/bandwidth/latency)、Serverless (FaaS)
RDS Multi-AZ and read replicas
Multi-AZ provides HA via a synchronous standby with automatic failover (for availability), while read replicas scale reads via async replication (for performance)—distinct purposes.
Prerequisites: CIA triad
Amazon SNS
Publish/subscribe messaging that fans out one message to many subscribers (push-based, 1:many); SNS + SQS forms a fan-out pattern.
Prerequisites: Polling vs. webhook (push/pull)
AWS Security Hub
Aggregates findings from GuardDuty, Inspector, Macie, Config, and more in ASFF format and presents compliance scores against CIS and the AWS Foundational Security Best Practices, visualizing security posture.
Prerequisites: Amazon GuardDuty、Amazon Inspector、Amazon Macie
CloudTrail advanced configuration
An organization trail centrally records all accounts, log file validation detects tampering, and data events record S3 object/Lambda invocations in detail. CloudTrail Lake enables SQL query analysis.
Prerequisites: AWS CloudTrail、AWS Lambda
Amazon Detective
A service that builds an entity behavior graph from GuardDuty/CloudTrail/VPC Flow Logs to investigate the timeline, scope, and root cause of an attack from a finding. GuardDuty does detection; Detective does investigation.
Prerequisites: AWS CloudTrail、Amazon GuardDuty、Blast radius
KMS key policies and grants
Access to a KMS key is controlled by the key policy (resource-based, the ultimate source of permission), combined with IAM policies and grants (temporary, programmatic delegation). Multi-Region keys replicate across Regions.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Resource-based policy、Multi-Region (active-active / active-standby)
AWS Network Firewall
A managed network firewall that statefully inspects and filters VPC traffic. With domain allow-lists, IPS/IDS, and protocol inspection, it provides more advanced perimeter defense than SGs/NACLs.
Prerequisites: Network ACL (NACL)
Patch Manager
Defines approved patches via patch baselines and applies them fleet-wide within maintenance windows, evaluating patch compliance.
Related: Patch compliance
Run Command
A Systems Manager feature to run commands/scripts across many instances at once without SSH/RDP, targeting by tags and aggregating results.
Related: AWS Systems Manager (SSM)
Session Manager
Connects to an instance shell from the browser/CLI with no open ports and no bastion, logging activity to CloudTrail/S3.
Prerequisites: AWS CloudTrail
Public / private subnet
A public subnet has a route to an internet gateway (IGW) for direct external traffic; a private subnet has no IGW route and reaches out via a NAT gateway. Best practice: place only public-facing resources in public subnets.
Prerequisites: Route table、Subnet
Related: Internet gateway (IGW)
Tag Editor
A console tool that searches existing resources across an account and lets you bulk-add, edit, or remove tags. It is used to retroactively enforce a tagging strategy or bulk-apply cost allocation tags, avoiding opening each resource individually to edit tags.
Prerequisites: Cost allocation (chargeback/showback)、AWS Cost Explorer、IAM policy structure (Effect/Action/Resource/Condition)、Tagging strategy
Related: AWS Resource Groups
Tagging strategy
A consistent policy for applying key/value tags to resources—used for cost allocation (chargeback), automation (targeting), access control (ABAC), and inventory; enforced/monitored via tag policies, cost allocation tags, and Config.
Prerequisites: Cost allocation (chargeback/showback)、AWS Cost Explorer、Tag policies (Organizations)、ABAC (attribute-based access control)
Transit Gateway attachment
The unit representing each thing connected to a Transit Gateway—a VPC, a VPN, a Direct Connect gateway, a Direct Connect transit VIF, or a peering to another TGW. Each attachment associates with exactly one TGW route table, which determines what it can communicate with.
Prerequisites: Direct Connect architecture (VIF / DX Gateway / LAG)、AWS Direct Connect、Route table、Transit Gateway
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Encryption、Managed services (management boundary)
Related: HTTPS
UDP
A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.
Prerequisites: Message ordering、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: ICMP、Port number、TCP
VPC flow log fields and destinations
Flow logs record source/destination IP, ports, protocol, bytes, and ACCEPT/REJECT, etc. Destinations are CloudWatch Logs, S3, or Data Firehose. Enabled per ENI/subnet/VPC for investigating rejected traffic and analyzing flows.
Prerequisites: CloudWatch Logs、Amazon Data Firehose、Amazon CloudWatch、Subnet
VPC/subnet quotas
The limits governing VPC network design—such as VPCs per Region and subnets per VPC—which can be checked and increase-requested via Service Quotas. By contrast, the subnet CIDR size range (/16 to /28) is a fixed architectural specification of VPC/subnets, not a Service-Quotas-adjustable value. A subnet's own CIDR block cannot be changed after creation, but a VPC's address space can be expanded by adding secondary CIDR blocks.
Prerequisites: CIDR notation、Service Quotas、Subnet、Secondary CIDR block
Related: Subnet reserved addresses
WAF logging
A feature that sends details of requests WAF inspected—matched rule, action taken, headers, etc.—to CloudWatch Logs, S3, or Kinesis Data Firehose. Used to investigate false positives and tune rules.
Prerequisites: CloudWatch Logs、Amazon Data Firehose、Kinesis Data Streams、Amazon CloudWatch
Related: WAF Bot Control
Accelerated Site-to-Site VPN
An option that routes VPN traffic through AWS Global Accelerator edge locations onto the AWS backbone network as early as possible, reducing latency and jitter over the public internet segment. Useful for geographically distant sites or latency-sensitive workloads.
Prerequisites: AWS Global Accelerator、Edge location、AWS Site-to-Site VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
Application Load Balancer (ALB)
An L7 load balancer supporting host/path-based routing, target groups, sticky sessions, and auth integration (OIDC/Cognito), used to route HTTP apps.
Prerequisites: Amazon Cognito、ALB features (routing/sticky/target group)
Direct Connect architecture (VIF / DX Gateway / LAG)
A virtual interface (VIF) is the logical connection unit over Direct Connect: a private VIF to a VPC, a public VIF to AWS public services, and a transit VIF to a Transit Gateway. A Direct Connect Gateway connects multiple Regions/VPCs together, and a LAG (link aggregation group) bundles physical links for more bandwidth (resiliency is separate—use multiple locations).
Prerequisites: AWS Direct Connect、Performance metrics (IOPS/throughput/bandwidth/latency)、Transit Gateway
Amazon VPC IP Address Manager (IPAM)
A service to plan, allocate, track, and monitor IP address space across an organization. It prevents overlapping CIDRs and auto-allocates from hierarchical pools to accounts/Regions.
Prerequisites: Amazon VPC、CIDR notation
Network Load Balancer (NLB)
An ultra-high-performance L4 load balancer. It has static IPs (per AZ), can preserve client IP, and is used for cross-zone load balancing and exposing services via PrivateLink.
Prerequisites: Cross-zone load balancing、AWS PrivateLink
Anycast
A communication mode that advertises the same IP address from multiple locations at once, automatically routing traffic to the topologically nearest node. CDNs, DNS, and global load-balancing services use it as the foundation for low latency and high availability.
Prerequisites: CIA triad、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Unicast
Warm pool
A mechanism that keeps pre-initialized instances (stopped or running) on standby in a separate pool ahead of an Auto Scaling group's scale-out. It cuts startup time far below launching from scratch during a demand spike, especially valuable for apps with heavy boot processes; the standby state (stopped vs. running) lets you trade off cost against responsiveness.
Prerequisites: Auto Scaling、Scalability
AWS App Runner
A fully managed service that automatically builds, deploys, and scales web apps/APIs from source code or a container image. It exposes containerized apps without managing load balancers, autoscaling, or certificates—lower operational overhead than ECS/Fargate. In DevOps, the choice for running a simple container web service with minimal ops.
Prerequisites: AWS Fargate、Containerization、Managed services (management boundary)
Availability Zone (AZ)
One or more isolated datacenters within a Region (separate power/cooling/network); spreading across AZs gives high availability.
Prerequisites: CIA triad
AWS Copilot (CLI)
A command-line tool to build, deploy, and operate containerized apps on ECS/Fargate/App Runner. Declaring a service type (e.g., Load Balanced Web Service) and environments (test/prod) generates the underlying CloudFormation, pipelines, and logging. Unrelated to GitHub Copilot.
Prerequisites: AWS App Runner、AWS CloudFormation、AWS Fargate、Containerization
Edge location
Sites that cache/deliver content near users (Amazon CloudFront) for low-latency delivery.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon CloudFront
Amazon Managed Service for Prometheus (AMP)
A managed, Prometheus-compatible metrics ingestion/storage service. You query container-environment metrics (EKS/ECS, etc.) with PromQL while AWS handles scale and retention—commonly paired with Managed Grafana for visualization.
Prerequisites: Amazon Managed Grafana、Managed services (management boundary)
Security group (AWS)
A virtual firewall controlling traffic at the instance (ENI) level; stateful (return traffic auto-allowed) and allow-rules only (no deny rules).
Related: Network ACL (NACL)
AWS Backup Audit Manager
Continuously evaluates whether backups comply with organizational policy (frequency, retention, encryption, cross-Region) and generates compliance reports—detecting unprotected resources and deviations to meet audit requirements.
Prerequisites: Compliance reporting、Encryption、AWS Audit Manager、AWS Backup
Block storage
Low-latency storage the OS mounts as a volume (EBS); suited to databases and boot disks. Most volumes attach to a single instance, but configurations like EBS Multi-Attach allow simultaneous attachment from multiple instances.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: File storage、Object storage
DeletionPolicy (Retain/Snapshot)
A CloudFormation attribute specifying what happens to a resource on stack delete/replace: Retain (keep), Snapshot (snapshot then delete), or Delete (default). Used to protect databases/buckets from accidental deletion.
Prerequisites: AWS CloudFormation、IAM policy structure (Effect/Action/Resource/Condition)
Compliance programs and AWS Artifact
AWS complies with third-party certifications (ISO, SOC, PCI DSS, HIPAA, FedRAMP) and provides their audit reports on demand via AWS Artifact. Scope is shared per the shared responsibility model.
Prerequisites: AWS Artifact、Pricing models (On-Demand / Savings Plans·RI / Spot)、Shared responsibility model
CloudFront cache policy
A setting that defines the TTLs (min/default/max) CloudFront uses when caching an object and which elements (headers, query strings, cookies) are included in the cache key. Narrowing the cache key raises the hit ratio and reduces origin load, trading off against how finely responses need to vary per request.
Prerequisites: Amazon CloudFront
CloudFront geo restriction
A per-distribution control that allows or blocks delivery using a country-code allow list or deny list. It's used to satisfy content-licensing or export-regulation requirements that are geography-specific. Because it judges location from IP geolocation, it can be bypassed via VPNs.
Prerequisites: Amazon CloudFront、Route 53 routing policies、SCP deny-list strategy
Related: CloudFront automatic compression
CloudFront signed URL
A URL that restricts access to a single file by expiry, IP, or a custom policy. Because one signed URL maps to exactly one object, distributing many files (e.g., video segments) means generating one per request; it is signed with a CloudFront key pair or a trusted key group.
Prerequisites: Amazon CloudFront、S3 developer features (presigned URLs, encryption)、X-Ray sampling and subsegments
Related: CloudFront signed cookies
Amazon ECS (Elastic Container Service)
AWS-native container orchestration: describe containers in a task definition and run them on the EC2 launch type (self-managed) or the Fargate launch type (serverless); scales by task/service.
Prerequisites: AWS Fargate、Serverless (FaaS)
CloudWatch Logs Insights
Interactively analyzes logs stored in CloudWatch Logs with a purpose-built query language (fields/filter/stats/sort/limit) to filter and aggregate—e.g., error counts or top IPs. Billed by the volume of data scanned.
Prerequisites: CloudWatch Logs
Related: Amazon CloudWatch
Connection pooling
A mechanism that pre-establishes database connections and holds them in a pool, avoiding the overhead of opening a new connection per request and preventing connection exhaustion. Amazon RDS Proxy is the flagship example, and it matters most for serverless/high-concurrency apps like Lambda.
Prerequisites: AWS Lambda、Amazon RDS、Amazon RDS Proxy、Serverless (FaaS)
DynamoDB capacity modes (on-demand / provisioned + Auto Scaling)
On-demand requires no capacity management and auto-follows demand (unpredictable load, pay-per-use); provisioned sets RCUs/WCUs with Auto Scaling tracking a utilization target (cheaper for predictable load; reserved capacity adds discounts). Choose by load profile.
Prerequisites: Auto Scaling、Amazon DynamoDB、Pricing models (On-Demand / Savings Plans·RI / Spot)
Redshift Spectrum
Queries S3 data directly from Redshift. Without loading, it joins across the data lake and warehouse, referencing the Glue Data Catalog.
Related: Amazon Redshift、Glue Data Catalog、AWS Glue
Durability and availability (nines)
Durability = probability of not losing data (S3 is 99.999999999%—eleven nines—virtually no loss). Availability = probability the service is reachable (e.g., 99.99% ≈ 52 minutes/year of downtime). They are distinct; SLAs are usually stated as availability.
Prerequisites: CIA triad
Amazon Cognito
App user auth/authorization. User pool = sign-up/sign-in (authentication) issuing JWTs; identity pool = exchange tokens for temporary AWS credentials (AWS authorization). Supports external-IdP federation and MFA.
Lambda configuration (layers, env vars, ephemeral storage)
Share common libraries via layers and pass settings via environment variables (KMS-encryptable). The /tmp ephemeral storage scales up to 10GB, and the memory setting also determines CPU allocation.
Prerequisites: AWS Lambda、Encryption
Instance Metadata Service (IMDS)
An endpoint at 169.254.169.254 that lets an EC2 instance read its own data (instance ID, the IAM role’s temporary credentials, user data, etc.). IMDSv2 requires a session token to prevent credential theft via SSRF (enforcing it is recommended).
Prerequisites: AWS IAM、User data、Instance metadata (IMDSv2)、Temporary credentials
EC2 status checks and auto recovery
System status check = AWS-side infrastructure issues (host/network); instance status check = internal causes (OS/config); there is also an attached-EBS status check. A CloudWatch alarm’s EC2 action (recover/reboot/stop/terminate) configures auto recovery.
Prerequisites: Amazon CloudWatch
User data
A bootstrap script run at an EC2 instance's first boot to automate package installation and configuration; by default it runs once at launch.
Related: Bootstrapping
ECS task role
The IAM role that the application code running inside the container assumes to call AWS APIs such as S3 or DynamoDB. It's the target for least-privilege scoping of the app's own permissions, specified via a task definition's taskRoleArn.
Prerequisites: Amazon DynamoDB、AWS IAM
Encryption in transit
Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.
Prerequisites: Encryption at rest
Related: Encryption
Error rate
The proportion of failed requests out of total requests. It's one of the most common SLIs, used as a CloudWatch metric and alarm threshold; a sudden spike is often monitored as a signal of a deployment-caused failure or throttling.
Prerequisites: Amazon CloudWatch、Throttling (capacity)
Related: Toil
Hashing
A one-way, non-reversible transform; used for password storage and tamper detection (cannot be decrypted, unlike encryption).
Prerequisites: Encryption
Horizontal scaling (scale out)
Scaling by adding more instances to spread the load. It assumes a stateless design plus a load balancer and auto scaling, and since one instance failing doesn't take down the whole system, it also improves fault tolerance. Considered the default direction in cloud-native design.
Prerequisites: Auto Scaling、Fault tolerance、Scalability
Access Advisor (last-accessed info)
An IAM feature showing when a user/role/policy last accessed each service (last-accessed info). Used to identify unused, excessive permissions and tighten toward least privilege.
IAM condition keys
Keys used in a policy’s Condition: aws:SourceIp (source IP), aws:MultiFactorAuthPresent (require MFA), aws:PrincipalTag/ResourceTag (ABAC), aws:SourceVpce (via a specific endpoint), etc. The crux of fine-grained access control.
Prerequisites: ABAC (attribute-based access control)
IAM Policy Simulator
A tool that evaluates whether a given principal would be allowed an action—without making the real request—for pre-deployment permission testing.
Prerequisites: Principal、IAM policy evaluation logic
Session policy
A temporary inline policy passed programmatically during AssumeRole that further narrows the assumed role permissions for that session (it can only restrict, never expand).
Prerequisites: IAM inline policy、AssumeRole
ICMP
A protocol for control and diagnostic messages rather than data transfer. It powers ping (reachability checks) and traceroute (path checks), and carries unreachable/TTL-exceeded notifications—essential for diagnosing network connectivity issues.
Related: Port number、TCP、UDP
IPsec
A protocol suite that encrypts and authenticates traffic at the IP packet level, used to encrypt the path in site-to-site VPNs (on-prem to a cloud VNet/VPC). The tunnel won't establish unless both ends agree on encryption, integrity, and key-exchange settings.
Prerequisites: Encryption
RPO (Recovery Point Objective)
A target indicating how far back in time data must be recoverable after a failure, determined by backup frequency; a smaller RPO means less tolerable data loss. Distinct from RTO, which is about recovery time.
Related: RTO (Recovery Time Objective)
RTO (Recovery Time Objective)
A target for how much time is allowed to restore service after a failure occurs; a smaller RTO means faster recovery is required. Distinct from RPO, which concerns tolerable data loss.
Related: RPO (Recovery Point Objective)
Message ordering
A guarantee that messages are processed in send order. Standard SQS/SNS do not guarantee order (high throughput); FIFO guarantees order per message group. When order matters, address it with group-ID design or a single consumer.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: FIFO (ordering / deduplication)
Object storage
Virtually unlimited storage that manages data by key and is accessed over HTTP (S3); suited to backups, distribution, and data lakes, with a flat namespace rather than a hierarchy.
Related: Block storage、File storage
Optimistic locking
A concurrency-control technique that compares a version number or timestamp at update time and lets the write succeed only if no one else has changed the record. It doesn't lock upfront, so concurrency stays high; DynamoDB conditional writes (ConditionExpression) are the classic implementation, with conflicts resolved by retrying.
Prerequisites: Amazon DynamoDB
Related: Idempotency key pattern、DynamoDB write control (conditional/transactions)
Tag policies (Organizations)
An Organizations feature that enforces standard tag keys/allowed values org-wide and detects non-compliant tags—ensuring the tag consistency that cost allocation and ABAC depend on. Distinct from SCPs (SCPs govern permissions; tag policies govern tags).
Prerequisites: AWS Organizations (consolidated billing)、Cost allocation (chargeback/showback)、ABAC (attribute-based access control)
Provisioned vs. serverless
A capacity-model contrast. Provisioned reserves capacity ahead (predictable, steady load—can be cheaper); serverless auto-follows demand, pay-per-use, no capacity management (intermittent/unpredictable load). A choice across Aurora, DynamoDB, Lambda, etc.
Prerequisites: Amazon DynamoDB、AWS Lambda、Amazon Aurora、Serverless (FaaS)
DSSE-KMS (dual-layer server-side encryption)
A server-side encryption mode that applies two independent encryption layers to an S3 object using KMS keys. It targets regulated workloads with high-assurance requirements (mandated double encryption) that a single layer can't satisfy, such as FIPS 140-2 or ITAR contexts, at a higher processing cost than ordinary SSE-KMS.
Prerequisites: Encryption
Related: S3 Bucket Key、S3 encryption and public-access prevention
DR strategies (four)
Backup & restore (cheap/slow) → pilot light → warm standby → multi-site (costly/fast); shorter RTO/RPO costs more. Use cross-region replication + Route 53 failover for region-wide failures.
Prerequisites: Amazon Route 53
SNS fan-out and event-driven
Fan-out from one SNS topic to multiple SQS queues or Lambdas enables decoupled parallel processing. EventBridge routes events to many targets via rules.
Prerequisites: AWS Lambda、Loose coupling (decoupling)、Amazon SNS
Amazon SQS
A fully managed message queue that decouples producers/consumers and buffers work to absorb spikes (pull-based, typically 1:1).
Prerequisites: Loose coupling (decoupling)、Managed services (management boundary)、Polling vs. webhook (push/pull)
Resource Access Manager (RAM)
Shares specific AWS resources (Transit Gateway, subnets, licenses, etc.) across accounts and the organization, letting multiple accounts use them without duplication.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Transit Gateway、Subnet
VPC peering
A one-to-one direct connection between two VPCs. It is non-transitive, so connecting many VPCs becomes a hard-to-manage full mesh—use Transit Gateway at scale.
Related: Transit Gateway
Instance metadata (IMDSv2)
A scheme requiring a session token (PUT→GET) to access EC2 instance metadata, preventing SSRF-based theft of the instance role’s temporary credentials. The recommendation is to disable IMDSv1 and enforce IMDSv2.
Prerequisites: Temporary credentials
WAF rules (managed/rate-based)
AWS WAF evaluates rules in a Web ACL: AWS managed rule groups (common threats, OWASP, bots), rate-based rules (limit IPs exceeding a threshold), and custom rules.
Prerequisites: AWS WAF
Related: Rate limiting
Amazon Security Lake
A service that automatically centralizes and normalizes security logs/events (to the OCSF standard schema) into an S3 data lake in a dedicated account. It aggregates VPC Flow Logs, CloudTrail, Route 53, and various AWS/third-party security data for cross-source analysis with Athena/OpenSearch.
Prerequisites: AWS CloudTrail、Amazon Route 53、Amazon Athena、Amazon OpenSearch Service
Certificate revocation (CRL / OCSP)
Mechanisms to invalidate a compromised certificate before expiry: CRL distributes a revocation list; OCSP queries revocation status online (OCSP stapling improves efficiency). Managed when running a private CA via ACM Private CA (PCA).
Prerequisites: AWS Private Certificate Authority
AWS Backup
Centralized backup across services (EBS/RDS/DynamoDB/EFS, etc.). Backup plans define schedule and retention, with cross-region/cross-account copy and Backup Vault Lock (WORM) to prevent deletion.
Prerequisites: Amazon DynamoDB
CloudWatch agent
An agent required to collect in-guest OS metrics like EC2 memory usage and disk free space, which are not available by default (a common SOA gotcha); it also collects logs.
Prerequisites: Amazon CloudWatch
CloudWatch dashboards and Synthetics
Dashboards visualize metrics/logs on one screen, and Synthetics canaries continuously test endpoint availability and response via synthetic monitoring.
Prerequisites: CIA triad、CloudWatch Synthetics、Amazon CloudWatch
Amazon Application Recovery Controller (ARC)
A service to control availability and disaster recovery of multi-Region/multi-AZ applications. It continuously checks each cell’s readiness and provides routing controls to perform failover (traffic shifting) safely, giving governance to execute complex recovery actions reliably.
Prerequisites: CIA triad、Multi-Region (active-active / active-standby)、RDS Multi-AZ and read replicas
SSM Inventory
A Systems Manager capability that collects metadata—installed software, applications, network configuration, and more—from managed instances into a central view. Collected data can feed Athena/QuickSight for compliance assessment and asset inventory.
Prerequisites: Amazon Athena、Amazon QuickSight、AWS Systems Manager (SSM)
Related: SSM State Manager
SSM State Manager
A Systems Manager capability that defines an instance's desired configuration (OS settings, agents, scheduled tasks, etc.) and continuously, automatically enforces and remediates it. Defined as an association that runs on a schedule, reverting drift back to the declared state.
Prerequisites: AWS Systems Manager (SSM)
Related: SSM Inventory
Synchronous replication
Replication that waits for the replica to commit before acknowledging a write; zero data loss on failure (RPO 0) at the cost of higher write latency. Used by RDS Multi-AZ, etc.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、RDS Multi-AZ and read replicas
TCP
A reliability-focused transport-layer protocol that establishes a connection (three-way handshake), guarantees ordering, and retransmits lost data. Used for HTTP, SSH, database connections, and anywhere data loss or reordering is unacceptable.
Prerequisites: Message ordering
Related: ICMP、Port number、UDP
Transit Gateway route table
A route table that controls reachability between the attachments connected to a Transit Gateway. Combining association (which route table an attachment resolves routes through) with propagation (whether another attachment's routes are auto-injected) implements segmentation between environments such as production and development.
Prerequisites: Route table、Transit Gateway、X-Ray sampling and subsegments
Transit Gateway vs. VPC peering
Choosing a connectivity model. VPC peering is 1:1 and non-transitive (A-B and B-C don’t let A reach C), so full mesh explodes in management. Transit Gateway is hub-and-spoke, aggregating many VPCs/on-prem with route-table segmentation (for scale).
Prerequisites: Route table、Transit Gateway、VPC peering、X-Ray sampling and subsegments
Dual-stack VPC (IPv4/IPv6)
A configuration where a single VPC/subnet runs both IPv4 and IPv6 addressing together. IPv6 addresses are all globally routable with no exhaustion concern, but to allow only outbound traffic and block inbound, an egress-only internet gateway is used.
Prerequisites: Centralized egress and egress-only IGW、Internet gateway (IGW)、Subnet
Related: Public IPv4 address behavior
Elastic Network Interface (ENI)
A virtual network card holding private IPs, Elastic IPs, security groups, and a MAC; it can be detached/attached between instances (failover). Multiple ENIs enable multi-homing or separating management/data traffic.
Prerequisites: Security group (AWS)、Elastic IP and placement groups
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON
Related: AWS CloudFormation
AMI distribution and lifecycle (copy/share/deprecate)
Distributing and aging AMIs: copy (replicate to another Region/account for encryption or DR), launch permissions (share with other accounts), deprecate (discourage new use while existing remains usable), and deregister (make the AMI unusable).
Prerequisites: Encryption
Managed prefix lists
Bundles multiple CIDRs into one named list referenced by security groups and route tables. Changing an entry propagates to all references, simplifying rule maintenance.
Prerequisites: Security group (AWS)、CIDR notation、Route table
Route 53 health checks and failover
Monitors endpoint health and, on failure, fails over to a healthy target via failover routing. It also supports calculated health checks and CloudWatch alarm integration.
Prerequisites: Amazon Route 53、Amazon CloudWatch、Route 53 routing policies
Transit Gateway appliance mode and centralized inspection
To inspect many VPCs’ traffic in one place (an inspection VPC), split TGW route tables to route through the inspection VPC. If forward and return traverse appliances in different AZs, asymmetric routing drops the return, so enable TGW appliance mode to pin a flow to the same-AZ appliance.
Prerequisites: Route table、Transit Gateway
Capacity Rebalancing
An Auto Scaling group feature that proactively launches a replacement instance as soon as AWS signals an elevated risk of Spot interruption, without waiting for the actual interruption notice. The existing instance is terminated only after the replacement is healthy, minimizing impact on availability.
Prerequisites: Auto Scaling、Pricing models (On-Demand / Savings Plans·RI / Spot)、CIA triad
Auto Scaling capacity settings (min/desired/max)
Auto Scaling group sizing: minimum (floor), maximum (ceiling), and desired capacity (the count to maintain now). Scaling adjusts desired capacity within the min–max range.
Prerequisites: Auto Scaling
AWS (Amazon Web Services)
One of the largest public clouds, offering compute, storage, databases, networking, and more on a pay-as-you-go basis.
Prerequisites: Consumption-based pricing
AWS CodeBuild
A fully managed build/test service; compiles and tests source per steps defined in buildspec.yml and produces artifacts. Pay-per-use with no build servers to manage.
Prerequisites: Consumption-based pricing、Managed services (management boundary)
Related: CodeDeploy (deployment groups/agent)
Amazon EBS
Block storage—a virtual disk attached to EC2; one volume normally attaches to one instance (io1/io2 support Multi-Attach to several), while one instance can have many volumes. Types include gp3/io2, backed up via snapshots.
Prerequisites: Block storage
Amazon EC2
Virtual servers (IaaS), the most flexible compute where you manage the OS and above; optimize via purchasing options (On-Demand/RI/Savings Plans/Spot).
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)
Amazon EFS
File storage—an NFS file system many EC2 can mount and share.
Prerequisites: File storage
Elastic Load Balancing (ELB)
Distributes traffic to healthy targets across instances/AZs; a staple for high availability.
Prerequisites: CIA triad
AWS Fault Injection Simulator (FIS)
A managed chaos-engineering/fault-injection service. You define experiments (CPU stress, instance stop, API throttling, AZ impairment, etc.) as templates with stop conditions (guardrails) to validate resilience in production-like environments—the DevOps "break it to learn" resilience testing.
Prerequisites: API Gateway features (stages, throttling, integrations)、Throttling (capacity)
AWS Private Certificate Authority
A managed service for running a private certificate authority (CA) for internal use. It issues private certificates that public ACM cannot, enabling mutual TLS (mTLS) between internal services and use cases like IoT device authentication where a public CA is inappropriate, including building a CA hierarchy.
Prerequisites: Managed services (management boundary)
Related: AWS Certificate Manager (ACM)
Centralized logging (log archive account)
A best practice of aggregating organization logs (CloudTrail, Config, VPC flow logs, app logs) into S3 in a dedicated log archive account, with tamper-proofing (Object Lock) and long-term retention. Control Tower’s landing zone provisions this by default.
Prerequisites: AWS CloudTrail、S3 Object Lock、AWS Control Tower
Stack policy
A JSON policy that protects specific resources from update/replace/delete during a stack update—guarding e.g. production databases from unintended changes. Distinct from IAM policies.
Prerequisites: JSON
Change management
A management process for planning, assessing, approving, and recording changes to production so they can be applied safely with minimal impact (ITIL's change management is a representative example). Its core elements are approval workflows, controlling allowed change windows, and having a rollback procedure ready; AWS tools like SSM Change Calendar and Change Manager automate parts of this for AWS workloads specifically.
Prerequisites: SSM Change Calendar
Related: Audit trail、Compliance reporting
Field-level encryption
Encrypts specific form fields (e.g., credit-card numbers) with a public key at the CloudFront edge and carries them confidentially to the origin; only the final processing point with the matching private key decrypts them.
Prerequisites: Amazon CloudFront、Encryption、Public-key cryptography (asymmetric)
CloudWatch Internet Monitor
A service that visualizes the availability and performance of internet paths between AWS resources and end users, broken down by city and network provider. It draws on AWS's large-scale traffic observations to surface problems visible only from the end-user's vantage point, such as ISP-side outages.
Prerequisites: CIA triad、Amazon CloudWatch
Related: CloudWatch Network Monitor
Config configuration recorder
The core AWS Config capability that continuously detects configuration changes on tracked resources and records them as time-series Configuration Items. Without enabling the recorder, neither Config rule evaluation nor the resource timeline works, and it must be enabled per Region.
Prerequisites: AWS Config、IAM policy structure (Effect/Action/Resource/Condition)、AWS Config rules and remediation
Amazon EKS (Elastic Kubernetes Service)
Managed Kubernetes: AWS runs the control plane; workers run on EC2 or Fargate. Chosen when you want to keep existing Kubernetes assets/ecosystem (more complex than ECS).
Prerequisites: AWS Fargate
Cost Anomaly Detection
Uses machine learning to learn normal usage patterns and automatically detects/alerts on unexpected cost spikes—catching anomalies earlier than after-the-fact budget alerts.
Prerequisites: CloudWatch alarms (composite/anomaly)
Cost Optimization Hub
A Billing feature that consolidates cost-saving opportunities across the org (unused resources, right-sizing, Savings Plans/RI recommendations) ranked by estimated savings—aggregating recommendations from Compute Optimizer and Trusted Advisor.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、AWS Trusted Advisor、AWS Compute Optimizer
CloudWatch dashboard sharing
A feature that securely shares a CloudWatch dashboard with external parties who have no AWS account, or with non-logged-in users. There are three sharing methods: inviting up to 5 specific email addresses (each with their own Cognito-backed password), sharing a single dashboard as a public link with no authentication, and sharing all dashboards in the account via SSO/SAML integration. It lets you provide read-only access—like a status page—without granting IAM permissions.
Prerequisites: Amazon CloudWatch、Amazon Cognito、CloudWatch dashboards and Synthetics
CloudWatch metrics
The numeric time-series data CloudWatch handles, identified by namespace and dimensions and feeding alarms and dashboards; standard metrics (e.g., EC2) are collected automatically.
Prerequisites: Amazon CloudWatch
DynamoDB TTL (auto-expiry)
Sets an expiry-timestamp attribute on items so expired items are deleted automatically (without consuming write capacity). Auto-cleans transient data like sessions/logs to cut storage cost; deletions can also flow to DynamoDB Streams.
Prerequisites: Amazon DynamoDB、DynamoDB design features (GSI/DAX/Global Tables)
DDoS attack types (L3/L4 vs L7)
L3/L4 attacks saturate links/resources with volumetric packets (SYN flood, reflection/amplification)—absorbed by Shield/NLB/scrubbing. L7 attacks exhaust the app with legitimate-looking requests—mitigated by WAF rate-based rules and Shield Advanced. Layer defenses by tier.
Prerequisites: AWS Shield Advanced、WAF rules (managed/rate-based)、AWS Shield (Standard/Advanced)
Glue crawler
Scans data sources to infer schema and partitions, automatically registering/updating table definitions in the Glue Data Catalog.
Prerequisites: Glue Data Catalog
Related: AWS Glue
Amazon S3 Tables
Managed storage for tabular data in Apache Iceberg format on S3, efficiently queryable from analytics engines (Athena/EMR/Spark) with automatic compaction to optimize tables.
Prerequisites: Amazon S3、Amazon Athena、Compaction (small-file consolidation)
Delivery semantics (at-least-once/exactly-once)
Guarantee levels for message delivery: at-least-once = may duplicate (standard SQS—needs idempotent handling); exactly-once = no duplicates or loss (SQS FIFO); at-most-once = may drop but no duplicates. Designs tolerate duplicates via idempotency.
AWS CDK (Cloud Development Kit)
An IaC framework to author infrastructure in programming languages (TypeScript/Python, etc.) that synthesizes CloudFormation templates. Constructs (L1 = raw CFn, L2 = higher-level, L3 = patterns) enable modular reuse, and CDK Pipelines build self-mutating CI/CD.
Prerequisites: AWS CloudFormation
CodeDeploy deployment configurations
Clarifying CodeDeploy concepts. Deployment type = in-place or blue/green (EC2/on-prem). Deployment configuration = rules for traffic shift or healthy-host count: Lambda/ECS use Canary/Linear/AllAtOnce, while EC2 uses minimum healthy hosts (OneAtATime/HalfAtATime, etc.). Hooks and alarms enable automatic rollback.
Prerequisites: AWS Lambda
Related: CodeDeploy (deployment groups/agent)
Amazon ECR (Elastic Container Registry)
A registry that stores and versions container images. Image scanning (Basic/Enhanced = Amazon Inspector integration) detects vulnerabilities, lifecycle policies prune old images, and immutable tags prevent overwrites. It is the deployment source for ECS/EKS.
Prerequisites: Amazon Inspector
Systems Manager Incident Manager
A service that coordinates major-incident response. It manages response plans, escalation plans, on-call schedules (rotations), and contact channels; auto-triggers runbooks on occurrence, pages stakeholders, and supports post-incident analysis.
Prerequisites: Incident response and forensics、AWS Systems Manager (SSM)、SSM Automation (runbooks)
DynamoDB Accelerator (DAX)
An in-memory cache purpose-built for DynamoDB that speeds reads to microseconds and offloads read traffic, with minimal app code changes.
Prerequisites: Amazon DynamoDB
DynamoDB write control (conditional/transactions)
Conditional writes prevent conflicts and optimistic locking (version number) detects overwrites. Multi-item consistency uses transactions (TransactWriteItems), and reads use Query (by key) vs Scan (full).
Prerequisites: Amazon DynamoDB
Related: Optimistic locking
Lambda versions and aliases
Published versions are immutable, and an alias is a mutable pointer to a specific version. Weighted routing on an alias enables canary/linear traffic shifting.
Prerequisites: AWS Lambda、CodeDeploy deployment configurations、Route 53 routing policies
Direct Connect vs. VPN
Comparing on-prem connectivity. Site-to-Site VPN is cheap and instant over the internet but has variable bandwidth/latency; Direct Connect is a dedicated link—stable, low-latency, high-bandwidth—but slower and costlier to set up. Critical links pair DX with VPN as backup.
Prerequisites: AWS Direct Connect、AWS Site-to-Site VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
EBS snapshot sharing
A feature that shares an EBS snapshot with another AWS account. Sharing an encrypted snapshot requires not only the snapshot's own share setting but also granting the target account usage permission in the key policy of the customer-managed key (CMK) used to encrypt it.
Prerequisites: EBS snapshots、Encryption、KMS key policies and grants
Bootstrapping
Automatically running initial setup (installing packages, fetching config, starting services) the first time an instance boots; on EC2 done via the user-data script processed by cloud-init.
Related: User data
On-Demand Capacity Reservation
Reserves needed instance capacity in a specific AZ without a long-term commitment—ensuring critical or DR workloads can launch when needed; combinable with Savings Plans for discounts (capacity assurance + cost optimization).
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、DynamoDB capacity and TTL
ALB features (routing/sticky/target group)
ALB listener rules route by path (/api/*) or hostname to a target group. Sticky sessions pin a client to the same target (via cookie); X-Forwarded-For is the header that conveys the original client IP.
Eventual consistency
A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.
Prerequisites: CIA triad、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Strong consistency
File storage
Storage exposed as a shared file system that many clients can access concurrently (EFS, FSx), organizing files in a directory hierarchy.
Related: Block storage、Object storage
GuardDuty detector / threat lists
A detector enables GuardDuty per Region, analyzing CloudTrail, VPC flow logs, and DNS logs with ML and threat intelligence. You can add trusted IP lists (suppress false positives) and threat IP lists (custom block targets).
Prerequisites: AWS CloudTrail、Amazon GuardDuty
Health check types and thresholds
Designing health determination: shallow checks (process liveness) vs deep checks (real functionality including dependencies). Healthy/unhealthy thresholds (consecutive successes/failures) confirm state and reduce flapping; interval and timeout are tuned too. Used by ELB, Route 53, and Auto Scaling.
Prerequisites: Auto Scaling、Amazon Route 53
Infrastructure as Code (IaC)
Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.
Prerequisites: AWS CloudFormation
Wildcard permission
Using "*" in a policy's Action or Resource (e.g., s3:*), which grants broader operations or resources than intended. This is a classic least-privilege violation, and IAM Access Analyzer policy validation or Access Advisor is used to detect and fix the excess.
Prerequisites: Access Advisor (last-accessed info)、IAM policy structure (Effect/Action/Resource/Condition)、IAM Access Analyzer
IKE policy
The Internet Key Exchange settings that define how an IPsec tunnel exchanges keys—encryption algorithm, hash, Diffie–Hellman group, and SA lifetime—must match on both the on-prem device and the cloud-side VPN gateway.
Prerequisites: Encryption、Hashing、IPsec
Kinesis consumers (enhanced fan-out / KCL)
The read side of Kinesis Data Streams. Standard consumers share a shard’s throughput; enhanced fan-out gives each consumer a dedicated 2 MB/s for low latency; the KCL (Kinesis Client Library) handles checkpointing and load balancing.
Prerequisites: Kinesis Data Streams、Performance metrics (IOPS/throughput/bandwidth/latency)、Amazon SNS
KMS encryption context
Additional key/value pairs supplied at encryption; requiring the same context at decryption binds “decrypt only in the right context,” and it’s logged in CloudTrail for auditability. S3, Secrets Manager, etc. use it internally.
Prerequisites: AWS CloudTrail、Encryption、AWS Secrets Manager
Microservices
An architectural style splitting an application into small, independent services that can each be deployed, scaled, and failed in isolation—at the cost of more inter-service communication and operational complexity. Commonly built on containers or serverless compute plus an API gateway.
Prerequisites: Amazon API Gateway、Serverless (FaaS)
Related: Monolith
Multi-account strategy
Separating workloads, environments, and teams by account to delimit billing, security, and blast radius. Governed with Organizations + OUs + SCPs, and Control Tower vends standardized accounts (account vending). A landing zone is the foundation.
Prerequisites: AWS Organizations (consolidated billing)、Blast radius、AWS Control Tower
Multicast
A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.
Prerequisites: Broadcast、Transit Gateway、Unicast
Broadcast
A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.
Prerequisites: X-Ray sampling and subsegments
Default route (0.0.0.0/0)
The catch-all route in a route table for destinations that match no more-specific route. In public subnets it points to an IGW; in private subnets to a NAT gateway—deciding the egress path.
Prerequisites: Route table、Subnet、Public / private subnet
Network Firewall stateful rules
Inspects traffic at VPC subnet boundaries with stateless rules (fast allow/deny) and stateful rules (connection tracking, Suricata-compatible signatures for domain/protocol inspection)—used for egress domain filtering and IPS.
Prerequisites: Connection tracking、AWS Network Firewall、Subnet
Rate limiting
Capping the number of requests accepted per unit of time to protect downstream systems from overload and abuse (DoS, scraping, etc.). Commonly implemented as API-gateway throttling or a web-application-firewall rate-based rule.
Related: WAF rules (managed/rate-based)
Pessimistic locking
A concurrency-control technique that acquires a lock on the target before updating and makes other transactions wait while it's held. It's safer than optimistic locking when contention is frequent, but it reduces concurrency and risks deadlocks. Distributed locks spanning multiple nodes are typically implemented with DynamoDB or similar.
Prerequisites: Amazon DynamoDB、Optimistic locking
Related: Idempotency key pattern
Sensitive data protection (PII / masking)
Protecting sensitive data such as PII (personally identifiable information) and PHI: discover/classify with Macie, then protect via encryption, access control, and minimization. Masking/tokenization hides values, and handling varies by data classification; also prevent sensitive data leaking into logs.
Prerequisites: Encryption
Related: Amazon Macie
Route 53 Resolver endpoints
Hybrid DNS. An inbound endpoint lets on-premises resolve names inside AWS; an outbound endpoint plus Resolver rules forward specific domains from AWS to on-premises DNS—enabling mutual name resolution between VPCs and on-prem.
Prerequisites: Amazon Route 53、DNS / name resolution (record types)
Related: Route 53 Resolver
Option group
A collection of settings that enable engine-specific add-on features (e.g., Oracle Transparent Data Encryption, SQL Server Native Backup). Where a parameter group covers general engine settings, an option group is scoped to plugin-like engine extensions. It applies mainly to engines like Oracle and SQL Server; some engines, such as Aurora (MySQL/PostgreSQL-compatible), don't use the option group concept at all.
Prerequisites: Amazon Aurora、Encryption、DB parameter group
Blast radius
The scope of impact from a failure, mistake, or breach. Kept small via account separation, multiple Regions/AZs, least privilege, and cell-based partitioning. Limiting blast radius is fundamental to resilience and security.
Multi-Region Access Point
A feature providing one global endpoint to access S3 buckets distributed across multiple Regions. Built on AWS Global Accelerator, it automatically routes requests to the Region closest to the requester, used for failover and latency improvement.
Prerequisites: AWS Global Accelerator、Multi-Region (active-active / active-standby)、Performance metrics (IOPS/throughput/bandwidth/latency)
S3 Object Lambda
A feature that inserts a Lambda function between an S3 GET request and the underlying bucket to transform the response data on the fly. It enables use cases like PII masking, image resizing, or CSV-to-JSON conversion without changing application code or duplicating the data.
Prerequisites: AWS Lambda、JSON、Sensitive data protection (PII / masking)
S3 server access logging
Records detailed requests to a bucket (requester, operation, response) and stores them in another bucket—used for access analysis and security audits; CloudTrail data events complement it at the API level.
Prerequisites: AWS CloudTrail、CloudTrail event types (management/data/Insights)、CloudTrail advanced configuration
Caching layer design
Layered caching with CloudFront (edge), API caching, ElastiCache (in front of DBs), and DAX (in front of DynamoDB) to cut latency, backend load, and cost.
Prerequisites: Amazon CloudFront、Amazon DynamoDB、Performance metrics (IOPS/throughput/bandwidth/latency)
AWS Batch
A managed service to run and schedule batch computing jobs at scale, automatically provisioning the needed compute (EC2/Fargate/Spot).
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、AWS Fargate、Managed services (management boundary)
AWS DataSync
Transfers files and objects over the network—fast, incremental, and integrity-checked—across NFS/SMB/S3/EFS/FSx. Suited to online migration when bandwidth is adequate.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Multi-account network design
Aggregates many accounts/VPCs via a Transit Gateway or Cloud WAN hub, optimizing security and cost with a shared-services VPC, centralized egress, and centralized inspection (inspection VPC).
Prerequisites: AWS Cloud WAN、Transit Gateway appliance mode and centralized inspection、Transit Gateway
Service Control Policy (SCP)
An organization-wide guardrail applied to accounts or OUs in AWS Organizations. It sets a permission ceiling so member-account IAM cannot exceed it (a maximum permission boundary).
Prerequisites: AWS Organizations (consolidated billing)
Amazon SES (Simple Email Service)
A scalable email sending/receiving service for transactional and marketing email with high deliverability and bounce/complaint handling.
Prerequisites: SES deliverability (bounces/configuration sets)
Savings Plans types
Purchase options giving discounts for a 1- or 3-year usage commitment. Compute Savings Plans are most flexible (EC2/Fargate/Lambda, across Regions/families); EC2 Instance Savings Plans lock to a family/Region for deeper discounts. More flexible than RIs.
Prerequisites: AWS Lambda、Pricing models (On-Demand / Savings Plans·RI / Spot)、AWS Fargate
ABAC (attribute-based access control)
An access model that decides access dynamically by attributes like tags. Matching aws:PrincipalTag with aws:ResourceTag in conditions (e.g., allow if the same department tag) scales without adding roles. Contrasted with role-based RBAC.
AWS Audit Manager
A service that continuously collects and organizes audit evidence against regulatory frameworks (PCI DSS/HIPAA/SOC 2) to support audit reporting. Its role differs from configuration-compliance evaluation (Config) and finding aggregation (Security Hub).
Prerequisites: Compliance programs and AWS Artifact
Incident response and forensics
The AWS incident-response flow and evidence preservation: prepare (playbooks/IR roles/always-on logs) → contain (isolation SG/quarantine VPC, disable credentials) → preserve evidence (volatile memory → EBS snapshot, stop not terminate) → analyze in an isolated environment. Immediate termination loses evidence.
Prerequisites: EBS snapshots
IAM policy evaluation logic
The order for deciding access: an explicit Deny always denies (highest precedence); otherwise check for an explicit Allow; allow if Allowed and not Denied; with no Allow anywhere it is implicitly denied. Precedence: explicit deny > allow > implicit deny.
AWS Shield Advanced
Advanced protection against large DDoS attacks: always-on detection, response-team (DRT/SRT) support, cost protection, and WAF integration (Shield Standard is free basic protection).
Prerequisites: AWS Shield (Standard/Advanced)
SES deliverability (bounces/configuration sets)
Operations to keep email delivered: high bounce (undelivered) or complaint (spam-report) rates throttle sending. Configuration sets emit events (send/delivery/bounce/complaint) to SNS/CloudWatch for monitoring; DKIM/SPF/DMARC authenticate, and dedicated IPs/warm-up manage reputation.
Prerequisites: Cooldown and warmup、Amazon CloudWatch
CloudWatch alarms (composite/anomaly)
Alarms that notify/act when a metric crosses a threshold. Composite alarms combine conditions with AND/OR, and anomaly detection flags deviations from a dynamic baseline.
Prerequisites: Amazon CloudWatch
Dead-letter queue (DLQ)
A dedicated queue that captures messages which failed processing a set number of times, used for investigation and reprocessing and to keep poison messages from clogging the main queue; maxReceiveCount sets the redrive threshold.
Related: SQS redrive (reprocessing from DLQ)
FIFO (ordering / deduplication)
The FIFO variant of SQS/SNS: guarantees strict ordering per message group and removes duplicate sends within 5 minutes via a deduplication ID (or content-based dedup). Lower throughput than standard, but for workloads needing ordering and exactly-once.
Prerequisites: Delivery semantics (at-least-once/exactly-once)、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Message ordering
Session Manager (port forwarding/audit)
Key points of shell access without opening SSH/RDP or ports: port forwarding tunnels securely from local to e.g. RDS; all sessions are recorded to CloudTrail/S3/CloudWatch for audit. It replaces a bastion host.
Prerequisites: AWS CloudTrail、Amazon CloudWatch、Session Manager
Subnet reserved addresses
A rule where AWS reserves five addresses per VPC subnet—the first four (network address, VPC router, DNS, future use) and the last one (broadcast, unused in practice)—so they can't be assigned. A /24 subnet therefore has 251 usable addresses out of 256.
Prerequisites: Broadcast、Subnet
Related: VPC/subnet quotas
Vertical scaling (scale up)
Scaling by upgrading a single instance's specs (CPU, memory, etc.). It requires little application change and is simple, but is capped by instance-type limits, tends to be a single point of failure, and often requires downtime to apply. The counterpart choice to horizontal scaling.
Prerequisites: Horizontal scaling (scale out)、Single point of failure (SPOF)、Scalability
Secondary CIDR block
A capability that assigns an additional CIDR block to an existing VPC after creation, expanding the available IP address space. The new range must not overlap the primary CIDR, and it is a common remedy for IP address exhaustion when there is no room to add subnets.
Prerequisites: CIDR notation、Subnet
VPC sharing
A mechanism using AWS Resource Access Manager (RAM) to share one VPC's subnets across multiple accounts in an organization. Participant accounts can create resources in that subnet, centralizing network management with the owner account while still keeping account-level separation.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Resource Access Manager (RAM)、Subnet
WAF Bot Control
An AWS Managed Rules rule group that identifies and controls known good bots (e.g., search crawlers) and bad bots (e.g., scrapers, credential-stuffing tools). It is recommended to deploy first in count mode to assess impact before blocking.
Prerequisites: Glue crawler、WAF rules (managed/rate-based)
Related: WAF logging
Six pillars of Well-Architected
Axes for sound design: operational excellence (operations/automation), security, reliability (fault tolerance/recovery), performance efficiency, cost optimization, and sustainability (environmental impact). Reviewed via the Well-Architected Tool to surface risks.
Prerequisites: Fault tolerance
Related: AWS Well-Architected Framework
AWS Cloud WAN
A service to centrally manage a global network by policy. A core network with segments (isolated routing domains) unifies multiple Regions, accounts, and on-prem.
Prerequisites: X-Ray sampling and subsegments
Edge extensions (Local Zones / Outposts / Wavelength)
Extensions bringing AWS closer to users: Local Zones place compute/storage in metros, Outposts put AWS racks on-prem, and Wavelength sits inside 5G networks for ultra-low latency.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Centralized egress and egress-only IGW
Consolidates internet egress into one VPC, sharing NAT gateways via TGW to cut cost. For IPv6, an egress-only internet gateway allows outbound only.
Related: Internet gateway (IGW)
Network Access Analyzer
Statically analyzes configuration (without sending packets) to surface paths that can reach resources that should not be reachable, defined via a scope. Used to detect unintended network exposure (overly open paths). Reachability Analyzer determines reachability and the blocking point, while CloudWatch handles trend monitoring—distinct roles.
Prerequisites: Amazon CloudWatch、IAM Access Analyzer
Transit Gateway Connect
An attachment type connecting SD-WAN appliances or virtual routers to a Transit Gateway at high throughput via GRE tunnels + BGP.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、Transit Gateway
Instance refresh
Rolls an Auto Scaling group’s instances to a new launch template/AMI in batches, replacing them gradually while keeping a minimum healthy percentage—enabling immutable deployments.
Prerequisites: Auto Scaling、Launch template
Mixed instances policy
Combines multiple instance types and an On-Demand/Spot ratio within one Auto Scaling group—resilient to Spot interruptions while balancing capacity assurance and cost savings.
Prerequisites: Auto Scaling、Pricing models (On-Demand / Savings Plans·RI / Spot)
Athena (partitions/workgroups/CTAS)
Key Athena concepts for SQL over S3: partitioning + columnar formats (Parquet) cut scanned data (and cost); workgroups isolate queries with cost limits and separate billing; CTAS creates a table from results, and Federated Query spans other data sources.
Prerequisites: Amazon Athena、Partitioning (S3/data lake)
AWS CLI
The official tool for operating AWS services from the command line. It manages profiles/credentials and Region settings and is used to automate within shell scripts and CI/CD steps, calling APIs directly as `aws <service> <operation>` with JSON output you can post-process (e.g., with jq).
Prerequisites: JSON
AWS CloudShell
A pre-authenticated browser shell opened from the Management Console. AWS CLI, common runtimes, and persistent storage are preconfigured, letting you run ops commands and scripts quickly without storing keys locally.
Prerequisites: AWS CLI、AWS Management Console
Game day
An event where failures are deliberately injected so a team can rehearse real incident response. AWS Fault Injection Service (FIS) is used to safely automate chaos experiments—such as stopping instances or cutting network access—to validate the effectiveness of runbooks and alerts.
Prerequisites: AWS Fault Injection Simulator (FIS)、Incident response and forensics
AWS Health (events / organizational view)
Notifies of AWS-side events affecting your resources (maintenance, outages, scheduled changes, certificate expirations). Integrate via the Health API/EventBridge for automated response, and use the Organizational View to see all accounts centrally.
Prerequisites: Certificate revocation (CRL / OCSP)、AWS Health (Personal Health Dashboard)
AWS Health Dashboard
Shows AWS service health and events affecting your resources (AWS-side status; distinct from Trusted Advisor, which advises on your environment).
Prerequisites: AWS Trusted Advisor
Region (AWS)
A geographically separate area made of multiple Availability Zones (usually 3+); chosen by latency, compliance, cost, and service availability.
Prerequisites: Availability Zone (AZ)、Performance metrics (IOPS/throughput/bandwidth/latency)
AWS Resilience Hub
A service to assess and track application resilience. You define RTO/RPO targets; it analyzes the architecture to surface gaps against targets and single points of failure, then offers remediation recommendations and continuous assessment—used to validate DR/availability design.
Prerequisites: CIA triad、Single point of failure (SPOF)
Root user
The all-powerful account-creation user; protect with MFA, avoid daily use, and use IAM users/roles instead.
Prerequisites: AWS IAM
AWS STS
The Security Token Service that issues temporary credentials; it handles AssumeRole and federation requests and returns short-lived credentials, central to avoiding long-term key distribution.
Prerequisites: AssumeRole、Temporary credentials
CloudFormation intrinsic functions (Ref/GetAtt/Sub)
Functions that resolve values dynamically in templates: Ref (reference a parameter/resource), Fn::GetAtt (get a resource attribute—ARN, endpoint, etc.), Fn::Sub (interpolate variables into strings), plus Fn::Join/Fn::If, and more. They avoid hard-coding and improve portability.
Prerequisites: AWS CloudFormation、IAM policy structure (Effect/Action/Resource/Condition)
CloudFront automatic compression
A feature where CloudFront automatically compresses origin responses with Gzip or Brotli, cutting transfer size and speeding up rendering. It only applies when the origin returns an uncompressed response, the Content-Type is on the compressible (text-based) allowlist such as HTML/CSS/JS, and the object size is between 1,000 and 10,000,000 bytes; it's enabled per cache behavior. CloudFront picks the format (gzip or br) based on the viewer's Accept-Encoding header.
Prerequisites: Amazon CloudFront
Related: CloudFront geo restriction
Connection tracking
How a stateful firewall (e.g., a security group) remembers established connections in a state table and automatically allows their return traffic. Unlike stateless rules, it removes the need to separately open the ephemeral-port range for the return leg.
Prerequisites: Ephemeral port
CloudWatch cross-account observability (OAM)
Via the Observability Access Manager (OAM), aggregates metrics, logs, and traces from multiple source accounts into one monitoring account for centralized observation—simplifying operations in multi-account setups.
Prerequisites: Amazon CloudWatch、Three pillars of observability (metrics/logs/traces)
Custom metrics
Application-defined metrics sent to CloudWatch via the PutMetricData API, the CloudWatch agent, or the Embedded Metric Format (EMF) extracted from logs.
Prerequisites: CloudWatch agent
Related: Amazon CloudWatch
Log retention
A per-log-group setting in CloudWatch Logs controlling how long log events are kept before automatic deletion (1 day to 10 years, or never). The default is never-expire, so explicitly setting a retention period is a frequent practical and exam gotcha for cost control.
Prerequisites: CloudWatch Logs、Amazon CloudWatch
DynamoDB capacity behavior (hot partitions/adaptive capacity)
Skewed access to certain keys causes hot partitions and throttling. Adaptive capacity automatically absorbs skew, and burst capacity tolerates short spikes. The design basic is a high-cardinality partition key to spread load.
Prerequisites: Amazon DynamoDB、Throttling (capacity)
Amazon EMR
A managed big-data platform running Apache Spark/Hadoop/Hive/Presto on clusters. Fits very large custom distributed processing and migrating existing Hadoop/Spark assets (Glue is simpler for lightweight serverless ETL).
Prerequisites: AWS Glue、Serverless (FaaS)
Managed Service for Apache Flink
A real-time service that performs in-flight windowed aggregation/transformation on streams, used for low-latency continuous stream analytics.
Prerequisites: Managed services (management boundary)、Performance metrics (IOPS/throughput/bandwidth/latency)
Amazon MemoryDB
A Redis-compatible, durable in-memory database for ultra-low-latency workloads that also need persistence (ElastiCache is for caching only).
Prerequisites: Durability and availability (nines)、Performance metrics (IOPS/throughput/bandwidth/latency)
Partitioning (S3/data lake)
Splits data into folders by keys like date or region so queries skip irrelevant partitions (pruning), cutting scan and cost.
Redshift Serverless
Redshift without cluster management. It auto-scales by usage (RPUs), optimizing cost for intermittent or unpredictable analytics workloads.
Prerequisites: Amazon Redshift、Serverless (FaaS)
AWS AppConfig
A Systems Manager capability to safely deliver app configuration and feature flags, with validation, gradual rollout, and automatic rollback (tied to CloudWatch alarms) to reduce risk.
Prerequisites: Amazon CloudWatch、AWS Systems Manager (SSM)
Config aggregator and org compliance
Aggregates AWS Config data across multiple accounts/Regions into one place to centrally evaluate and visualize org-wide resource configuration and compliance.
Prerequisites: AWS Config、IAM policy structure (Effect/Action/Resource/Condition)
DR testing
The practice of verifying that a disaster recovery plan actually works, through backup-restore checks and failover drills that measure real RTO and RPO against targets, surfacing gaps between the plan and reality. Without regular exercise, a DR plan tends to become stale and unreliable.
Prerequisites: RPO (Recovery Point Objective)、RTO (Recovery Time Objective)
API Gateway types (REST/HTTP/WebSocket)
REST APIs are feature-rich (usage plans, API keys, request validation), HTTP APIs are low-latency/low-cost and simple, and WebSocket APIs support bidirectional real-time communication.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Amazon API Gateway
Envelope encryption and data keys
Encrypts data with a data key, then encrypts that data key with a KMS master key for storage. GenerateDataKey returns plaintext/ciphertext data keys; the plaintext is discarded after use.
Prerequisites: Encryption
Step Functions (Standard/Express, ASL)
Defines workflows in Amazon States Language (ASL). Standard suits long-running, exactly-once with full history; Express suits high-volume, short-duration event processing, differing in billing and semantics.
Prerequisites: Delivery semantics (at-least-once/exactly-once)、AWS Step Functions
Dedicated Host
An EC2 placement option that dedicates an entire physical server to one customer. Sockets, cores, and the host ID are visible, which matters when bringing your own socket/core-based software licenses (BYOL). It costs more than Dedicated Instances but lets you control instance placement on the same host.
Related: Dedicated Instance
EC2 Fleet
A feature that launches a set of instances meeting a target capacity in one request, spanning multiple instance types, purchase options (On-Demand/Reserved/Spot), and AZs. Unlike Spot Fleet, it can mix On-Demand and Spot in the same request. The request type is instant (synchronous, one-time), request (asynchronous, one-time), or maintain (keeps target capacity and auto-replenishes interruptions); the default is maintain.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、Spot Fleet
AWS Graviton (ARM instances)
AWS-designed ARM-based processors offering lower price and higher power efficiency than x86 at comparable performance (helping cost optimization and sustainability). Migrating supported workloads (much of Linux, containers, managed services) improves price-performance.
Prerequisites: Managed services (management boundary)、Six pillars of Well-Architected
Placement groups (cluster/spread/partition)
Strategies for physical placement. Cluster packs instances on the same rack for low latency/high throughput (HPC); spread separates them across hardware to avoid simultaneous failure (a few critical instances); partition isolates failures by group (distributed systems like HDFS).
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Spot Fleet
A mechanism that maintains a target capacity of Spot Instances (optionally mixed with On-Demand) across multiple instance types and AZs. An allocation strategy (e.g., capacity-optimized, lowest-price) auto-selects pools less likely to be interrupted, and automatically replaces capacity in another pool on interruption.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)
Elasticity
Automatically scaling capacity with load (autoscaling); scalability made automatic.
Prerequisites: Scalability
Cross-zone load balancing
Each node distributes evenly to targets in all AZs; when off, uneven target counts per AZ cause skew. ALB enables it by default (free); NLB disables it by default (enabling incurs inter-AZ data charges).
Prerequisites: Data transfer costs (intra/inter-Region, egress)
EventBridge cross-account integration
Forwards events from one account’s event bus to another’s, enabling cross-organization event-driven flows; a resource-based policy authorizes the source. Used for centralized auditing and aggregating security events.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)、Resource-based policy
EventBridge Scheduler
An EventBridge capability that runs cron, rate, or one-time schedules at scale with timezone support. It can manage millions of individual schedules and is positioned as the successor to scheduling via legacy CloudWatch Events rules.
Prerequisites: Amazon CloudWatch
Related: EventBridge Pipes
Free Tier alert
AWS Billing notifications that warn by email as Free Tier usage nears its limit. For accounts created on/after 2025-07-15 under the new credit-based Free Tier, alerts fire when 50%/25%/10% of credits remain and at 15/7/2 days left in the free period. Often paired with AWS Budgets as an early warning against unexpected charges.
Prerequisites: Free Tier、AWS Budgets
IAM group
A container that bundles multiple IAM users so policies can be attached in bulk. A group is not itself a principal and cannot assume a role—it only simplifies distributing permissions to users. Groups cannot be nested inside other groups.
IAM managed policy
A standalone policy object that can be attached to and reused across multiple IAM users, groups, and roles. It splits into AWS managed policies (created/updated by AWS—quick but coarse-grained) and customer managed policies (self-authored and versioned—recommended, and easier to make least-privilege).
Prerequisites: AWS IAM
Related: IAM inline policy
Password policy
Account-wide rules applied to IAM user passwords, enforcing minimum length, character-type requirements, expiration, and prevention of reusing prior passwords. Combined with periodic access-key rotation, it keeps credential hygiene in check.
Prerequisites: IAM user、S3 lifecycle (transition and expiration)
Service-linked role
A predefined IAM role dedicated to an AWS service so it can act on other resources on your behalf. Its permissions are predefined and protected from accidental breakage (e.g., used by Auto Scaling, ELB, Config). Unlike normal roles, it’s restricted from deletion/editing.
Prerequisites: Auto Scaling、AWS IAM
Lambda runtime config (memory/timeout//tmp)
Memory allocation (128 MB–10 GB; more memory also adds CPU proportionally—sometimes faster and cheaper), timeout (up to 15 minutes), and ephemeral /tmp (up to 10 GB). Tuning these drives performance and cost.
Prerequisites: AWS Lambda、Lambda configuration (layers, env vars, ephemeral storage)
Principle of least privilege
A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.
Prerequisites: AWS IAM、Blast radius
Monolith
An architectural style that bundles all of an application's functionality into one large codebase and deployment unit. Simple early on, but as it grows the deployment unit becomes coarse, often forcing a full redeploy for even a small change.
Related: Microservices
OpEx (operational expenditure)
Spending paid continuously as you consume it. Cloud pay-as-you-go billing follows this model, minimizing upfront investment and letting cost flex with demand. The CapEx-to-OpEx shift is commonly cited as a core financial benefit of moving to the cloud.
Prerequisites: CapEx (capital expenditure)、Consumption-based pricing
Public-key cryptography (asymmetric)
Encrypt with a public key and decrypt with a private key (or sign with the private key and verify with the public key). It solves key distribution and underpins TLS, SSH, code signing, and certificates; slower than symmetric, so data is encrypted with a symmetric key that is itself protected by the public key (envelope).
Prerequisites: Encryption
DB parameter group
A template that groups DB engine settings (max connections, timeouts, character set, etc.). Dynamic parameters apply immediately, but changing a static parameter requires an instance reboot to take effect—a common exam distinction.
Prerequisites: IAM policy structure (Effect/Action/Resource/Condition)
Read-write splitting
A database access pattern that always sends writes to the primary instance and routes reads to read replicas to spread load. The split happens at the app layer or via a proxy layer such as RDS Proxy. Because replicas use asynchronous replication, a read immediately after a write can miss the update (replication lag).
Prerequisites: Asynchronous replication、Amazon RDS Proxy
AWS Resource Explorer
A service to search and discover resources across Regions; by default it searches within a single account, and organization-wide search requires multi-account search setup. Find quickly by tag/type for inventory. Where Resource Groups is about grouping, this focuses on search.
Prerequisites: AWS Resource Groups、IAM policy structure (Effect/Action/Resource/Condition)
Reserved Instance types
Standard RIs give the deepest discount with limited changes; Convertible RIs allow changing family/OS, etc. (lower discount). Regional RIs are flexible across AZs, while Zonal RIs add a capacity reservation in a specific AZ. Payment: all/partial/no upfront.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、On-Demand Capacity Reservation
Root user protection
The root user (created with the account) has near-unlimited power, so it must be protected and not used daily: enable MFA, avoid/delete access keys, use a strong password, and reserve it for the few actions that require it (billing/closure). Monitor via Organizations.
Prerequisites: AWS Organizations (consolidated billing)、Root user
S3 Batch Operations
A managed job that performs operations (copy, tagging, ACL changes, Lambda invoke, restore) across billions of objects at once; targets are specified via an S3 Inventory or manifest.
Prerequisites: AWS Lambda
S3 replication features (RTC/batch/inventory)
Replication Time Control (RTC) guarantees replication within 15 minutes with an SLA; batch replication copies pre-existing objects after the fact; S3 Inventory periodically lists objects with encryption/replication status as input for audits and batch operations.
Prerequisites: Encryption
Related: S3 Batch Operations
S3 replication rules (CRR/SRR/bidirectional)
CRR = cross-Region (DR, geo-proximity); SRR = same-Region (log aggregation, account separation). Bidirectional replication supports multi-Region read/write. Scope by prefix/tag, and configure owner override and batch replication of existing objects.
Prerequisites: Multi-Region (active-active / active-standby)
EBS volume types (gp3/io2/st1/sc1)
Choose by workload: gp3 general-purpose SSD (IOPS/throughput set independently), io2/io2 Block Express for durable high-IOPS, st1 throughput-optimized HDD, and sc1 cold HDD.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
S3 performance features (Transfer Acceleration / S3 Select)
Transfer Acceleration speeds long-distance uploads via edge, and multipart upload parallelizes large objects. S3 Select (SQL to retrieve part of an object) is deprecated for new use; query S3 with Athena, etc. instead.
Prerequisites: Amazon Athena
Amazon Fraud Detector
A managed service that uses machine learning to detect online fraud (fake accounts, fraudulent transactions).
Prerequisites: GuardDuty detector / threat lists、Managed services (management boundary)
Schema Conversion Tool (SCT)
A tool that converts schema and stored procedures for heterogeneous DB migrations (e.g., Oracle → Aurora PostgreSQL), reporting what cannot be converted. Unnecessary for same-engine moves, where DMS alone suffices.
Prerequisites: Amazon Aurora
AWS Service Catalog
Publishes approved IT services (CloudFormation products) as portfolios so users self-service-deploy standardized configurations, balancing governance and speed with guardrails.
Prerequisites: AWS CloudFormation
Service Quotas
A service to centrally view and request increases to AWS service quotas (limits), used to manage scaling ceilings in large designs.
Strangler fig pattern
An incremental technique to safely modernize a monolith. Place an API Gateway or ALB facade, carve out features one at a time into new services and re-point routing, then retire the monolith last—avoiding the high risk of a big-bang rewrite.
Prerequisites: Amazon API Gateway、Monolith
SCP deny-list strategy
An SCP approach that keeps the default FullAWSAccess and only Denies the actions you want to forbid—flexible and the most common. SCPs are a permission ceiling and grant nothing (effective = SCP ∩ IAM).
GuardDuty findings and Security Hub
GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail via ML/threat intel to detect threats. Security Hub aggregates findings from multiple security services and assesses conformance to standards (CIS/PCI).
Prerequisites: AWS CloudTrail、Amazon GuardDuty
Amazon Data Lifecycle Manager (DLM)
A service that automates creation, retention, and deletion of EBS snapshots and EBS-backed AMIs via policies. It manages scheduled backups and retention, supporting compliance and data protection (lifecycle of encrypted snapshots).
Prerequisites: Encryption
Related: EBS snapshots
SNS message filtering
Sets a filter policy on a subscription so only messages matching message attributes reach each subscriber—routing from one topic by condition and reducing unneeded downstream processing.
AWS Health (Personal Health Dashboard)
Notifies events affecting your account (maintenance, issues, deprecations). Today this is the 'Your account health' view of the AWS Health Dashboard (formerly the Personal Health Dashboard); overall status is shown by 'Service health' (formerly the Service Health Dashboard).
Related: AWS Health Dashboard
Spot interruption notice
A notice issued about 2 minutes before AWS reclaims a Spot instance's capacity. It can be received via an EventBridge event or instance metadata (instance-action), giving a grace window to checkpoint state or hand off work safely before interruption.
Prerequisites: Pricing models (On-Demand / Savings Plans·RI / Spot)、Instance metadata (IMDSv2)
SQS long polling
An SQS receive mode that waits up to 20 seconds for a message before responding; it reduces empty receives, lowering request cost and noise, and is generally recommended. Set via WaitTimeSeconds.
Prerequisites: Polling vs. webhook (push/pull)
Related: SQS short polling
SQS short polling
The default SQS receive mode that responds immediately even when no message is available; fast to return but produces more empty receives, raising request count and cost.
Prerequisites: Polling vs. webhook (push/pull)
Related: SQS long polling
Toil
An SRE term for repetitive, manual operational work that could be automated. It creates no lasting value and, left unchecked, erodes engineers' capacity for other work. SRE practice sets a target share of operational time to spend automating toil away.
Related: Error rate
SSM Change Calendar
Defines open/closed windows for automation and patching on a calendar—blocking changes during peak or freeze periods (change freeze) and gating Automation/Run Command execution.
Prerequisites: Run Command
Patch compliance
A capability that, after Patch Manager runs a scan or install, aggregates each instance's adherence to the patch baseline's approval rules. It surfaces instances with missing patches and integrates with the Compliance dashboard or Config rules to identify remediation targets.
Prerequisites: AWS Config rules and remediation
Related: Patch Manager
Strong consistency
A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Eventual consistency
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
Prerequisites: CIDR notation、Subnet
ECMP (equal-cost multi-path)
A generic routing technique that spreads traffic evenly across multiple paths of equal cost/metric. It's a broadly used networking concept, not tied to any one vendor; a representative application is distributing traffic across multiple VPN tunnels attached to an AWS Transit Gateway. When a workload needs to exceed a single tunnel's bandwidth ceiling (about 1.25 Gbps), Transit Gateway lets you bundle multiple tunnels and use ECMP to raise aggregate throughput.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)、Transit Gateway
Unicast
The most common one-to-one communication mode, sending from a single source to a single destination. Ordinary client–server traffic and most API calls are designed around this mode.
Related: Anycast
PrivateLink endpoint service
Exposes your own service behind an NLB privately to other VPCs/accounts via PrivateLink; traffic stays inside AWS, enabling SaaS-style offerings without the internet or VPC peering.
Prerequisites: AWS PrivateLink、VPC peering
BGP path control (AWS)
Controls hybrid routing over Direct Connect/VPN via BGP attributes. AS-PATH prepending de-prioritizes a path, local preference sets outbound preference, and BGP communities control route advertisement scope.
Prerequisites: AWS Direct Connect
Route 53 DNSSEC
Signs DNS responses so tampering and cache poisoning are detected via validation. In Route 53 it is enabled via zone signing with a KMS key.
Prerequisites: Amazon Route 53
Direct Connect resiliency (BFD)
For production, use high/maximum resiliency models with multiple locations and devices. BFD (Bidirectional Forwarding Detection) speeds failure detection and shortens failover.
Prerequisites: AWS Direct Connect
Gateway Load Balancer (GWLB)
An L3 gateway for transparently inserting third-party virtual appliances (NGFW, IDS/IPS) into the traffic path. It encapsulates packets with GENEVE (port 6081) to the appliance fleet, and inserting a GWLB endpoint (GWLBe) into route tables routes a source VPC’s traffic to an inspection VPC.
Prerequisites: Route table
Route 53 hosted zones (public/private)
Containers holding a domain’s records. Public hosted zones serve the internet; private hosted zones serve within VPCs. You can build split-view DNS with both for the same name.
Prerequisites: Amazon Route 53
Traffic Mirroring
Copies actual packets passing through a source ENI and sends them to a monitoring ENI or NLB for deep inspection via IDS or packet capture. Whereas VPC Flow Logs are metadata only, Traffic Mirroring captures the payload (packet contents). Filters narrow the mirrored traffic, but mirrored bandwidth and cost apply.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Auto Scaling termination policies
Rules deciding which instances to terminate on scale-in: choose from OldestInstance, NewestInstance, OldestLaunchTemplate (formerly OldestLaunchConfiguration), AllocationStrategy, or Default (ClosestToNextInstanceHour matters little under per-second billing). Scale-in protection can exclude specific instances.
Prerequisites: Auto Scaling
Aurora endpoints (cluster/reader/custom)
Aurora connection targets: the cluster (writer) endpoint for writes (follows failover automatically); the reader endpoint to load-balance reads across replicas; and custom endpoints to group an arbitrary set of instances (e.g., for analytics). Use by purpose.
Prerequisites: Amazon Aurora
AWS App2Container (A2C)
A migration tool that analyzes existing Java/.NET applications and containerizes them—generating a Dockerfile, ECS/EKS deployment artifacts, and a CI/CD pipeline template. It automates modernizing (containerizing) legacy apps.
Prerequisites: Containerization
Data transfer costs (intra/inter-Region, egress)
An often-overlooked AWS cost. Egress to the internet is charged, ingress is free; within an AZ is free, while inter-AZ/inter-Region is billed. Traffic via NAT gateways or across AZs drives cost; VPC endpoints can cut NAT-bound transfer.
Free Tier
Ways to try AWS at no cost. New accounts since July 2025 get a credit-based plan (a fixed credit amount with a time limit) granted at sign-up; the traditional model has three forms—12-month free, always-free, and trials.
AWS License Manager
A service to centrally manage software licenses (BYOL—bring your own license). It defines licensing rules to prevent overage and tracks/reports usage based on dedicated hosts or core/socket counts—used for license compliance across an organization.
Prerequisites: Dedicated Host
AWS Marketplace
A catalog to find and procure third-party software (billed via your AWS invoice).
AWS SDKs and Tools
Official libraries for calling AWS APIs from each language (Python = boto3, JavaScript, Java, Go, etc.). They handle credential resolution, automatic retries (exponential backoff), pagination, and Region configuration under a common spec—the foundation for operating AWS from apps and Lambda.
Prerequisites: AWS Lambda
AWS Serverless Application Repository (SAR)
A repository to find, deploy, and publish prebuilt serverless applications defined with SAM. It lets you share reusable apps/components (functions, APIs, integrations) inside and outside an organization and deploy them in near one-click fashion.
Prerequisites: Serverless (FaaS)
Signature Version 4 (SigV4)
The standard way to sign AWS API requests with access keys: a signature computed from the request, timestamp, Region, and service detects tampering and prevents replay. SDKs/CLI handle it automatically; presigned URLs build on it.
Prerequisites: S3 developer features (presigned URLs, encryption)
AWS Well-Architected Framework
Best practices for cloud design, reviewed across six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability).
Related: Six pillars of Well-Architected
Billing alarm
A mechanism that sets a threshold on CloudWatch's EstimatedCharges metric to catch unexpected charges early. Because that metric is recorded only in us-east-1 (N. Virginia), the billing alarm itself must also be created in us-east-1.
Prerequisites: Amazon CloudWatch
CapEx (capital expenditure)
Spending to buy and own equipment or facilities up front—like building an on-prem data center—requiring a large initial outlay that is depreciated as an asset over years. It was the center of the traditional pre-cloud IT investment model.
CloudFormation validation (Hooks/Guard/Linter)
Tools for template quality and governance: cfn-lint (syntax/best-practice checks), CloudFormation Guard (cfn-guard) for policy-as-code compliance, and Hooks to enforce custom checks before provisioning—combined with drift detection to maintain control.
Prerequisites: AWS CloudFormation
CloudFormation template anatomy
Key sections of a template: Parameters (inputs), Mappings (env/Region lookup tables), Conditions (conditional creation), Resources (what’s created—required), and Outputs (exports to other stacks). Together they make reusable IaC that absorbs environment differences.
Prerequisites: AWS CloudFormation
CloudFront origin groups (origin failover)
Bundles a primary and secondary origin and fails over to the secondary on specified error responses—providing origin redundancy by pairing, e.g., S3 with a cross-Region S3 or ALB.
Prerequisites: Amazon CloudFront
Conformance pack
A mechanism that bundles multiple Config rules and remediation actions into one template for bulk deployment across an account or an entire organization. It is used to apply common baselines like PCI DSS or CIS benchmarks at once, avoiding configuring each rule individually.
Prerequisites: AWS Config rules and remediation
Economies of scale
The idea that AWS aggregates many customers’ demand to lower unit costs, passing savings back as price cuts. Alongside pay-as-you-go, no upfront investment, and easy global reach, it’s a core cloud value proposition.
Prerequisites: Consumption-based pricing
CloudWatch Contributor Insights
Ranks “top contributors” from logs by rule (e.g., IPs causing the most errors, slowest APIs, most-accessed items)—used to find load skew or anomalous sources.
Prerequisites: Amazon CloudWatch
Metric math
Combines multiple metrics with expressions to derive new time series—e.g., error rate (errors ÷ total), sums, or anomaly-detection bands—for use in alarms and dashboards.
Prerequisites: Error rate
Amazon Neptune
A fully managed graph database optimized for relationship queries (social graphs, recommendations, fraud detection, knowledge graphs), supporting Gremlin/openCypher/SPARQL.
Prerequisites: Managed services (management boundary)
Amazon AppFlow
A fully managed integration service that securely transfers data between SaaS apps (Salesforce, SAP, Zendesk, etc.) and AWS, configuring flows with no code.
Prerequisites: Managed services (management boundary)
Compaction (small-file consolidation)
Consolidates many small files into fewer large ones, reducing metadata load and scan overhead to improve read performance.
AWS DMS (Database Migration Service)
A service for database migration and continuous replication. CDC (change data capture) ingests only deltas and syncs without stopping the source DB. Pair with SCT (Schema Conversion Tool) when schema conversion is needed.
Prerequisites: Schema Conversion Tool (SCT)
Amazon DocumentDB
A managed MongoDB-compatible document database, fitting workloads with flexible JSON-like documents.
Prerequisites: JSON
Glue Data Quality (DQDL)
Validates and scores data quality on the catalog or in pipelines against rules expressed in DQDL (a rule definition language).
Related: AWS Glue
AWS Glue DataBrew
A no-code visual data-preparation tool. Apply 250+ transforms (cleansing, normalization) via GUI and reuse them as recipes.
Prerequisites: AWS Glue
AWS Glue Studio
A visual authoring environment to build, run, and monitor Glue ETL jobs as a node graph, with the option to edit the generated Spark code.
Prerequisites: AWS Glue
Job bookmarks
A Glue feature that remembers processed data position to incrementally process only new data on reruns, preventing duplicates.
Related: AWS Glue
Amazon Keyspaces
A managed Apache Cassandra-compatible wide-column database. Serverless, it fits workloads using Cassandra’s CQL.
Prerequisites: Serverless (FaaS)
Schema registry
Centrally manages stream/message schemas and enforces compatibility (backward/forward) to prevent breaking changes between producers and consumers. Glue Schema Registry is the typical one.
Prerequisites: AWS Glue
AWS Chatbot
A service that relays ops notifications and alarms to Slack or Microsoft Teams (now renamed 'Amazon Q Developer in chat applications'). It pushes SNS notifications and CloudWatch graphs into chat and can run approved commands from chat (ChatOps).
Prerequisites: Amazon CloudWatch
AWS CodeArtifact
An artifact repository centralizing dependency packages (npm/pip/Maven/NuGet, etc.). Public repositories can be set as upstreams to transparently proxy and cache them, unifying internal and public packages behind one endpoint.
Prerequisites: AWS Artifact
Cold standby / cross-Region DR
AWS’s standard DR has four tiers—backup & restore, pilot light, warm standby, and multi-site (active-active)—chosen by RTO/RPO vs cost. Cold standby is an informal term close to backup & restore (minimal standby). Cross-Region DR recovers in another Region via inter-Region copies of AMIs/snapshots/data plus IaC.
Prerequisites: DR strategies (four)
Lambda concurrency (provisioned/reserved)
Lambda concurrency controls. Provisioned concurrency keeps environments warm to reduce cold starts; reserved concurrency caps/guarantees a function’s concurrency. Increasing memory also raises CPU proportionally.
Prerequisites: AWS Lambda
Dedicated Instance
An EC2 instance placement that runs on hardware not shared with other AWS accounts' tenants. It is physically isolated but, unlike a Dedicated Host, gives no host-level visibility (socket/core IDs). Chosen when compliance requires physical isolation but licensing doesn't require host visibility.
Related: Dedicated Host
Enhanced networking (ENA / EFA)
High-throughput, low-latency networking. ENA (Elastic Network Adapter) reaches ~100 Gbps; EFA (Elastic Fabric Adapter) provides OS-bypass ultra-low latency for tightly coupled HPC/ML workloads.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Instance store
Temporary storage physically attached to the host: very fast but ephemeral—data is lost on stop/terminate. Suited for caches/scratch; use EBS when persistence is needed (a common SOA contrast).
Prerequisites: Lambda configuration (layers, env vars, ephemeral storage)
EFS modes (performance/throughput/storage class)
EFS configuration axes: performance mode (General Purpose for low latency / Max I/O for high parallelism); throughput mode (Bursting / Elastic—auto-scales to demand / Provisioned); storage classes Standard and Infrequent Access (IA), with lifecycle management to auto-tier and cut cost.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
SNI (multiple certificates)
Server Name Indication: a TLS-handshake extension where the client presents the target hostname, so an ALB (and NLB TLS listener) can serve different ACM certificates by hostname—offering HTTPS for many domains from one load balancer.
Prerequisites: HTTPS
Target group attributes / deregistration delay
Settings for a target group’s behavior. Deregistration delay (connection draining) waits for in-flight requests to finish before removing a target; you also tune stickiness duration, slow start, healthy/unhealthy thresholds, and health-check interval.
Prerequisites: Health check types and thresholds
Idempotent HTTP methods
A property of HTTP methods: GET/PUT/DELETE are idempotent (same result no matter how many times called); POST is non-idempotent (may create on each call). Important for retry design—idempotent operations can be safely resent; non-idempotent ones use an idempotency key to prevent duplicates.
Prerequisites: Retry design
Credential report
A CSV report listing, for every IAM user in the account, whether a password exists, MFA status, and each access key's creation and last-used date. It can be generated at most once every 4 hours and is the starting point for auditing and deactivating unused credentials.
Prerequisites: IAM user
Immutable infrastructure
An operating model that never modifies running servers—instead it rebuilds and replaces them from a new image (AMI/container). It eliminates configuration drift, and rollback is just reverting to the prior version; pairs well with blue/green and Auto Scaling.
Prerequisites: Auto Scaling
KMS key types and rotation
KMS key categories: AWS-managed keys (service-managed, auto annual rotation), customer-managed keys (you control policy/rotation/disable), and AWS-owned keys (invisible). Grants and key policies authorize use; automatic key rotation refreshes key material.
Prerequisites: KMS key policies and grants
MFA device types
Second factors for MFA: virtual MFA (authenticator TOTP), hardware MFA (physical token), and FIDO security keys (passkeys, strong phishing resistance). Required for root and privileged users; enforce critical actions with the aws:MultiFactorAuthPresent condition.
Prerequisites: IAM condition keys
Private IP ranges (RFC 1918)
Private address blocks not routed on the internet: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. VPC CIDRs are typically chosen from these; when connecting multiple VPCs, avoid overlapping ranges (overlap breaks peering/TGW reachability).
Prerequisites: CIDR notation
AI services opt-out policy
An AWS Organizations-level policy that stops Amazon from using customer data to improve AI/ML services, applied across the whole organization at once. It is a type of Organizations policy that avoids configuring each account individually and helps meet data governance requirements.
Prerequisites: AWS Organizations (consolidated billing)
Delegated administrator
A mechanism that delegates organization-wide administrative rights for supporting services (GuardDuty, Config, Security Hub, etc.) to a member account other than the management account. It minimizes use of the management account and lets a security operations team hold separated duties; it must be configured per service.
Prerequisites: Amazon GuardDuty
Circuit breaker
A pattern that temporarily “opens” (cuts off) a repeatedly failing dependency to stop wasteful retries and cascading failure; after a cooldown it half-opens to test, then closes on recovery. Combined with timeouts, retries, and backoff.
Prerequisites: Cooldown and warmup
RDS Performance Insights
A performance-monitoring feature that visualizes DB load by wait events and top SQL to pinpoint bottlenecks, tracking DB load (average active sessions) on a dashboard; complements CloudWatch metrics.
Prerequisites: Amazon CloudWatch
Redshift performance (RA3/WLM/dist keys)
RA3 separates compute and storage (managed storage); concurrency scaling temporarily adds clusters for concurrency peaks; workload management (WLM) controls priority/memory via queues; distribution keys (DISTKEY) and sort keys (SORTKEY) optimize joins and scans.
Prerequisites: Amazon Redshift
Retry design
A design that retries after a transient failure using exponential backoff with jitter. A naive immediate retry can cause a retry storm—many clients retrying in sync and worsening the outage—so random jitter spreads retries out over time. It is safe to use only for idempotent operations.
S3 Access Points
Creates multiple named entry points to a single bucket—one per app/team—each with its own access policy, splitting up large, complex bucket policies for easier management.
Prerequisites: S3 access control (bucket policy/ACL/ownership)
S3 Event Notifications
Sends object create/delete events to SNS, SQS, Lambda, or EventBridge to trigger processing automatically—used for upload-driven thumbnailing or ingestion pipelines.
Prerequisites: AWS Lambda
S3 lifecycle (transition and expiration)
Rules that auto-manage objects by age. Transition moves to cheaper storage classes (e.g., Standard-IA at 30 days, Glacier at 90); expiration auto-deletes old objects, noncurrent versions, and incomplete multipart uploads to control cost.
S3 Object Lock
Protects objects as WORM (write-once-read-many), blocking delete/overwrite during retention. Modes: governance (privileged override), compliance (no one can remove), plus legal hold (indefinite). Used for regulatory compliance and tamper-proofing.
Migration strategies (the 7 Rs)
A taxonomy of migration approaches chosen per workload: rehost (no change), replatform (minor optimization), refactor (rebuild), repurchase (go SaaS), retire (decommission), retain (keep), relocate (move as-is). Choose by the effort-vs-value trade-off.
AWS Data Exchange
A data marketplace to find and subscribe to third-party data products and receive/use them securely on AWS, ingesting external datasets into your analytics.
Prerequisites: AWS Marketplace
AWS Management Console
The web console for operating and monitoring AWS resources via a GUI—one of the primary interfaces alongside CLI/SDK/IaC.
Application Migration Service (MGN)
The workhorse for rehosting on-prem or other-cloud servers to EC2 via agent-based, block-level continuous replication. Validate with test launches and minimize downtime at cutover.
Prerequisites: Migration strategies (the 7 Rs)
AWS Snow Family
Transports large data offline to AWS on encrypted physical devices (Snowball Edge) when networks are too slow/constrained or deadlines too tight. (The petabyte-scale Snowmobile truck has been retired.)
Prerequisites: Encryption
AWS Transfer Family
A managed service for ongoing file exchange with external partners over SFTP/FTPS/FTP against S3/EFS, moving the backend to the cloud while preserving existing transfer protocols.
Prerequisites: Managed services (management boundary)
SCP allow-list strategy
An SCP approach that removes the default FullAWSAccess and explicitly enumerates only allowed actions—strict, but heavier to manage since a missing allow can block legitimate actions.
Prerequisites: SCP deny-list strategy
Permissions boundary
A policy that sets the maximum permissions an IAM user/role can have. It does not grant; it limits effective permission to "identity policy ∩ boundary." Used to prevent over-permissioning when delegating administration.
Prerequisites: IAM user
AWS User Notifications
A service to centrally configure and aggregate AWS notifications from multiple sources (CloudWatch alarms, Health, Security Hub findings, etc.) and deliver them to the console, email, and more—improving visibility and reach of security events.
Prerequisites: Amazon CloudWatch
AWS Verified Access
A Zero Trust service that grants secure access to corporate applications without a VPN. It evaluates trust signals (policies) from the identity provider and device on each request, verifying every access.
Prerequisites: Zero Trust
Amazon Verified Permissions
A managed service that externalizes application authorization (who can do what). Define fine-grained access control with the Cedar policy language, decoupled from app code for centralized management and auditing.
Prerequisites: Managed services (management boundary)
Step Functions states (Map/Parallel/Choice)
Building blocks of a state machine: Task (work), Choice (branch), Parallel (concurrent branches), Map (iterate over array items; Distributed Map for large-scale parallelism), plus Wait/Pass/Succeed/Fail. Callbacks (.waitForTaskToken) wait for external completion.
Prerequisites: AWS Step Functions
S3 versioning and replication
Versioning enables recovery from overwrites/deletes, cross-/same-Region replication auto-copies to another location, and MFA Delete protects deletions.
Prerequisites: S3 replication rules (CRR/SRR/bidirectional)
SQS redrive (reprocessing from DLQ)
Moves failed messages parked in a dead-letter queue back to the source queue for reprocessing after fixing the cause (DLQ redrive). Messages exceeding maxReceiveCount move to the DLQ; used to isolate and recover from poison messages.
Related: Dead-letter queue (DLQ)
Zero Trust
The principle of "never trust, always verify"; verify identity, device, and context on every access, even inside.