Principal → entiti yang hantar request (User, Role, atau AWS service). Hanya Principal boleh "buat" sesuatu

User → identiti KEKAL untuk 1 orang/app. Ada credentials sendiri (password + access keys long-term)

Group → bakul untuk kumpul Users. BUKAN identity — tak boleh login, tak boleh jadi Principal. Attach policy kat sini (best practice)

Identity source → dari mana user datang: built-in directory, AWS Managed Microsoft AD, atau external IdP (Okta, Entra ID/Azure AD) via SAML 2.0.

Permission Set → koleksi IAM policies (macam "role template") yang define apa user boleh buat. Contoh: AdministratorAccess, ReadOnly, atau custom. Permission set ni dirender jadi IAM role dalam tiap assigned account.

Account assignment → map (User/Group) × (Permission Set) × (AWS Account). Ni yang tentukan siapa boleh masuk account mana dengan kebenaran apa.

External Access findings → resource (S3/role/KMS/SQS/Lambda/Secrets) yang boleh diakses dari LUAR zone of trust (public / account lain / Org lain). FREE.

Unused Access findings → IAM role/user, access key, atau permission yang tak digunakan dalam tempoh tertentu — untuk right-size ke least privilege. BAYAR per resource.

Policy validation → semak policy lawan IAM best practice + grammar semasa kau tulis (>100 checks).

Resource share → bekas yang kau letak resource + senarai principal (account/OU/Org) yang dibenarkan.

Owner account → yang MEMILIKI & urus resource; kekal kawal penuh.

Consumer/participant account → yang dikongsikan; boleh GUNA resource (cth launch EC2 dalam subnet kongsi) tapi tak boleh ubah/padam resource.

🟢 Pre-authorized (NO approval) → 8 service: EC2, RDS, Aurora, CloudFront, API Gateway, Lambda (+ Lambda@Edge), Lightsail, Elastic Beanstalk. Terus test resource sendiri.

🔴 Prohibited (haram, walau resource sendiri) → DoS/DDoS simulation, port flooding, protocol flooding, request flooding, DNS zone walking via Route 53.

🟡 Needs separate program → DDoS / network stress / simulated event testing: kena engage AWS DDoS Simulation Testing program / dapat kebenaran khas dulu.

ACM Public Certificate → cert percuma untuk public-facing HTTPS (browser-trusted). Auto-renew selagi DNS validation. Tak boleh export.

ACM Private CA (Private Certificate Authority) → private PKI untuk internal resources/IoT devices — TAK browser-trusted. Berbayar ($400/bln per CA). Boleh export private certs.

Imported Certificate → cert kau beli dari pihak ketiga (DigiCert dll), import masuk ACM untuk guna kat ALB/CloudFront. ACM TAK auto-renew imported cert — kau jaga renewal sendiri.

VPC CIDR → IP range keseluruhan (172.16.0.0/16 = 65,536 IPs)

Public Subnet → Ada route ke IGW. EC2 boleh dapat public IP

Private Subnet → Tiada route terus ke internet. DB, app servers letak sini

/16 → 65,536 total → 65,531 usable (guna untuk VPC range)

/24 → 256 total → 251 usable (subnet standard)

/25 → 128 total → 123 usable

Private IP → Auto-assign dari CIDR subnet masa launch (wajib ada minimum satu). Internal VPC sahaja. Kekal melekat selagi EC2 wujud; hanya lepas bila Terminate. Stop/Start TAK ubah private IP.

Public IP → Optional, auto-assign dari pool awam AWS bila EC2 dalam public subnet (setting "auto-assign public IP"). BERUBAH setiap Stop/Start (lepas balik ke pool, dapat baru bila start). Tak boleh dialih manual. IPv4.

Elastic IP → Allocate ke akaun kau, kekal milik kau sampai release. Associate ke instance/ENI. Static — tak berubah walau Stop/Start. Boleh disassociate & re-associate ke EC2 lain (failover). Property of ENI. Limit 5/region. IPv4 sahaja.

Local → traffic dalam VPC sendiri (auto, tak boleh delete)

0.0.0.0/0 → igw-xxx (public subnet — keluar ke internet)

0.0.0.0/0 → nat-xxx (private subnet — outbound je)

Region → kawasan geografi (cth ap-southeast-1). Servis & harga berbeza ikut Region. Pilih ikut latency, kos, compliance/data residency, ketersediaan servis

Availability Zone (AZ) → 1+ datacenter fizikal berasingan dalam Region (kuasa/penyejuk/rangkaian sendiri). Berkilometer jauh tapi link <2ms. Min 3 AZ per Region biasanya

AZ ID (cth use1-az1) → ID fizikal tetap; nama AZ (us-east-1a) di-map rawak per account supaya beban seimbang. Guna AZ ID bila nak padan AZ across account (RAM/shared VPC)

Backup Plan → "resepi": schedule (frequency) + retention + lifecycle (transition ke cold storage) + cross-region / cross-account copy

Resource assignment → pilih resource ikut TAG atau resource ID (auto-cover resource baru yang match tag)

Backup Vault → bekas tempat recovery point disimpan, encrypt dengan KMS

Versioning → setiap PUT jadi version baru (version ID unik); delete = letak delete marker (object "hilang" tapi versi lama kekal, boleh undo). Kena enable per bucket; sekali ON cuma boleh suspend, tak boleh OFF

Delete marker → penanda "latest = deleted"; buang delete marker = object muncul balik

MFA Delete → wajib kod MFA untuk delete version / suspend versioning (lindung dari delete malicious)

Standard tier → snapshot biasa, INCREMENTAL (block berubah je disimpan), disimpan dalam S3 managed. $0.05/GB-mo

Archive tier (Snapshot Archive) → untuk snapshot rarely-accessed simpan 90+ hari. Convert incremental → FULL snapshot, sampai 75% lebih murah. Restore ambil 24-72 jam

Fast Snapshot Restore (FSR) → volume yang dibuat dari snapshot terus fully-initialized, takde first-access latency. Enable per snapshot + per AZ, max 5/Region, snapshot ≤16 TiB. Mahal (DSU-hours)

FSx for Windows File Server → SMB / NTFS + Active Directory, DFS namespaces, VSS shadow copies. Single-AZ atau Multi-AZ. Untuk Windows apps & file share

FSx for Lustre → POSIX, throughput ratus GB/s + jutaan IOPS, sub-ms latency. Native S3 integration (DRA). Dua deployment: Scratch (sementara, no replication, murah) vs Persistent (durable, replicated dalam AZ). Untuk HPC / ML / media

FSx for NetApp ONTAP → MULTI-PROTOCOL (NFS + SMB + iSCSI serentak), feature ONTAP penuh: snapshot, SnapMirror, dedup, compression, auto data tiering ke capacity pool murah. Untuk migrate NetApp enterprise

S3 File Gateway → mount NFS/SMB on-prem, file disimpan sebagai object dalam S3 (boleh lifecycle ke Glacier). Local cache untuk akses laju

FSx File Gateway → mount SMB on-prem dengan Active Directory, backend Amazon FSx for Windows File Server. Untuk Windows file share low-latency

Volume Gateway → expose iSCSI block volume ke server on-prem. Backup point-in-time = EBS snapshot dalam S3. Dua mode: Cached vs Stored

Outposts hardware → rack 42U atau server 1U/2U yang AWS hantar & pasang dalam data center kau (AWS yang maintain).

Supported services on Outposts → EC2, EBS, S3 on Outposts, ECS, EKS, RDS, EMR, ElastiCache — run LOCAL, data kekal on-prem.

Service Link → sambungan (VPN over internet / Direct Connect) balik ke parent AWS Region untuk control plane (management, monitoring).

Function → unit code + config (memory, timeout, runtime, env vars, role). Ini benda yang kau deploy

Handler → entry point: method yang Lambda panggil tiap kali invoke (cth handler(event, context))

Execution Environment → micro-VM (Firecracker) yang isolate + run code. Init sekali (= COLD START), lepas tu di-reuse (WARM)

Application → bekas teratas (umbrella) untuk app kau — pegang banyak version + environment

Application Version → satu source bundle (.zip/.war) yang dilabel & disimpan dalam S3. Deploy = pilih version untuk satu environment

Environment → set resource AWS (EC2 + ALB + ASG + health monitoring) yang menjalankan SATU version. Satu app boleh ada banyak environment (dev/test/prod)

Cluster → pool logikal capacity (EC2 instances atau Fargate) tempat tasks jalan

Task Definition → blueprint JSON: image, vCPU, memory, ports, env vars, volumes + Task Role + Task Execution Role. BUKAN benda yang "run" — ia resepi sahaja

Task → satu running instance dari Task Definition (boleh ada 1+ container)

Control Plane (AWS managed) → API server (min 2 node, multi-AZ) + etcd (3 AZ) + scheduler. Kau tak sentuh langsung

Worker Nodes → EC2 yang run kubelet + container runtime. 3 jenis: Managed Node Groups, Self-Managed, Fargate (serverless per-pod)

Pod → unit terkecil K8s (1+ container). Dapat REAL VPC IP via AWS VPC CNI plugin

EKS Anywhere → Deploy K8s clusters on-prem using open-source tools, connected to AWS control plane for management consistency

EKS Distro → AWS K8s distribution used by EKS — run fully on-prem, NO AWS control plane dependency. Full open-source freedom

ECS Anywhere → Run ECS tasks on on-premises servers, managed by AWS ECS control plane

Ingress Resource → Kubernetes YAML yang define HTTP routing rules (path, host). Controller watch ni dan create ALB

ALB (auto-created) → Layer 7 load balancer dengan path/host rules. Controller create target groups + listener rules automatically

NLB (auto-created) → For Service type LoadBalancer. Controller create NLB untuk TCP/UDP traffic

meta-data/ → info instance: instance-id, local/public-ipv4, hostname, security-groups, placement/az

meta-data/iam/security-credentials/<role> → temporary IAM role credentials (auto-rotate) — ni yang SSRF nak curi

dynamic/instance-identity/document → JSON identity (region, accountId, instanceType) untuk verify identity

Job → satu unit kerja (container/script) yang kau submit

Job Definition → blueprint: image mana, vCPU, memory, IAM role

Job Queue → tempat job beratur ikut priority sebelum dijalankan

Registry → satu registry private per akaun AWS per region (auto-wujud)

Repository → "folder" untuk satu app/image (cth my-app), simpan banyak versi

Image tag → versi image (cth :latest, :v1.2) — tag boleh mutable atau immutable (immutable = elak orang timpa :v1

Disk fizikal pada HOST → tak boleh detach, tak boleh pindah ke instance lain

Ephemeral → data HILANG bila instance stop/terminate/fail

NVMe atau SSD/HDD → IOPS jauh melebihi EBS (jutaan)

ENI → Virtual network card (NIC). Boleh attach ke EC2 untuk network tambahan. Boleh ada IP private, public IP, security groups, MAC address. Boleh detach dari satu EC2 → attach ke EC2 lain (failover IP). Guna untuk: management network, NAT, bastion.

ENA → Elastic Network Adapter = driver/software untuk enable network performance tinggi pada instance yang support. Up to 100 Gbps. Dua versi: ENA (standard, sampai 25 Gbps) dan ENAv2 (sampai 100 Gbps).

EFA → Elastic Fabric Adapter = NIC special untuk HPC. Ada ENA capabilities + OS-bypass (libfabric API). Instance boleh communicate terus (bypass OS network stack) → latency rendah + throughput tinggi untuk message passing (MPI, CUDA). Hanya Linux.

Viewer Request → bila user hantar request ke CloudFront (sebelum cache check). Boleh inspect/modify request, redirect.

Viewer Response → sebelum CloudFront hantar response ke user. Boleh modify headers, inject content.

Origin Request → bila cache MISS, sebelum CloudFront hantar request ke origin. Boleh rewrite path, pilih origin.

Volume → "hard disk" maya, attach ke 1 EC2 (network-attached). Hidup dalam SATU AZ je

Snapshot → backup volume ke S3 (incremental). Boleh copy cross-region/cross-account untuk DR

DeleteOnTermination → flag: root volume default TRUE (hilang bila terminate), extra volume default FALSE (kekal)

gp3 → General Purpose SSD (default). Baseline 3,000 IOPS + 125 MB/s INCLUDED free; boleh provision IOPS & throughput BERASINGAN dari saiz (up to 16,000 IOPS / 1,000 MB/s — exam classic; docs terkini list ceiling lebih tinggi pada Nitro). Boot volume ✓

gp2 → Older General Purpose SSD. IOPS terikat saiz (3 IOPS/GB, burst 3,000). Less predictable; migrate ke gp3 (gp3 ~20% murah)

io2 / io2 Block Express → Provisioned IOPS SSD, paling power. 99.999% durability. io2 standard ~64,000 IOPS; io2 Block Express sampai 256,000 IOPS / 4,000 MB/s, sub-ms latency. Supports Multi-Attach

File System → "shared drive" NFS sebenar, auto-scale (bayar ikut guna). Span banyak AZ

Mount Target → 1 ENI per AZ (alamat EC2 mount). Setiap AZ kena ada satu; SG-nya MESTI allow inbound TCP 2049

Performance Mode (set masa create) → General Purpose (latency rendah, default) vs Max I/O (latency lebih tinggi, parallel besar)

Bucket → bekas top-level, nama GLOBAL unik (semua AWS), terikat pada 1 Region

Object → fail sebenar; identified by Key (full path nama, cth photos/2026/cat.jpg)

Key → "nama penuh" object dalam bucket (prefix + nama). Tiada folder sebenar — prefix je

IAM Policy → attach ke USER/ROLE (identity-based). "Apa user aku boleh buat" dalam akaun sama

Bucket Policy → attach ke BUCKET (resource-based JSON). Cross-account, public, force HTTPS/encryption

ACL → legacy, per-object/bucket, coarse. AWS galak DISABLE (Bucket owner enforced)

S3 Standard → Hot data, access frequent, default untuk most workloads (99.99% avail, ≥3 AZ)

S3 Standard-IA → Infrequent access (~sebulan sekali) TAPI masih perlu millisecond retrieval; multi-AZ (contoh: DR backup)

S3 One Zone-IA → Infrequent access, data dalam 1 AZ sahaja (20% lebih murah dari Standard-IA, risiko AZ musnah)

Transition rule → "bila object umur X hari, pindah ke class Y" (cth: 30 hari → Standard-IA)

Expiration rule → "bila object umur Z hari, delete permanently" (cth: 2555 hari → delete)

Filter → boleh scope rule ikut prefix (folder), tags, atau object size

CloudFront Signed URL/Cookie → access private content MELALUI CloudFront (edge-cached, global low latency, boleh restrict by IP range + expiry, guna trusted key group). Untuk serve at scale via CDN.

S3 Presigned URL → direct access ke SATU S3 object, signed dengan IAM credentials orang yang generate (inherit permission dia), takde CDN caching. Untuk one-off upload/download terus ke S3.

Listener → "telinga" ALB yang dengar request pada port + protocol tertentu (cth HTTP:80, HTTPS:443). Sini kau pasang ACM cert untuk SSL/TLS termination.

Rules → undang-undang saringan pada listener: "kalau path = /api/* → hantar ke Target Group Backend". Dinilai ikut priority; ada default rule sebagai fallback. Condition boleh path, host, header, query string, source IP.

Target Group → bakul server yang buat satu tugas. Health check jalan ke SETIAP target dalam bakul ni. Satu rule tunjuk ke satu target group.

Listener → dengar pada protokol Layer 4: TCP, UDP, TCP_UDP, atau TLS (+ QUIC). TIADA "Rules path/host" macam ALB — NLB tak baca HTTP. TLS listener boleh terminate SSL guna ACM cert (offload decrypt dari target).

Target Group → bakul target; protokol TCP/UDP/TCP_UDP/TLS/QUIC. Health check PER target group, boleh guna TCP, HTTP, atau HTTPS (boleh ketuk path /health walaupun NLB sendiri L4).

Targets → 3 jenis: instance (EC2 by ID), ip (peered VPC / on-prem via DX/VPN), atau ALB (NLB boleh daftar ALB sebagai target → dapat static IP + L7 path routing serentak). ASG daftar/drain automatik.

Listener → dengar SEMUA IP packet merentas SEMUA port (Layer 3). Tiada port/protocol spesifik macam ALB (HTTP:443) atau NLB (TCP:80) — GWLB telan semua. Satu listener, hantar ke satu target group.

Target Group → bakul virtual appliance (firewall / IDS / IPS / DPI). Target jenis instance (EC2 by ID) atau ip. Health check pastikan appliance hidup; appliance rosak dibuang dari rotation.

Targets → mesin pemeriksa sebenar (3rd-party security appliance). GWLB + appliance bertukar trafik guna GENEVE encapsulation port 6081 — paket asal dibalut, dihantar ke appliance untuk inspect, pastu dipulangkan.

Simple → 1 resource, no health check, no failover

Weighted → split traffic by % (A=70%, B=30%)

Latency-based → route to lowest latency AWS region

Visibility Timeout → Message invisible semasa diproses (max 12 jam). Jika consumer mati sebelum siap → message visible semula selepas timeout

Delay Seconds → Delay sebelum message pertama kali visible dalam queue (max 15 minit)

Dead Letter Queue (DLQ) → Message yang gagal diproses N kali dihantar ke DLQ untuk debug

Message Filtering → Subscriber boleh set filter policy (JSON) supaya hanya terima message yang match criteria — tak perlu filter dalam app code

Message Delivery → Push-based, SNS hantar ke subscriber endpoint. Retry policy built-in untuk HTTP/S

FIFO Topics → Ordered, deduplicated delivery (pair dengan SQS FIFO queues). Max 300 publishes/sec (3000 with batching)

REST API → full features: API keys + usage plans (per-client throttling), request validation, AWS WAF, resource policies, private endpoint, endpoint types edge-optimized/regional/private

HTTP API → minimal features, ~70% lebih murah, lower latency, JWT (OIDC/OAuth2) authorizer, regional sahaja — pilih bila tak perlu REST extras

WebSocket API → bidirectional real-time (chat, games, trading, live dashboard) — server push ke client

Engine → ActiveMQ atau RabbitMQ (pilih ikut protokol app sedia ada)

Protokol terbuka → AMQP, MQTT, STOMP, OpenWire, WebSocket, JMS — sebab itu app lama boleh sambung tanpa tukar code

Broker → instance yang AWS urus (patching, HA). Bukan serverless macam SQS

Configuration Recorder → enjin yang detect & rekod setiap perubahan config resource. Kena ON dulu, kalau OFF Config tak rekod apa-apa

Configuration Item (CI) → 1 snapshot point-in-time bagi SATU resource (state + relationship + metadata). Ini unit yang kau bayar $0.003 setiap satu

Configuration History → timeline semua CI bagi satu resource — boleh banding "semalam vs hari ni"

CodeCommit → Store & version control source code (Git)

CodeBuild → Compile, test, produce build artifacts

CodeDeploy → Deploy ke EC2, Lambda, ECS, on-premises

Cluster → satu primary instance (read+write) + sampai 15 replica (read-only) merentas AZ untuk HA.

Compute & storage BERPISAH → instance handle query, storage layer auto-grow 10GB → 64TB sendiri (kau tak provision disk).

Storage replicate 6 salinan / 3 AZ (sama macam Aurora) → durable + failover auto.

Data simpan sebagai nodes (benda) + edges (hubungan) + properties → bukan rows/columns. Query = "ikut benang hubungan", bukan JOIN table.

Cluster → 1 primary (write) + sampai 15 read replica merentas AZ; storage auto-grow ke 64TB, 6 copies / 3 AZ (macam Aurora).

Dua model query → Property Graph (guna Gremlin / openCypher) ATAU RDF (guna SPARQL). Pilih ikut data model app.

Keyspace → macam "database" dalam Cassandra; dalam dia ada tables (wide-column). Akses guna CQL (Cassandra Query Language) — sama macam Cassandra tulen.

Serverless penuh → takde node/cluster nak urus. AWS auto-scale throughput naik-turun ikut traffic.

Data replicate 3 salinan merentas AZ automatik → durable, HA.

Ingestion → terima writes laju (jutaan/saat), serverless, auto-scale. Setiap rekod = timestamp + dimensions + measures.

Memory store → data BARU duduk sini: laju untuk query terkini + write. Mahal/GB. Kau set tempoh simpan (cth 12 jam).

Magnetic store → data LAMA auto-turun sini: murah, untuk query sejarah. Kau set retention (cth 1 tahun).

In-memory data store → semua data dalam RAM → microsecond reads, single-digit ms writes. Valkey/Redis OSS commands.

Multi-AZ transactional log → INI yang bagi durability: setiap write ditulis ke log merentas berbilang AZ SEBELUM di-ack. Node mati → data tak hilang, failover pulih dari log.

Cluster + shards → data dipecah ikut shard (horizontal scale); tiap shard ada primary + replica untuk HA.

Leader Node → terima query, buat plan, agih ke compute node, kumpul hasil

Compute Nodes → simpan data + jalankan query selari (MPP)

RA3 + Managed Storage → compute & storage berasingan, bayar ikut guna; scale tanpa pindah data

Data sources → S3, Athena, Redshift, RDS/Aurora, sumber luar (databases, SaaS); QuickSight baca TERUS, tak payah ETL dulu

SPICE → Super-fast Parallel In-memory Calculation Engine; cache data import dalam memori untuk dashboard laju & repeatable. Alternatif: Direct Query (pukul sumber live)

Analysis → kanvas tempat kau bina visual (carta, jadual, peta)

Data Catalog → kedai metadata pusat (database, table, column, partition). Satu sumber kebenaran untuk Athena, EMR, Redshift Spectrum, Lake Formation

Crawler → connect ke sumber (S3/JDBC/DynamoDB), infer schema, ISI Data Catalog. Boleh jadual berkala

Classifier → kenal pasti format data (CSV/JSON/Parquet/custom grok); Crawler panggil Classifier untuk tentukan schema

Amazon Polly → Text-to-Speech (TTS): convert text jadi audio (natural voice)

Amazon Transcribe → Speech-to-Text (STT): convert audio/video jadi text

Amazon Lex → Conversational chatbot: NLU + ASR, maintains context, integrates Lambda (powers Alexa)

Notis interrupt 2 minit datang melalui DUA saluran: (1) EventBridge event "EC2 Spot Instance Interruption Warning" (detail-type), dan (2) instance metadata pada instance itu sendiri. Best practice: poll metadata setiap 5 saat. Ada juga Rebalance Recommendation — signal AWAL sebelum notis 2 minit, bagi peluang pindahkan beban lebih cepat. NOTA: kalau interruption behavior = hibernate, kau dapat notis tapi BUKAN 2 minit awal (hibernate mula serta-merta).

Cost Optimization → idle/underutilized resources, idle load balancers, unassociated Elastic IPs, RI/SP purchase opportunities

Performance → over-utilized instances, high-latency config, EBS throughput, service config yang melambatkan

Security → open security groups, public S3 buckets, MFA on root, IAM key exposure, exposed access keys

Lapisan 1 — Storage $/GB-mo → harga simpan tiap GB sebulan (Standard mahal → Deep Archive paling murah)

Lapisan 2 — Retrieval fee $/GB → bayar tiap kali tarik data balik (Standard & Intelligent-Tiering = $0; IA & Glacier kena caj, makin sejuk makin mahal tarik)

Lapisan 3 — Minimum storage duration → delete sebelum tempoh min still kena bayar baki (Standard none · IA 30d · Glacier 90d · Deep Archive 180d)

Frequent Access → tier default masuk. Sama harga macam S3 Standard ($0.023/GB)

Infrequent Access → auto turun lepas 30 hari TAK akses. Sama harga Standard-IA ($0.0125/GB)

Archive Instant Access → auto turun lepas 90 hari tak akses. Retrieval ms (instant). ~$0.004/GB

Backup & Restore — tiada infra DR. Bencana → provision semua + restore backup. RTO/RPO jam. Kos $.

Pilot Light — data replicate & LIVE (DB on). App server OFF. Bencana → hidupkan app + scale. RTO/RPO puluhan minit. Kos $$.

Warm Standby — full stack scaled-down SENTIASA ON. Bencana → scale up + failover DNS. RTO/RPO minit. Kos $$$.