Glossary

Portable Batch System — traditional on-premises HPC job scheduler software

Simple Linux Utility for Resource Management — popular HPC cluster job scheduler

IBM Load Sharing Facility — enterprise batch workload scheduler used on-premises

AWS Systems Manager — manage EC2 instances remotely without SSH; run commands, patch, configure

Amazon Athena — serverless SQL query service that reads data directly from S3, no database needed

Instance Metadata Service v2 — more secure way to query EC2 metadata; requires a session token before fetching data

Instance Metadata Service — endpoint at 169.254.169.254 that provides info about the running EC2 instance

Server-Side Request Forgery — attacker tricks a server app into making a request on its behalf, e.g. forcing an EC2 app to GET 169.254.169.254 and leak IAM credentials. [[IMDSv2]] (token + hop limit) is the fix; security groups CANNOT block link-local 169.254.169.254.

IMDSv2 metadata response TTL (network hops) — default = 1, so the response cannot travel beyond the instance itself (blocks a containerised/proxied request from reaching the metadata endpoint). Extra layer of [[SSRF]] defense.

CloudTrail integrity feature — computes a SHA-256 hash of every delivered log file and writes a signed digest file each hour, so you can prove logs were not modified or deleted after delivery (tamper-proof audit). A CloudTrail feature, NOT an S3 feature.

AWS Security Token Service — issues temporary credentials (access key + secret + session token)

Cross-Region Replication — automatically copies S3 objects to a bucket in another AWS region

Identity and Access Management — controls who (users, roles, services) can do what in AWS via policies

Amazon Machine Image — a snapshot template (OS + software) used to launch EC2 instances

Elastic Compute Cloud — virtual servers you rent in AWS; you choose the CPU, RAM, and OS

Elastic Load Balancing — NAMA KELUARGA/payung untuk SEMUA load balancer AWS, BUKAN satu produk. 4 jenis di bawahnya: [[ALB]] (Layer 7), [[NLB]] (Layer 4), [[GWLB]] (Layer 3), [[CLB]] (legacy). "EC2 behind ELB" = di belakang mana-mana jenis (am); "EC2 behind ALB" = spesifik ALB. Analogi: ELB = "kenderaan", ALB = "sedan" (sedan ialah jenis kenderaan). Exam: pilihan tulis "ELB" = konsep am; jawapan betul biasanya paksa pilih jenis spesifik (ALB/NLB).

Application Load Balancer — Layer 7 load balancer; routes HTTP/HTTPS by path, host header, or query string. Satu daripada 4 jenis [[ELB]].

AWS Content Delivery Network — caches content at 400+ edge locations worldwide to reduce latency for users

Content Delivery Network — a network of edge servers that cache and serve content close to users to cut latency

Relational Database Service — managed SQL databases (MySQL, PostgreSQL, etc.) with automated backups and patching

Single Sign-On — log in once to access multiple AWS accounts or applications without re-entering credentials

A group of EC2 instances managed together, typically mixing On-Demand and Spot types

A group of EC2 instances managed together to meet a target capacity or cost, often mixing On-Demand and Spot

Spare EC2 capacity at up to 90% discount — AWS can reclaim them with a 2-minute interruption notice

1- or 3-year commitment to a specific EC2 instance config. Standard RIs: up to 72% off On-Demand. Convertible RIs: up to 66% off (can change instance family/OS). All Upfront gives max discount.

Flexible commitment to a consistent usage amount ($/hr) for 1-3 years; applies across EC2, Lambda, Fargate

EC2 Spot Instances — spare AWS capacity at up to 90% discount; can be interrupted with 2-min notice

EC2 On-Demand — pay per second/hour with no commitment; always available, never interrupted

Reserve EC2 capacity in a specific AZ with NO 1-3 year term commitment — guarantees capacity is there when you need it, but you pay the On-Demand rate even while idle (no discount). Combine with a Savings Plan/RI to also get the discount. Differs from Zonal RI (which bundles capacity reservation + discount but needs a 1-3 yr commitment). Exam keyword: "guaranteed capacity without long-term commitment" → ODCR.

Protocols that encrypt data travelling over a network (in transit). SSL = lama, TLS = versi baru lebih kebal — orang industri tetap panggil "SSL" sebab dah biasa. Analogi: peti besi berkunci yang bungkus data SEBELUM posmen ([[TCP]]) bawa atas jalan awam — lori posmen kena rompak pun, perompak tak boleh buka. HTTP + TCP + TLS = [[HTTPS]] (port 443). Cert TLS = yang kau request kat [[ACM]] & attach kat ALB/CloudFront.

Transmission Control Protocol — cara hantar data yang CERMAT & sah sampai. Buat [[3-way handshake]] dulu (salam dengan server), pastikan semua packet sampai + tersusun; kalau ada hilang, minta hantar semula. Lambat sikit tapi reliable. Analogi: Pos Laju / surat berdaftar — kena sign bukti terima. Guna untuk: web (HTTP/HTTPS), email, SSH, download fail. AWS: ALB (Layer 7) & NLB (Layer 4) boleh handle TCP. Lawan: [[UDP]].

User Datagram Protocol — cara hantar data ULTRA-LAJU, tembak je tak kisah ada packet tercicir. Takde handshake, takde retransmit. Analogi: live streaming / radio — kalau tersekat 1 saat, dia sambung ke depan, tak ulang balik ayat tadi. Guna untuk: game online, video call/VoIP, DNS. AWS: NLB sokong UDP; Global Accelerator pun boleh. Lawan: [[TCP]] (reliable tapi lambat sikit).

HTTP + [[TCP]] + [[SSL/TLS]] = web SELAMAT (port 443). HTTP biasa (port 80) hantar plain text — hacker boleh intip password/nombor kad. HTTPS bungkus data dalam "peti besi" TLS sebelum hantar atas TCP. Cert TLS dari [[ACM]] di-attach kat ALB/CloudFront (TLS termination = ALB buka mangga TLS sebelum hantar ke EC2 belakang). INGAT: http:// port 80 = tak selamat; https:// port 443 = selamat.

HyperText Transfer Protocol — protokol web atas [[TCP]], port 80, hantar PLAIN TEXT (tak encrypted) → terdedah kepada intipan. Tambah [[SSL/TLS]] jadi [[HTTPS]] (port 443, selamat). Layer 7 (application). ALB & WAF beroperasi di Layer 7 ni.

Langkah [[TCP]] "salam" sebelum hantar data: SYN → SYN-ACK → ACK — pastikan dua-dua pihak bersedia & boleh komunikasi. [[UDP]] TAKDE handshake (sebab tu dia laju). Keyword exam: "SYN flood" DDoS serang langkah ni dengan banjir SYN tak siap — AWS Shield Standard (Layer 3/4) lindung percuma.

Routing only works directly — VPC Peering: if A peers B and B peers C, A still cannot reach C without its own peering

Routing through a middle point — if A connects to hub and B connects to hub, A can reach B indirectly

Central hub that connects multiple VPCs and on-premises networks with transitive routing (A↔hub↔B)

Transit Gateway — shortform. Central network hub connecting many VPCs + on-prem (VPN/Direct Connect) with transitive routing. Supports ECMP to combine multiple VPN tunnels for higher throughput (VGW cannot)

Virtual Private Gateway — the AWS-side endpoint of a Site-to-Site VPN, attached to ONE VPC. No transitive routing, no ECMP (~1.25 Gbps per tunnel cap). Need more throughput / many VPCs → use TGW instead

The on-premises (customer) side of a Site-to-Site VPN. TWO things: (1) the physical/virtual router or firewall in your office/data center (e.g. Cisco, Juniper, Fortinet), and (2) a config object IN AWS that describes it — holds the on-prem router PUBLIC IP + routing type (static, or dynamic via [[BGP]] ASN). Pairs with the AWS-side [[VGW]] (or a TGW) to form the encrypted IPSec tunnel. INGAT: VGW = AWS side, CGW = your side.

Customer Gateway — shortform. The on-prem end of a Site-to-Site VPN: your physical router/firewall + an AWS config object holding its public IP + routing (static or BGP). Pairs with [[VGW]] on the AWS side. Soalan exam: "what represents the on-premises VPN device?" → Customer Gateway, BUKAN Virtual Private Gateway

Equal-Cost Multi-Path — routing that spreads traffic across multiple equal-cost paths at once. On a TGW it lets you bond several VPN tunnels so bandwidth adds up (e.g. 4 tunnels ≈ 4× ~1.25 Gbps). VGW does NOT support ECMP

Direct private network link between two VPCs so they communicate as if on the same network; non-transitive

Private connection from your VPC to AWS services (e.g. S3) without going through the public internet

Virtual Private Cloud — your own isolated network in AWS where you launch and control resources

Allows resources in a public subnet to send and receive traffic to/from the internet

Internet Gateway — VPC component that allows public subnet resources to reach the internet

Network Address Translation Gateway — lets private subnet instances initiate outbound internet traffic without being publicly reachable

NAT Gateway variant with NO internet route (no IGW) — used for private-to-private routing between VPCs / on-prem with overlapping CIDRs. Common exam distractor: it does NOT give internet access — for outbound internet you need a Public NAT Gateway in a public subnet

IPv6 equivalent of a NAT Gateway — gives IPv6 instances outbound-only internet access while blocking inbound. IPv6 addresses are globally routable so no address translation is needed; you just need to stop inbound. Exam keyword: "IPv6" + "outbound only" → Egress-Only IGW (NOT NAT Gateway)

Egress-Only Internet Gateway — see that entry. IPv6 outbound-only gateway; the IPv6 counterpart of a NAT Gateway

Translation that lets an IPv6-only client reach an IPv4 destination. A NAT Gateway performs NAT64 (paired with DNS64 on the Route 53 Resolver) — this is the ONLY IPv6 role of a NAT GW; for plain IPv6-to-IPv6 outbound use an Egress-Only Internet Gateway

CloudWatch metric for NAT Gateway — counts times the NAT GW could not allocate a source port. Means you hit the 55,000-simultaneous-connections-per-unique-destination limit. Fix: add more IPs (up to 8) to the NAT GW or split resources across subnets/NAT GWs (NOT a bandwidth problem — bandwidth auto-scales)

Border Gateway Protocol — dynamic routing protocol that exchanges routes between networks; used in Direct Connect and VPN

Internet Protocol Security — encryption suite used to secure VPN tunnels over the public internet

Classless Inter-Domain Routing — defines an IP address range. /16 = 65 536 IPs, /24 = 256 IPs

Kumpulan 8 bits. IPv4 address ada 4 octets (4 × 8 = 32 bits). Nilai setiap octet = 0–255 kerana 2⁸ = 256 kemungkinan. Contoh: 192.168.100.10 → octet 1=192, octet 2=168, octet 3=100, octet 4=10

A subdivision of a VPC. Public subnet has a route to an Internet Gateway; private subnet has no direct internet access

Traffic flowing INTO your resource (e.g. an HTTP request arriving at your web server)

Traffic flowing OUT FROM your resource (e.g. your server connecting to a database)

Inspects the full content of network packets — not just headers — to detect malware, intrusions, or policy violations

Actively blocks detected attack patterns in network traffic in real-time before they reach the target

Allows or blocks traffic based on hostnames/domains (e.g. block *.malicious.com) rather than raw IP addresses

Advanced Encryption Standard 256-bit — industry-standard symmetric encryption algorithm

Secure Sockets Layer — older protocol for encrypting data in transit (now replaced by TLS)

Transport Layer Security — modern encryption protocol for data in transit; successor to SSL

Network Access Control List — subnet-level firewall; stateless, evaluates every packet, supports both allow and deny rules

Distributed Denial of Service — overwhelming a service with traffic from thousands of sources to make it unavailable

Attack where malicious SQL code is slipped into input fields to manipulate or dump a database

Cross-Site Scripting — attacker injects scripts into web pages to steal cookies or hijack user sessions

Web Application Firewall — filters HTTP/HTTPS requests at Layer 7 to block SQL injection, XSS, bots, and rate-limit abuse

DDoS Response Team — AWS experts available 24/7 to help Shield Advanced customers during active attacks

Application layer in the OSI model — understands HTTP, HTTPS, DNS. WAF and ALB operate here

Network layer in the OSI model — handles IP routing. Shield Standard protects here against volumetric floods

Transport layer in the OSI model — handles TCP/UDP ports. Shield protects SYN floods and UDP reflection attacks

Intelligent THREAT DETECTION — continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs with ML to flag anomalies (crypto-mining, compromised instances, recon). Log-based detection, agentless. NOT a vuln scanner (Inspector) or PII finder (Macie).

Automated VULNERABILITY SCANNING for EC2, ECR container images, and Lambda — checks against CVEs and network exposure. Software/CVE focus. NOT log-based threat detection (GuardDuty).

An [[Amazon Inspector]] scan type that maps which ports/paths on an EC2 instance are reachable from the internet, a VPC, or a peered network — surfaces unintended network exposure (e.g. an open admin port). Pairs with [[Host Vulnerability Scanning]] (the CVE/package side).

The [[Amazon Inspector]] scan type that finds CVEs in the OS and software packages on an EC2 instance, using the SSM Agent (or an agentless EBS-snapshot scan). Contrast [[Network Reachability]] = exposure of ports, this = vulnerabilities in installed software.

Uses ML to discover and classify SENSITIVE DATA (PII, credentials) in S3 buckets. Data-privacy focus, S3-specific. NOT threat detection (GuardDuty) or vuln scanning (Inspector).

Captures METADATA about IP traffic to/from network interfaces (srcaddr, dstaddr, ports, protocol, bytes, ACCEPT/REJECT) — NOT packet payload. Enable at VPC, subnet, or ENI level; send to CloudWatch Logs, S3, or Data Firehose. Use to troubleshoot SG/NACL (look for REJECT), security analysis, and as a source for GuardDuty/Detective. For actual packet content use Traffic Mirroring.

Managed DDoS protection. Shield Standard = free, automatic, Layer 3/4 (volumetric). Shield Advanced = paid, adds Layer 7 protection, DRT access, and cost-protection for scaling during an attack.

Authentication for web/mobile apps. User Pools = sign-up/sign-in directory (who you are, authN). Identity Pools = exchange that identity for temporary AWS credentials (what you can access, authZ). Supports social/SAML federation.

Managed Microsoft Active Directory in AWS. Managed Microsoft AD = full AD in cloud. AD Connector = proxy to on-prem AD (data stays on-prem). Simple AD = lightweight Samba-based, standalone.

AWS Certificate Manager — provision, manage, and auto-renew free public SSL/TLS certificates for ELB, CloudFront, and API Gateway. For CloudFront the cert MUST be in us-east-1. Cannot export public certs.

AWS Private Certificate Authority — a paid ($400/mo per CA) managed private CA for issuing internal/private certs (private PKI, IoT devices) that browsers do NOT trust. Unlike public [[ACM]] certs, private certs can be exported. Use for internal microservice mTLS, not public websites.

Resource Access Manager — securely SHARE resources across accounts without duplicating them (e.g. VPC subnets, Transit Gateway, Route 53 Resolver rules, License Manager configs). Often paired with Organizations.

Dedicated, single-tenant hardware security module — you have FULL control of keys (FIPS 140-2 Level 3). Use when compliance forbids shared/multi-tenant KMS. KMS is easier and multi-tenant; CloudHSM is for strict custody requirements.

Protect data while it MOVES across a network (browser→server, on-prem→AWS, service→service). Done with [[SSL/TLS]] (HTTPS, e.g. ACM cert on an ALB/CloudFront) or an IPSec tunnel (Site-to-Site VPN). Stops eavesdropping on the wire. INGAT: "in transit" = data sedang JALAN. BUKAN [[KMS]] (that is at rest). Exam keyword: "in flight", "over the network", "man-in-the-middle" → TLS/IPSec.

Protect data while it SITS stored on disk (S3 object, EBS volume, RDS data, DynamoDB table, snapshot). Done with [[KMS]] keys ([[SSE-KMS]]) or AES-256. Stops someone who steals the physical disk / raw storage. INGAT: "at rest" = data DUDUK diam dalam storage. BUKAN TLS (that is in transit). Exam keyword: "stored data", "on disk", "compliance encryption" → KMS/SSE.

AWS Key Management Service — create, store, and manage encryption keys; used for data at rest encryption

Server-Side Encryption with KMS — objects/data are encrypted at rest automatically using keys in AWS KMS

Customer Managed Key — a KMS key you create and control (rotation, policies, auditing), vs AWS-managed keys

Write Once Read Many — data can be written exactly once and never modified or deleted after

Data encrypted with a data key; the data key is encrypted by a KMS master key. Only the encrypted data key is stored alongside data

Satu kunci 256-bit yang SAMA untuk encrypt dan decrypt — tak pernah keluar KMS. Default KMS key type; AWS service SSE (S3/RDS/EBS) guna ni SAHAJA. Tak boleh buat digital signing (kunci sama = tak boleh asingkan sign dari verify). Lawan [[Asymmetric KMS key]]

Pasangan public + private key. Private dicipta & kekal dalam KMS (tak keluar); public boleh download/share. Guna untuk digital signing (private SIGN, public VERIFY) atau encryption oleh pihak luar yang tak boleh call KMS. TAK disokong untuk AWS service SSE. Pilih [[key usage]] masa create. Lawan [[Symmetric KMS key]]

Tetapan masa cipta [[Asymmetric KMS key]] — pilih SATU & TAK boleh tukar: "Sign and Verify" (digital signature) ATAU "Encrypt and Decrypt" (encryption guna public/private). Untuk digital signing → pilih "Sign and Verify"

Key usage untuk [[Asymmetric KMS key]] yang buat digital signature: private key sign (hanya pemilik), public key verify (sesiapa boleh sahkan tulen + tak diubah). Exam keyword "digital signing / only sender signs, others verify" → Asymmetric Sign and Verify

Transparent Data Encryption — encrypt data at rest pada peringkat DATABASE engine, TRANSPARENT (aplikasi tak perlu ubah kod). Dalam RDS, TDE disokong HANYA oleh Oracle & SQL Server (MySQL/MariaDB/PostgreSQL guna RDS encryption + [[KMS]] sebagai ganti). Hanya Oracle RDS boleh simpan TDE master key dalam [[CloudHSM]] (via PKCS#11); SQL Server RDS guna cert RDS-managed. Exam keyword "encrypt at rest + no application changes + single-tenant HSM" → Oracle RDS + TDE + CloudHSM

S3 Object Lock mode where NO user — not even root — can shorten or delete the retention period

S3 Object Lock mode where users with special IAM permissions can override retention, unlike Compliance mode

An S3 Object Lock flag that blocks deletion indefinitely with no fixed expiry — removed only when explicitly released

The fixed time window during which an S3 object cannot be deleted or overwritten (used with Object Lock)

Multi-Availability Zone — synchronous standby replica in a different AZ; automatic failover for high availability. Default ("DB Instance" mode) = 1 standby yang IDLE (tak serve reads), 2 AZ, failover ~60-120s

Mode Multi-AZ RDS yang lebih baru (2022, MySQL & PostgreSQL sahaja) — 1 writer + 2 readable standby merentas 3 AZ, semisynchronous replication. Beza dengan [[Multi-AZ]] DB Instance: reader BOLEH serve reads (HA + sikit read capacity), failover lebih laju (biasanya <35s), write latency lebih rendah. BUKAN [[Aurora Global Database]] / Aurora cluster (Aurora = shared storage 6-copy/3-AZ, sampai 15 reader)

Asynchronous read-only copy of a database — offloads read queries; can exist in a different region

One OR MORE data centres (NOT a single building) in one physically isolated location within a [[Region]] — own power, cooling, networking. Analogy: Region = bandar (e.g. Singapore), AZ = kawasan/lokasi berasingan dalam bandar tu. Each Region has 3+ AZs. 1 AZ = 1 risk point (banjir/api/power = AZ tu jatuh, AZ lain selamat); spread resources across ≥2 AZs = basic [[Multi-AZ]] high availability

A geographic area (e.g. ap-southeast-1 Singapore) containing multiple [[Availability Zone]]s. Pick by latency, cost, service availability, and [[Data Residency]]. Data stays in a Region unless you move it

A fixed physical identifier for an AZ (e.g. use1-az1). AZ names (us-east-1a) are mapped randomly per account, so use the AZ ID to match the same physical AZ across accounts (shared VPC / [[AWS RAM]])

A resource that lives in only ONE [[Availability Zone]] — cheaper, but does NOT survive an AZ failure (single point of failure). Examples: EFS One Zone, FSx Single-AZ deployment, instance store, a non-Multi-AZ RDS. Exam trade-off: pick Single-AZ to save cost for non-critical / reproducible data; pick [[Multi-AZ]] when the keyword is "high availability / survive AZ outage".

One of 600+ CloudFront points of presence ([[PoP]]) worldwide that cache content close to users. It is a CDN cache, NOT where you run your servers

An extension of a [[Region]] that places compute/storage near a large metro area for single-digit-millisecond latency (gaming, media, real-time)

AWS infrastructure embedded inside 5G telco networks for ultra-low-latency mobile edge applications

AWS hardware (a 42U rack, or a 1U/2U server) that AWS ships and installs in YOUR data center so you can run EC2, EBS, S3 on Outposts, RDS, ECS/EKS locally with the same AWS APIs. Data and compute stay on-prem; only the control plane links back to a [[parent Region]] via [[Service Link]]. Exam keyword: "data must stay on-premises / cannot migrate + run AWS services locally". Contrast [[Local Zone]] (AWS-owned metro infra, no hardware of yours) and [[Storage Gateway]] (storage bridge only).

The encrypted connection (VPN over internet, or [[Direct Connect]]) that links an [[Outposts]] back to its [[parent Region]] for the control plane (management, monitoring). If it drops, Outposts instances keep running locally but can't be managed from the console/API.

On an [[Outposts]] rack, the gateway that routes low-latency traffic between the Outposts and your on-premises network (supports customer-owned IP / CoIP). The on-prem equivalent of an internet/NAT gateway for the rack.

On an [[Outposts]] server (1U/2U), the network interface that connects the server directly to your on-prem LAN — the server form-factor counterpart to a rack's [[Local Gateway (LGW)]].

The AWS Region an [[Outposts]] is anchored to. The Outposts uses it for its control plane and to reach the Region's broader set of services; it is chosen when you order the Outposts.

Deploying across two or more [[Region]]s to survive an entire Region outage or meet [[Data Residency]] rules. Higher cost/complexity than [[Multi-AZ]]; replication is usually asynchronous

A compliance requirement that data must physically stay within a specific country/jurisdiction. Met by choosing the right [[Region]] (and optionally an [[SCP]] that blocks other Regions)

Recovery Point Objective — maximum acceptable data loss in time. RPO = 1 hour means you can afford to lose 1 hour of data

Recovery Time Objective — maximum acceptable downtime. RTO = 4 hours means systems must be back up within 4 hours

Elastic Block Store — persistent block storage (like a virtual hard drive) attached to one EC2 instance

Elastic File System — managed NFS file system that can be shared across multiple EC2 instances simultaneously

Network File System — protocol that lets a Linux machine MOUNT a remote file system and use it like a local folder (read/write/edit files in place). EFS speaks NFS. Contrast with [[S3 Standard]] object storage where you upload/download via API and cannot edit in place.

Portable Operating System Interface — the standard file semantics Linux apps expect: real files & folders, permissions (chmod/chown), byte-range locks, in-place edits. [[EFS]] is POSIX-compliant (mount & edit like a normal folder); S3 is NOT (object store, no in-place edit). Exam keyword "POSIX / shared file system / mount" → EFS, not S3.

The entry point an EC2 uses to reach an [[EFS]] file system — one Elastic Network Interface ([[ENI]]) per [[Availability Zone]], each with an IP and a [[Security Group]]. The mount target SG MUST allow inbound TCP 2049 (NFS) from the EC2, else the mount times out. Create one mount target per AZ you run instances in.

EFS performance mode with the LOWEST per-operation latency. Recommended for all workloads including web serving, CMS, and data sharing. AWS explicitly recommends General Purpose over Max I/O for all file systems.

Previous-generation EFS performance mode with HIGHER per-operation latency but higher aggregate throughput. For massively parallel HPC workloads with hundreds/thousands of concurrent connections. NOT recommended when low latency is required.

EFS throughput mode that scales with storage size: baseline 50 KiB/s per GiB stored. A 25 GB file system gets only ~1.25 MiB/s baseline — insufficient for high-throughput workloads. Burst credits allow temporary higher throughput.

EFS throughput mode where you specify the exact throughput (in MiB/s) regardless of file system size. Use when throughput requirements exceed what Bursting provides for your storage size.

Recommended EFS throughput mode that automatically scales throughput up and down based on workload. Pay per use. No need to provision or manage throughput limits.

amazon-efs-utils tool that simplifies EFS mounting. Supports -o tls flag to enable encryption in transit via TLS 1.2 + AES-256. Usage: sudo mount -t efs -o tls fs-xxxx /mnt/efs

Input/Output Operations Per Second — counts how MANY separate read/write operations per second (NOT data volume; that is [[Throughput]]). High IOPS matters for RANDOM access of small records → databases. IOPS-bound workloads → SSD ([[gp3]]/[[io2]]). Analogy: how many cars pass the toll per second.

General Purpose SSD (gen 3) — the default [[EBS]] volume type. INCLUDES a free baseline of 3,000 [[IOPS]] + 125 MB/s; IOPS & throughput are provisioned INDEPENDENTLY of size (unlike [[gp2]] where IOPS is tied to size). Exam-classic ceiling 16,000 IOPS / 1,000 MB/s (AWS docs now list higher Nitro ceilings). $0.08/GB-mo, ~20% cheaper than gp2. Not sure which EBS type? → gp3.

General Purpose SSD (gen 2) — older default [[EBS]] type. IOPS scale with size (3 IOPS/GB, burst to 3,000), less predictable than [[gp3]] under sustained load.

Provisioned IOPS SSD (gen 2) — mission-critical [[EBS]] type. 99.999% durability; the only type (with [[io1]]) that supports [[EBS Multi-Attach]]. io2 standard ~64,000 [[IOPS]]; [[io2 Block Express]] scales to 256,000 IOPS / 4,000 MB/s with sub-ms latency. $0.125/GB-mo + $0.065/provisioned-IOPS-mo (most expensive EBS). Exam: ">64,000 IOPS / SAP HANA / sub-ms" → io2 Block Express.

Highest-performance [[EBS]] tier — the next-gen [[io2]] architecture. Up to 256,000 [[IOPS]], 4,000 MB/s throughput, 99.999% durability, sub-millisecond average latency. For the most demanding databases (SAP HANA, Oracle, SQL Server). Exam keyword: "more than 64,000 IOPS" or "mission-critical sub-ms latency" → io2 Block Express (gp3/io1 cannot reach it).

Previous-generation (legacy) [[EBS]] volume type backed by magnetic platters. ~100 IOPS average (burst to hundreds), 1 GiB–1 TiB. AWS recommends current-gen types instead. Can be a boot volume. Exam trap: appears as a "cheapest" decoy, but the cheapest CURRENT-gen EBS is [[sc1]].

Provisioned IOPS SSD (gen 1) — older high-performance [[EBS]] type. Up to 64,000 IOPS; supports [[EBS Multi-Attach]] like [[io2]].

Throughput-Optimized HDD — low-cost [[EBS]] type for SEQUENTIAL workloads (log processing, ETL, big data). High throughput, NOT for random I/O. $0.045/GB-mo. Cannot Multi-Attach.

Cold HDD — the cheapest [[EBS]] type ($0.015/GB-mo) for infrequently-accessed sequential data. Lowest performance. Cannot Multi-Attach.

EBS feature that attaches a SINGLE block volume to up to 16 EC2 instances in the SAME [[Availability Zone]] simultaneously. Works ONLY on [[io1]]/[[io2]] (Provisioned IOPS SSD) — gp2/gp3/st1/sc1 cannot. Block-level [[ReadWriteOnce (RWO)]], requires a cluster-aware filesystem; it is NOT a shared file system (for that use [[EFS]]). Exam: "shared block across nodes, all EBS options" → io1/io2 Multi-Attach.

Ephemeral, physically attached storage on the EC2 host. Data is LOST on instance stop, terminate, or hardware failure. Can only be configured at launch time. Faster than EBS (local NVMe) but non-persistent.

Elastic Network Adapter — AWS network driver for high-throughput EC2 instances. Up to 25 Gbps (ENA) or 100 Gbps (ENAv2). Default on most modern instance types (c5, m5, r5…). Standard networking performance, not HPC.

Elastic Fabric Adapter — EC2 network card for HPC + ML distributed training. Combines ENA capabilities with OS-bypass (libfabric API) for lowest-latency inter-node communication via MPI. Linux only, HPC-optimized instance types only. Use with Placement Group Cluster.

EFA feature where applications access the network card directly, bypassing the OS network stack — eliminates kernel overhead for lowest latency. Used by HPC workloads running MPI (Message Passing Interface) or CUDA.

Dedicated Host feature that pins an EC2 instance to a specific physical host. Instance always launches on the same host even after stop/start. Used for BYOL licensing tied to physical hardware.

EC2 purchasing option where you get an entire physical server to yourself. You can see socket/core/ID for BYOL (bring-your-own-license) compliance. Billed per-host. Most expensive tenancy option.

EC2 instance running on single-tenant hardware (no other customers share the hardware) but you don't pick or see the physical server. +$2/hr region fee. Less control than Dedicated Host.

Bring Your Own License — use existing software licenses (Oracle, SQL Server, Windows) on AWS. Requires Dedicated Host to audit physical cores/sockets for license compliance.

Run Lambda functions at CloudFront edge locations (600+ globally) instead of in an AWS Region. Four trigger points: Viewer Request, Viewer Response, Origin Request, Origin Response. Deploy from us-east-1; supports Node.js/Python; can call AWS services.

Ultra-lightweight JavaScript executed at CloudFront edge viewer level. Sub-millisecond execution, max 2 MB memory, no network access. Used for simple header manipulation, URL rewrite, token check — cheaper than Lambda@Edge.

ELB feature that distributes traffic across targets in ALL AZs, not just the AZ receiving the request. ALB = always ON (free). NLB = OFF by default (enabling costs inter-AZ data transfer $0.02/GB). CLB = OFF by default (free to enable).

Load Balancer Capacity Unit — billing unit for ALB/NLB. Computed from the highest of: new connections, active connections, processed bytes, or rule evaluations (ALB only). ALB = $0.008/LCU-hr. NLB = $0.006/NLCU-hr.

Gateway Load Balancer — Layer 3 load balancer for inserting security appliances (firewall, IDS/IPS, DPI) transparently in the traffic path ("bump-in-the-wire"). Listens for ALL IP packets on ALL ports, forwards to virtual-appliance target group via [[GENEVE]] (port 6081), and maintains [[Flow stickiness]] so a flow always hits the same appliance. Paired with [[GWLBe]] (next hop in the route table). $0.0135/hr + $0.0035/GWLCU-hr (cheapest LB per hour). Exam: "transparent + 3rd-party firewall/IDS + centralized inspection for many VPCs" → GWLB.

Generic Network Virtualization Encapsulation — the tunneling protocol [[GWLB]] uses on UDP port 6081 to exchange traffic with its virtual appliances. GWLB wraps the original packet in GENEVE, sends it to the appliance for inspection unmodified, then unwraps it — this is what makes inspection transparent (the appliance sees the original packet). Exam: "GENEVE / port 6081" → Gateway Load Balancer.

[[GWLB]] feature that sends all packets of one flow to the SAME target appliance, so a stateful firewall sees both directions of a connection. Configurable as 5-tuple (default: src/dst IP + src/dst port + protocol), 3-tuple (src/dst IP + protocol), or 2-tuple (src/dst IP). Exam: "stateful appliance behind GWLB misses return traffic" → fix flow stickiness (the tuple), NOT add more appliances.

ELB session affinity feature — binds a user session to a specific target using a cookie. Duration 1 second to 7 days. ALB generates AWSALB cookie or uses app-provided cookie. NLB supports TCP stickiness. Use for stateful apps that don't support distributed sessions.

Default S3 storage class for frequently accessed data. $0.023/GB-month. Millisecond retrieval, no minimum duration, multi-AZ (≥3 AZs), 99.99% availability. Best for active data, websites, data lakes.

S3 Standard-Infrequent Access — for data accessed less than once a month. $0.0125/GB-month + retrieval fee. Millisecond retrieval. Multi-AZ. Min 30-day storage duration. Best for long-lived infrequently accessed data.

S3 One Zone-Infrequent Access — same as Standard-IA but data stored in only 1 AZ. $0.01/GB-month (20% cheaper). 99.5% availability. Best for re-creatable infrequently accessed data where AZ loss is acceptable.

High-performance single-AZ S3 storage class (newer, 2023+) designed for single-digit millisecond data access — up to 10x faster than S3 Standard with 50% lower request costs. Stored in ONE Availability Zone you choose (99.95% availability, 11 nines durability). Storage price is HIGH (~$0.16/GB-month) — it is for latency-sensitive hot data, NOT for saving storage cost. Exam trigger: "lowest latency / single-digit millisecond / latency-sensitive".

S3 Glacier class for archive data that needs millisecond retrieval. $0.004/GB-month. No restore job needed — direct GET like Standard-IA. Min 90-day duration. Best for medical imaging, news archive accessed rarely but instantly.

S3 Glacier class for archives where retrieval can take minutes to hours. $0.0036/GB-month. Restore tiers: Expedited (1-5 min), Standard (3-5 hr), Bulk (5-12 hr). Min 90-day duration. Formerly called "S3 Glacier".

S3 Glacier Deep Archive — lowest-cost storage class at $0.00099/GB-month. Retrieval: Standard ~12 hours, Bulk ~48 hours. No Expedited option. Min 180-day duration. Best for compliance archives (7-10 years) rarely or never accessed.

Per-GB charge to read data back from a cold S3 class. Standard and Intelligent-Tiering = $0. Standard-IA/One Zone-IA ~$0.01/GB. Glacier Instant ~$0.03/GB. Glacier Flexible/Deep Archive charge per restore job. The hidden cost that makes IA more expensive than Standard when data is accessed often.

The minimum time S3 bills an object in a class even if deleted earlier: Standard none, IA 30 days, Glacier (Instant/Flexible) 90 days, Deep Archive 180 days. Delete before the minimum and you still pay the remaining days (see [[Early Delete Fee]]).

The pro-rated charge you pay when you delete or transition an object out of a class before its [[Minimum Storage Duration]] elapses. Example: delete a Standard-IA object after 10 days → still billed for the full 30 days.

IA and Glacier classes bill objects smaller than 128 KB as if they were 128 KB. Storing millions of tiny objects (thumbnails, small logs) in IA can cost more than Standard — keep small objects in S3 Standard or Intelligent-Tiering.

S3 analytics feature that observes real access patterns and recommends when to transition objects from Standard to Standard-IA. Use it to size a Lifecycle Policy before guessing.

EC2 instance whose root volume is an EBS volume — data persists across stop/start, survives instance termination (if DeleteOnTermination=false)

EC2 instance whose root volume is an instance store — data is lost on stop or termination. Rare in modern workloads.

EBS feature allowing you to increase volume size, change volume type, or adjust IOPS/throughput on a live, attached volume — no downtime, no detach required. After resize, extend the OS filesystem (growpart + resize2fs on Linux).

Point-in-time backup of an EBS volume stored in S3. Incremental — only changed blocks are saved after the first snapshot. Used to create new volumes or copy data across regions.

Centralized managed backup service supporting EFS, EBS, RDS, DynamoDB, S3, FSx, EC2 AMIs, and more. Provides policy-based scheduling, retention rules, cross-region/cross-account copies, restore, and compliance reporting via Backup Audit Manager.

ECS networking mode that gives each task its own ENI and private IP — enables per-task security groups and VPC Flow Logs visibility

Elastic Network Interface — virtual network card attached to an EC2 instance or ECS task; carries a private IP, security groups, and MAC address

Docker bridge networking mode for ECS — tasks share the EC2 host's network interface; does not support per-task security groups

ECS networking mode where tasks share the EC2 host's network namespace; port conflicts possible when running multiple copies of the same task

Ephemeral Backup Key — AES-256 key generated inside an HSM to encrypt CloudHSM cluster backup data; exists only for the duration of the backup

Persistent Backup Key — long-lived key stored in CloudHSM that wraps (encrypts) the EBK; encrypted backup is stored in S3 in the same region as the cluster

Attribute-Based Access Control — IAM policy technique that grants access by MATCHING tags: a condition like aws:PrincipalTag/Project = aws:ResourceTag/Project means a user tagged Project=X can only touch resources tagged Project=X. Wujud sebab RBAC (satu policy per team/projek) meletup bila projek makin banyak — dengan ABAC, projek baru cuma perlu tag, TAK perlu tulis policy baru. Exam keyword: "scale permissions across many teams/projects without writing a new policy each time" / "tag-based access" → ABAC (vs [[Permission Set]]/RBAC for a small fixed set of roles).

IAM policy element that matches all principals EXCEPT those listed; used with Deny to restrict a resource to only a specified set of users/roles

Role-Based Access Control — grant access by attaching a specific policy per role/group (e.g. one IAM Group + policy per team). Simple bila role sikit & stabil, tapi tak scale: tiap projek/team baru = tulis policy baru. Lawan [[ABAC]] yang guna tag matching (satu policy untuk semua). Exam keyword "few well-defined roles, small fixed set" → RBAC; "scale across many projects/teams without new policy" → ABAC.

Service yang scan resource-based policy (S3 bucket, IAM role trust, KMS key, SQS queue, Lambda, Secrets Manager) dan kenal pasti resource yang boleh diakses oleh entiti LUAR zone of trust (public internet / account lain / Org lain), guna automated reasoning (provable security — bukti matematik). Ada juga Unused Access findings (cari role/key/permission tak guna untuk least-privilege right-sizing), policy validation, dan policy generation dari CloudTrail. External Access = free; Unused Access = bayar per resource. Exam keyword "identify resources shared/exposed to external account or public" → IAM Access Analyzer, BUKAN [[Amazon GuardDuty]] (threat aktif) atau [[AWS Config]] (compliance rules).

Masalah keselamatan cross-service: bila kau bagi satu AWS service (the "deputy") kuasa akses resource kau, pihak ketiga boleh perdaya service tu menggunakan kuasa kau bagi pihak mereka. Dilindungi dengan condition [[aws:SourceArn]] dan/atau [[aws:SourceAccount]] dalam ROLE TRUST POLICY supaya service hanya assume role bila request benar-benar datang dari ARN/account kau. Exam keyword "prevent confused deputy / cross-service impersonation" → aws:SourceArn + aws:SourceAccount.

IAM condition key yang dipakai dalam trust policy untuk hadkan SIAPA (resource ARN spesifik, cth topik SNS atau bucket tertentu) yang boleh menyebabkan satu AWS service assume role kau. Pertahanan utama lawan [[Confused Deputy]]. Selalu dipasangkan dengan [[aws:SourceAccount]].

IAM condition key yang hadkan account ID mana yang dibenarkan menyebabkan satu AWS service guna role/permission kau. Digunakan dengan [[aws:SourceArn]] dalam trust policy untuk halang [[Confused Deputy]].

IAM/resource policy condition key yang padan dengan SELURUH VPC (VPC ID) tempat request datang — lebih luas daripada [[aws:SourceVpce]].

IAM/resource policy condition key yang padan dengan satu [[VPC Endpoint]] TERTENTU (endpoint ID — perhatikan "e" di hujung) — lebih granular daripada [[aws:SourceVpc]], jadi pilihan least-privilege. Exam: "restrict to a specific endpoint / least privilege" → aws:SourceVpce.

Laporan CSV (satu per account, boleh dijana tiap 4 jam) senaraikan SEMUA IAM users + status credential mereka: umur password, access key terakhir guna/umur, status MFA, dll. Guna untuk audit & buang credential lapuk/tak guna (least privilege & security hygiene). Pasangan: [[Access Advisor]] untuk permission yang tak diguna.

Service that AGGREGATES security findings from [[Amazon GuardDuty]], [[Amazon Inspector]], [[Amazon Macie]], [[IAM Access Analyzer]], [[Firewall Manager]] and partner tools into one normalized format ([[ASFF]]), and runs automated compliance checks (CIS, PCI DSS, AWS Foundational Security Best Practices) to give a security score. It does NOT detect threats itself — it is the single-pane-of-glass aggregator. Cross-account via a delegated administrator in Organizations. Exam keyword "aggregate/centralize findings + compliance score across accounts" → Security Hub (vs GuardDuty which is one detection source, vs [[Amazon Detective]] which investigates a single finding's root cause).

Central management service that applies firewall rules ([[AWS WAF]] rules, [[AWS Shield]] Advanced, Security Groups, AWS Network Firewall, Route 53 Resolver DNS Firewall) ONCE across ALL accounts and resources in an AWS Organization — and auto-covers accounts/resources created later. Requires [[AWS Organizations]] + [[AWS Config]] enabled. Exam keyword "centrally enforce firewall/WAF rules across all accounts incl. new ones" → Firewall Manager (vs AWS WAF which is per-resource). Costs ~$100/month per policy.

Lets workloads OUTSIDE AWS (on-premises servers, other clouds, IoT) obtain temporary IAM credentials by authenticating with an X.509 certificate, instead of storing long-term IAM access keys. The cert is issued by a CA you register as a [[Trust Anchor]]; a Profile limits which role can be assumed. Uses [[STS]] under the hood (auto-expiring creds) — the on-prem equivalent of an EC2 instance role. Exam keyword "on-prem / non-AWS server needs AWS access without long-term keys" → IAM Roles Anywhere.

In [[IAM Roles Anywhere]], the Certificate Authority (AWS Private CA or your own CA) that you register so AWS trusts the X.509 certificates it issues. Workloads presenting a cert signed by the trust anchor can exchange it for temporary AWS credentials.

Self-service portal to download AWS compliance reports (SOC 1/2/3, ISO 27001, PCI DSS, FedRAMP) and to review/accept legal agreements (BAA for HIPAA, GDPR DPA). The reports are evidence for the AWS side ("security OF the cloud") of the Shared Responsibility Model — what you hand auditors. Free. Exam keyword "download AWS compliance/audit reports for auditors" → AWS Artifact (vs [[AWS Config]] which checks YOUR resources' compliance, vs Audit Manager which collects evidence for YOUR audit).

AWS Security Finding Format — the standard JSON schema [[Security Hub]] normalizes all findings into, so findings from GuardDuty, Inspector, Macie, and partner tools look the same and can be triaged/automated uniformly.

Ciri "Last Accessed" pada IAM user/role/group/policy — tunjuk service mana yang TERAKHIR diakses oleh entiti itu & bila. Guna untuk kenal pasti & buang permission yang tak pernah dipakai → kemas ke least privilege. Pasangan: [[Credential Report]] untuk audit credential. Exam keyword "which services has this role actually used / remove unused permissions" → Access Advisor (last accessed).

Ciri [[AWS RAM]] di mana owner account kongsi subnet dari satu central VPC ke account lain (consumer); consumer boleh launch resource (EC2, RDS, ALB) TERUS dalam subnet kongsi itu. Networking diurus berpusat oleh owner, billing resource ikut account masing-masing. Beza dengan VPC Peering (sambung dua VPC berasingan) — VPC Sharing = banyak account guna SATU VPC yang sama. Exam keyword "share subnets / centrally managed VPC across accounts" → VPC Sharing via AWS RAM.

Cross-Origin Resource Sharing — browser security mechanism; an S3 CORS config specifies AllowedOrigin, AllowedMethod, and AllowedHeader to permit browser JS from a different domain to make requests

IP routing method where multiple servers share the same IP addresses; network routes to the nearest one. Used by Global Accelerator — clients always reach the closest PoP automatically

Point of Presence — AWS edge location where Global Accelerator or CloudFront receives traffic before routing it over the AWS backbone to the origin region

Data Repository Association — FSx for Lustre feature linking an S3 bucket to the file system so objects are lazily imported and processed files can be exported back to S3

Auto Scaling mechanism that pauses an instance in a wait state during a transition so custom actions can run before it proceeds. Two wait states: Pending:Wait (before InService — bootstrap, install, register) and Terminating:Wait (before termination — drain connections, flush logs, cleanup). Actions run via EventBridge+Lambda, SSM Run Command, or local scripts; you call CompleteLifecycleAction (or wait out the default 1-hour timeout) to continue. Distinct from a lifecycle state.

ASG lifecycle state where an instance is removed from the active pool (stops receiving traffic) without being terminated — used for in-place maintenance; returns to InService when done

ASG setting (default 300 s) that blocks new scaling actions after a scaling event to let the fleet stabilize before evaluating whether more scaling is needed

Normal running state for an Auto Scaling group instance — registered with the load balancer and receiving traffic

VPC peering limitation: gateways (IGW, NAT Gateway, VGW/VPN, Direct Connect, Gateway VPC endpoint) in one VPC cannot be used by resources in a peered VPC. Each VPC must have its own gateways.

Attempting to route traffic through a middle VPC via two peering connections — NOT supported. If A↔B and B↔C, A cannot reach C through B. Use Transit Gateway for transitive routing.

S3 versioning concept — a DELETE on a key without specifying a version ID creates a delete marker (not actual deletion); all previous versions remain and incur storage charges. To permanently remove a version, specify its version ID.

In a versioned S3 bucket, all versions of an object that are not the current (latest) version. Lifecycle rules can expire noncurrent versions to reduce storage cost.

S3 safety setting (default ON) at account and bucket level that overrides bucket policies and ACLs to prevent objects from becoming public. If a bucket policy allows public access but objects stay private, BPA is still ON.

S3 Object Ownership setting that DISABLES ACLs entirely — the bucket owner owns all objects and access is controlled only by IAM/bucket policies. AWS-recommended default for new buckets.

Global IAM condition key that is true when a request uses HTTPS/TLS. Used in a bucket policy (Deny when aws:SecureTransport=false) to force all S3 requests over HTTPS.

An additional IPv4 CIDR block associated with an existing VPC (up to 5 total). Used to expand IP space without recreating or migrating the VPC. New subnets are created from the secondary CIDR.

Server Name Indication — TLS extension where the client includes the hostname in the ClientHello message. Enables a single ALB HTTPS listener to hold multiple TLS certificates and return the correct one per domain.

Origin Access Control — CloudFront feature that restricts S3 bucket access to only the CloudFront distribution via SigV4 request signing. Supports SSE-KMS encrypted buckets (OAI does not). Bucket stays private.

Origin Access Identity — legacy CloudFront feature to restrict S3 access; replaced by OAC. Does NOT support SSE-KMS encrypted S3 buckets.

Remembers connection state — allowed return traffic is automatically permitted without an explicit rule (like Security Groups)

Does not track connections — every packet is evaluated independently against rules, both directions need rules (like NACLs)

API Gateway feature that creates a private connection between API Gateway and a Network Load Balancer (NLB) inside a VPC. Enables private integration: API Gateway → VPC Link → NLB → backend (EC2, ECS, or on-premises via Direct Connect). No public internet traffic.

API Gateway rate limiting: steady-state rate (requests/sec) + burst rate (spike capacity). Protects backend from overload. Configured per stage or per method. Returns HTTP 429 Too Many Requests when exceeded.

API Gateway can cache endpoint responses for a configurable TTL (300s default). Reduces backend calls for repeated identical requests. Cache capacity: 0.5 GB–237 GB. Supports encryption at rest.

Custom API Gateway access control via a Lambda function. Two types: TOKEN (bearer token like JWT/OAuth) and REQUEST (uses request params like headers/query strings). Returns IAM policy allowing/denying access.

API Gateway feature to control access via API keys: sets throttling limits (rate/burst) and quota (max requests/day/week/month) per API key. Used to monetize or tier API access.

SQS ReceiveMessage waits up to 20 seconds for a message before returning. Reduces API calls and cost vs short polling (which returns immediately even if queue empty). Set ReceiveMessageWaitTimeSeconds > 0.

Default SQS behavior — ReceiveMessage returns immediately even if no messages are available. Results in many empty responses and high API call costs for frequently polled queues.

Period during which SQS hides a retrieved message from other consumers (default 30s, max 12 hours). Must exceed processing time to prevent duplicate processing. Extend per-message with ChangeMessageVisibility.

SQS First-In-First-Out queue: guarantees strict message ordering within a MessageGroupId and exactly-once processing (5-min deduplication window). Max 3000 TPS with batching. Use for ordered, deduplicated processing.

SQS/SNS queue for messages that fail processing after max receive count. Used for debugging and isolating problematic messages. Configure via RedrivePolicy on the source queue.

Pattern where one SNS topic fans out to multiple SQS queues, Lambda functions, or HTTP endpoints simultaneously. Enables parallel processing of the same message by multiple subscribers.

AWS serverless workflow orchestration service. Coordinates Lambda functions, ECS tasks, and other services in multi-step workflows with built-in error handling, retries, branching, and parallel execution. Two types: Standard (exactly-once, up to 1 year) and Express (at-least-once, up to 5 min).

ASL — the JSON-based language used to define a Step Functions state machine. Specifies states (Task, Choice, Parallel, Map, Wait, Pass, Succeed, Fail), transitions, and built-in Retry/Catch error handling.

Step Functions service integration pattern (.waitForTaskToken) that PAUSES a workflow until an external system or human sends a success/failure token back via SendTaskSuccess/SendTaskFailure. Used for human-approval steps or waiting on third-party systems. Standard workflows only — Express does not support it.

Step Functions Map state mode that parallelizes processing over very large datasets (e.g. millions of S3 objects or rows of a file) by fanning out concurrent child executions. Standard workflows only. Contrast with the inline Map state, which is limited to smaller in-memory arrays.

An operation that produces the same result whether run once or many times (e.g. a DynamoDB PUT with a fixed key). Idempotent actions are safe under at-least-once delivery, so they suit Step Functions Express and SQS Standard; non-idempotent actions (charging a card) need exactly-once semantics (Step Functions Standard, SQS FIFO).

High availability feature: synchronous standby replica in a different AZ. Failover is automatic — the endpoint CNAME is updated to point to the standby. Standby is NOT accessible for reads.

Aurora capacity mode that automatically scales compute up/down based on demand and can pause when idle. Ideal for intermittent, unpredictable, or infrequent workloads. v2 scales in fine-grained ACU increments.

Aurora Capacity Unit — the unit Aurora Serverless scales compute in. Each ACU ≈ 2 GiB of memory plus matching CPU and networking. Serverless v2 scales in fine-grained 0.5-ACU increments; you set a min/max ACU range (e.g. min 1 max 8 ACU = ~2–16 GiB memory range). Exam: unpredictable MySQL-compatible workload with known memory range → Aurora Serverless v2 with ACU bounds.

Read Capacity Unit — DynamoDB provisioned-throughput unit. 1 RCU = one strongly-consistent read/sec of up to 4 KB (or two eventually-consistent reads/sec). You provision RCUs (or use On-Demand / Auto Scaling).

Write Capacity Unit — DynamoDB provisioned-throughput unit. 1 WCU = one write/sec of up to 1 KB. A GSI has its own RCU/WCU separate from the base table; an LSI shares the base table’s capacity.

In-memory data store offered by ElastiCache. Supports rich data structures (lists, sets, sorted sets, pub/sub), persistence/snapshots, replication, and Multi-AZ auto-failover. Chosen over Memcached when you need durability, HA, or complex types (leaderboards, session store).

DynamoDB Point-in-Time Recovery: enables continuous incremental backups. Restore to any second in the last 35 days. No performance impact. Provides RPO near-zero. Different from on-demand backups.

Automatically adjusts DynamoDB provisioned read/write capacity units based on actual traffic using AWS Application Auto Scaling. Set target utilization % and min/max capacity bounds.

AWS Database Migration Service: migrates databases to AWS with minimal downtime. Supports homogeneous (MySQL→MySQL) and heterogeneous (Oracle→Aurora) migrations. CDC (Change Data Capture) mode keeps source and target synchronized during cutover.

Automated data transfer service for migrating data between on-premises (NFS/SMB/HDFS) and AWS (S3/EFS/FSx). Also handles EFS-to-EFS cross-region replication over AWS private network. Includes scheduling, verification, and network optimization. NOT for ongoing hybrid access (use Storage Gateway) or database migration (use DMS).

Fully managed SFTP, FTPS, FTP, and AS2 endpoints that store files directly into S3 or EFS. Lets partners/users transfer files using legacy protocols without code changes. NOT for bulk data migration (use DataSync) or hybrid storage (use Storage Gateway).

Central dashboard to track application migrations across multiple AWS tools (DMS, MGN, DataSync). Does NOT perform migrations itself — only tracks progress. Requires a home region for storing tracking data. Includes Strategy Recommendations and Orchestrator.

Physical devices for offline data transfer and edge computing: Snowcone (8-14TB, portable), Snowball Edge Storage Optimized (210TB), Snowball Edge Compute Optimized (28TB, 104 vCPUs). Data encrypted with KMS. Rule of thumb: if internet transfer takes >1 week, consider Snow Family.

AWS Application Migration Service — the primary lift-and-shift (rehost) tool that replicates entire on-prem/other-cloud SERVERS to AWS with minimal downtime. Contrast: DMS migrates databases, DataSync migrates files/objects. For ongoing disaster recovery (not one-time migration) use [[AWS DRS]].

AWS Elastic Disaster Recovery (formerly CloudEndure Disaster Recovery) — DR-as-a-service that continuously block-level replicates servers (on-prem, other cloud, or EC2) into a LOW-COST staging area in AWS. On disaster you fail over (DRS launches full EC2 from the latest state, RPO seconds / RTO minutes); when the primary recovers you fail back. Gives near-Warm-Standby recovery at near-Pilot-Light cost, automated. Exam: "low-cost DR / continuously replicate servers / fast failover + failback" → AWS DRS; "lift-and-shift migrate permanently" → [[MGN]].

Change Data Capture — DMS mode that continuously replicates ongoing source-database changes to the target so they stay in sync during a migration, enabling near-zero-downtime cutover.

AWS Schema Conversion Tool — converts database schema and code between different engines (e.g. Oracle → Aurora PostgreSQL) for heterogeneous DMS migrations.

Applicability Statement 2 — a secure B2B file-exchange protocol common in EDI / retail / supply-chain. Supported by AWS Transfer Family alongside SFTP, FTPS, and FTP.

AWS service for the PLANNING phase of a migration — discovers on-prem servers and maps their dependencies/utilization so you can plan migration waves. It does NOT migrate anything (that is [[MGN]] for servers, [[AWS DMS]] for databases). Feeds data into [[AWS Migration Hub]]. Exam: "discover / inventory / dependency mapping before migration" → Application Discovery Service.

A discovery mode of [[Application Discovery Service]] — deploy one OVA appliance to VMware vCenter (no per-server install). Collects basic config (server, CPU, RAM, disk, OS). Lighter/faster but does NOT see network dependencies. Use for VMware-only environments. Contrast [[Agent-based discovery]].

A discovery mode of [[Application Discovery Service]] — install the [[Discovery Agent]] inside each OS (Windows/Linux). Beyond basic config it captures inbound/outbound network connections, enabling dependency mapping between servers/processes. Use when you must map dependencies before migrating. Contrast [[Agentless discovery]].

The AWS Application Discovery Agent — software installed in each on-prem OS for [[Agent-based discovery]]; reports system config plus network connections to [[Application Discovery Service]] / [[AWS Migration Hub]].

Auto-provisioning, auto-scaling mode of [[AWS DMS]] — you do not size or manage a replication instance; billed per DCU-hour (DMS Capacity Unit) based on actual load. Use when migration load is variable/unknown. Contrast: provisioned DMS = you pick a fixed replication instance size and pay per hour.

AWS OpsHub — a free GUI desktop app to manage [[AWS Snow Family]] devices locally (unlock device, transfer data, launch EC2 instances on the device) without using the CLI.

Hybrid storage service: an on-prem appliance (VM/hardware/EC2) that gives local apps low-latency access to virtually unlimited AWS cloud storage using familiar protocols, with a local cache. Four types: [[S3 File Gateway]], [[FSx File Gateway]], [[Volume Gateway]], [[Tape Gateway]]. Exam: ONGOING hybrid access → Storage Gateway (vs one-time migration → [[AWS DataSync]]; offline bulk → [[AWS Snow Family]]).

Storage Gateway type that exposes NFS/SMB mounts on-prem; each file is stored as a single object in S3 (can lifecycle to Glacier). Local cache keeps recently-used files fast. Use for generic on-prem file share backed by S3.

Storage Gateway type that exposes SMB shares on-prem with Active Directory integration, backed by Amazon FSx for Windows File Server. Use for native Windows file share with low-latency local access. Keyword: "Windows / SMB / Active Directory / NTFS".

Storage Gateway type that exposes iSCSI block volumes to on-prem servers; point-in-time backups are stored as [[EBS snapshot]]s in S3. Two modes: [[Cached volume]] (primary data in S3) and [[Stored volume]] (primary data on-prem).

Volume Gateway mode where the PRIMARY data lives in S3 and only frequently-accessed (hot) data is cached on-prem. Max 32 TB/volume, up to 1 PB/gateway. Use to minimize on-prem storage. Contrast [[Stored volume]].

Volume Gateway mode where ALL primary data lives on-prem (low-latency access to the entire dataset) and asynchronous point-in-time [[EBS snapshot]]s are pushed to S3 for backup/DR. Max 16 TB/volume, up to 512 TB/gateway. Keyword: "low latency to entire dataset". Contrast [[Cached volume]].

Storage Gateway type that presents a virtual tape library ([[VTL]]) over iSCSI; legacy backup software writes "tapes" that are actually stored in S3, then archived to Glacier / Deep Archive. Use to replace physical tape libraries without changing backup software.

Virtual Tape Library — an iSCSI interface that emulates a physical tape library so legacy backup software can read/write virtual tapes. Used by [[Tape Gateway]] to land backups in S3 + Glacier instead of real tape.

EBS Snapshots Archive tier — low-cost long-term storage for rarely-accessed [[EBS snapshot]]s kept 90+ days. Converts the incremental snapshot into a FULL snapshot; up to 75% cheaper than the standard tier, but restoring it back to the standard tier takes 24-72 hours. Min 90-day retention. Exam: "rarely accessed / compliance archive / 90+ days" → Archive tier.

FSR — makes a volume created from an [[EBS snapshot]] fully initialized at creation, eliminating the first-access I/O latency (lazy loading) volumes normally have. Enabled per snapshot + per AZ, max 5 per Region, snapshots ≤16 TiB, not supported on Outposts/Local Zones/Wavelength. Billed per DSU-hour per enabled AZ (expensive) — use only when RTO is tight.

See [[Fast Snapshot Restore]] — removes first-access latency on volumes restored from a snapshot.

DLM — automates creation, retention, and cross-region/cross-account copy of [[EBS snapshot]]s and AMIs based on tags and schedules. FREE (pay only for the snapshots created). Use instead of writing your own Lambda+EventBridge cron. Contrast [[AWS Backup]] (centralized across many services).

See [[Data Lifecycle Manager]] — free, tag-based automation of EBS snapshot/AMI schedules and retention.

Retention-rule service that lets you recover [[EBS snapshot]]s and AMIs that were accidentally or maliciously deleted, within a defined retention period. A safety net against accidental deletion. Exam: "recover deleted snapshot / protect against accidental deletion" → Recycle Bin.

Amazon FSx for Windows File Server — fully managed Windows-native file storage over SMB/NTFS with Active Directory, DFS namespaces, and VSS shadow copies. Single-AZ or Multi-AZ. Exam: "Windows / SMB / Active Directory / NTFS file share" → FSx for Windows (NOT [[EFS]], which is NFS/Linux only).

Amazon FSx for Lustre — high-performance POSIX file system for HPC/ML/media: hundreds of GB/s throughput, millions of IOPS, sub-ms latency. Natively links to S3 via [[DRA]]. Two deployment types: Scratch (temporary, no replication, cheapest — for rebuildable data) and Persistent (durable, replicated within one AZ). Exam: "HPC + high throughput + POSIX + S3 integration" → FSx for Lustre.

Amazon FSx for NetApp ONTAP — the only FSx that is MULTI-PROTOCOL (NFS + SMB + iSCSI simultaneously). Full ONTAP features: snapshots, SnapMirror, dedup, compression, and auto-tiering of cold data to a cheaper capacity pool. Exam: "migrate NetApp / multi-protocol / SnapMirror / enterprise NAS" → FSx for NetApp ONTAP.

Amazon FSx for OpenZFS — fully managed NFS file storage powered by the OpenZFS file system, with ZFS snapshots and low latency. Exam: "migrate ZFS / Linux NFS workload to AWS" → FSx for OpenZFS.

AWS Backup Vault Lock — makes backups in a [[AWS Backup]] vault WORM (immutable). Compliance mode CANNOT be undone even by root (protects against ransomware / regulatory deletion); Governance mode can be changed with special permissions. Exam: "backups cannot be deleted / immutable / ransomware protection" → Vault Lock.

On-demand S3 job that replicates EXISTING objects (those created before a replication rule was enabled) to a destination bucket. Normal [[CRR]]/SRR only replicates NEW objects going forward — use Batch Replication to back-fill pre-existing data.

S3 Versioning protection that requires an MFA code to permanently delete an object version or to suspend versioning on a bucket. Guards against accidental or malicious deletion of versioned data.

Attribute on a CloudFormation resource that controls what happens when the resource is deleted: Delete (default), Retain (keep resource), Snapshot (create final snapshot — supported by RDS, EBS, ElastiCache, not S3).

AWS service for storing and automatically rotating secrets (database passwords, API keys). Built-in rotation for RDS/Aurora/Redshift/DocumentDB via managed Lambda rotation function. Charged per secret per month.

Read-only replicas within an Aurora cluster. Serve read traffic with typically <10ms lag. Can be scaled automatically with Aurora Auto Scaling based on CPU/connections. Up to 15 replicas per cluster.

Fully managed connection pooler that sits between an application and RDS/Aurora. Multiplexes many app-side connections into a smaller pool of DB connections — fixes "too many connections" from Lambda or Auto Scaling fleets, and speeds up failover.

DynamoDB's hash key (also called the 'hash attribute') — determines which physical partition an item is stored in. High-cardinality values spread traffic evenly and avoid a 'hot partition'.

DynamoDB's range key (also called the 'range attribute') — the second part of a composite primary key. Items with the same partition key are stored together, sorted by this value, enabling efficient range queries.

All items in a DynamoDB table (or table + its LSIs) that share the same partition key value. Stored together, sorted by sort key. The 10GB-per-partition-key-value limit for LSIs applies to the whole item collection.

Global Secondary Index — DynamoDB index with a partition/sort key DIFFERENT from the base table. Can be added or removed at any time and has its own provisioned throughput.

Local Secondary Index — DynamoDB index with the SAME partition key as the base table but a different sort key. Must be defined at table creation; limited to 10GB per partition key value.

ElastiCache engine option: multi-threaded, simple key-value cache with NO persistence and NO replication. Data is lost if a node restarts. Use for simple, horizontally-scaled caching where durability does not matter.

Caching strategy: data is loaded into the cache only on a cache miss (app queries cache → miss → queries DB → writes result back to cache). Avoids filling the cache with unused data, but a cache miss costs 3 round trips and data can go stale.

Caching strategy: every write to the database is also written to the cache immediately. Cache data stays fresh and there is no cache-miss penalty for written data, but the cache can fill with rarely-read data and writes get slower.

Aurora feature spanning multiple AWS Regions: one primary Region plus up to 5 read-only secondary Regions, with typical cross-region replication lag <1s. Used for low-latency global reads and cross-region disaster recovery (promote a secondary in ~1 min).

Multi-Factor Authentication — requires a second factor (TOTP app, hardware/U2F key, etc.) on top of a password. Enforce on the root user and privileged IAM principals; can be required via IAM policy conditions (aws:MultiFactorAuthPresent).

Network-layer service that uses 2 static anycast IPs at AWS edge locations to route TCP/UDP traffic over the AWS backbone to the nearest healthy endpoint. Improves latency and fast failover for non-HTTP apps. Contrast CloudFront, which caches HTTP content.

S3 storage class that automatically moves objects between access tiers based on usage, with no retrieval fees. Best when access patterns are unknown or changing — saves cost without writing lifecycle rules.

Lightweight publish/subscribe messaging protocol for IoT / low-bandwidth devices. Supported by Amazon MQ (and AWS IoT Core) — a reason to pick Amazon MQ over SQS/SNS when an app already speaks it.

Advanced Message Queuing Protocol — open-standard messaging used by RabbitMQ. Supported by Amazon MQ, the managed broker for lift-and-shift apps needing AMQP/MQTT/STOMP rather than the SQS/SNS APIs.

Simple Text Oriented Messaging Protocol — a lightweight text-based messaging protocol supported by the ActiveMQ engine in Amazon MQ. If an existing app speaks STOMP, pick Amazon MQ (ActiveMQ), not SQS/SNS.

ActiveMQ's native binary wire protocol (used by JMS clients). Supported by the ActiveMQ engine in Amazon MQ — another reason to choose Amazon MQ when migrating an existing ActiveMQ/JMS app unchanged.

Java Message Service — the standard Java API for sending/receiving messages via a broker (queues & topics). Apps built on JMS map onto Amazon MQ (ActiveMQ) for a no-code-change migration, not the proprietary SQS/SNS SDK.

ECS task placement strategy that packs tasks onto as few instances as possible (by CPU or memory) to minimize instance count — cost-saving. Contrast spread.

ECS task placement strategy that distributes tasks evenly across a dimension (e.g. Availability Zone or instance) for high availability. Contrast binpack.

ECS task placement strategy that places tasks on instances at random — no cost or availability optimization. Contrast binpack (cost) and spread (HA).

ECS JSON blueprint describing the containers in your app: image, vCPU, memory, ports, env vars, volumes, plus the Task Role and Task Execution Role. It is a template only — it does not run; a Task is a running instance of it. Common exam answer to "best describes a task definition".

A running instance of an ECS Task Definition (one or more containers running together). Launched and kept at the desired count by an ECS Service.

ECS construct that keeps a desired number of Tasks running (restarting failed ones), and integrates with load balancers and auto-scaling. "Maintain N running copies" → Service.

IAM role whose permissions are vended to the application code running inside an ECS task — so the container can call AWS services (S3, DynamoDB, SQS) with per-task least privilege. Distinct from the Task Execution Role. See [[Task Execution Role]].

IAM role used by the ECS/Fargate agent (not your app code) to pull the container image from ECR, write logs to CloudWatch, and fetch secrets. "Task can't pull image / write logs" → fix this role. See [[Task Role]].

ECS task placement constraint that places each task on a separate container instance — no two tasks of the group share an instance. Contrast the memberOf constraint.

ECS task placement constraint that places tasks only on instances satisfying a cluster query expression (e.g. a specific instance type or attribute). Contrast distinctInstance.

IAM Roles for Service Accounts — EKS feature that lets a Kubernetes pod assume an IAM role via a service-account annotation, so pods call AWS services without storing credentials in the image. The EKS analogue of an ECS Task Role.

A controller you install into an EKS cluster that watches Kubernetes Ingress/Service objects and provisions AWS load balancers for you: a Kubernetes Ingress → an Application Load Balancer (L7, HTTP path/host routing), and a Service of type LoadBalancer → a Network Load Balancer (L4, TCP/UDP, static IP). Exam: "EKS + route HTTP traffic by URL path with least operational effort" → AWS Load Balancer Controller + ALB Ingress (managed), NOT a self-managed NGINX Ingress controller.

Kubernetes volume access mode: the volume can be mounted read-write by ONE node at a time. This is what EBS gives you — so EBS suits single-node workloads, NOT pods spread across different nodes. Exam keyword pairing: "single node" / EBS = RWO.

Kubernetes volume access mode: the volume can be mounted read-write by MANY nodes at once. This is what EFS gives you — the answer whenever an EKS question says "shared access by multiple pods on different nodes". Exam keyword pairing: "shared across nodes" / EFS = RWX.

Container Storage Interface driver that lets EKS pods mount an Amazon EFS file system as a ReadWriteMany (RWX) persistent volume. The mechanism that makes EFS the go-to shared storage for EKS across multiple nodes/AZs. (EBS uses the EBS CSI Driver, which is RWO only.)

ECS/Fargate storage option where a file or directory is mounted from the host (EC2 or Fargate) into a container. EPHEMERAL — the data is tied to the task lifecycle and is lost when the task stops. Good for scratch space or sharing a volume between containers in the SAME task; NOT for persistent or cross-task data (use EFS for that).

The temporary disk a Fargate task gets by default — 20 GiB, configurable from 20 up to 200 GiB via the task definition ephemeralStorage parameter, AES-256 encrypted. It is wiped when the task stops, so it is NOT for data you must keep. For persistent or shared storage, mount Amazon EFS.

AWS managed NLP service: sentiment analysis, entity recognition, key phrase extraction, topic modeling, language detection. No ML expertise needed. Analyzes text from support tickets, social media, documents.

HIPAA-eligible variant of [[Amazon Comprehend]] specialized for medical text — extracts medical entities (conditions, medications, dosages, PHI) from clinical notes and patient records. Exam keyword: "clinical notes / medical records / extract PHI" → Comprehend Medical, not plain Comprehend.

Conversational AI service for building chatbots and voice interfaces. Provides NLU (Natural Language Understanding) + ASR (speech recognition). Powers Amazon Alexa. Manages multi-turn conversation state.

Extracts text and structured data from scanned documents (PDF, images). Goes beyond OCR: extracts key-value pairs from forms and data from tables. Used for invoice/contract/report processing.

Intelligent enterprise search service powered by ML. Indexes and searches across diverse data sources (S3, SharePoint, databases) including unstructured documents (PDF, Word, email). Natural language query understanding.

Image and video analysis service. Detects objects, scenes, faces, text, and explicit content. Facial recognition and comparison. NOT for document text extraction (use Textract) or NLP (use Comprehend).

Text-to-speech service: converts written text to lifelike audio. Supports multiple voices and languages. NOT for chatbots (use Lex) or text analysis (use Comprehend).

Neural machine translation service: converts text between languages (e.g. English ↔ Japanese). Real-time and batch. NOT speech (pair with Transcribe for audio→text→translate) or sentiment (use Comprehend).

Automatic speech recognition (ASR): converts audio/video speech to text. Speaker identification, custom vocabulary, call-centre analytics. NOT text-to-speech (use Polly) or translation (use Translate).

Fully managed service for building generative AI apps using foundation models (FMs) from Amazon and third parties (Anthropic, Meta, etc.) via a single API. Supports fine-tuning and RAG (Knowledge Bases) without managing infrastructure. NOT for training models from scratch (use SageMaker).

End-to-end managed platform to build, train, and deploy CUSTOM ML models (your data, your algorithm/framework) — includes data prep, training, hyperparameter tuning, and real-time/batch/serverless deployment endpoints. Different from pre-built AI services (Polly, Rekognition, Comprehend) which need no training, and from Bedrock (foundation models via API, not training from scratch).

SageMaker AutoML feature: auto tries multiple algorithms + hyperparameters on your data and picks the best model, with little/no ML coding. Use when you want a custom model but lack ML expertise to hand-tune.

SageMaker deployment option that auto-scales compute (including to zero) based on traffic — you pay per inference, not per idle hour. Best for intermittent/spiky/unpredictable traffic where a real-time endpoint would sit idle but still bill.

SageMaker option to run inference on a whole dataset as a one-off/scheduled job (no persistent endpoint). Instances run only for the job. Use for offline scoring of large datasets, not low-latency live requests.

SageMaker deployment option that queues requests and processes them asynchronously — handles large payloads (up to 1GB) and long processing times, and can scale to zero when the queue is empty. Use for big/slow inference where the caller can wait.

Managed Streaming for Apache Kafka — fully managed Kafka cluster on AWS. Handles broker provisioning, patching, storage scaling. NO SSH to brokers. Lambda integration requires Event Source Mapping. MSK Serverless auto-scales capacity.

Managed Elasticsearch/OpenSearch cluster. Full-text search with relevance scoring, spell-checking, synonym support, fuzzy matching. Used for e-commerce product search, log analytics, application monitoring.

AWS marketplace for subscribing to and accessing third-party data products (market data, financial data, regulatory filings). Data delivered directly to your S3 bucket. Handles licensing and subscription management.

Real-time data streaming service. Captures GB/s of data with sub-second latency. Retains data 1–365 days. Integrates with Lambda, Firehose, Analytics. Use for real-time dashboards, ML, and event-driven architectures.

Serverless ETL (Extract, Transform, Load) service. Crawls data sources to build a metadata catalog, runs Spark-based transformation jobs, and orchestrates data pipelines. NOT a streaming or search service.

Petabyte-scale data warehouse for OLAP analytics. Columnar storage + compression + Massively Parallel Processing (MPP) make large aggregate/join queries fast. NOT for transactions (OLTP → RDS/Aurora). Variants: RA3 (compute/storage separate), Redshift Serverless (no cluster to manage).

Redshift feature that queries data directly in S3 without loading it into the cluster. Lets a single SQL query join warehouse tables with data-lake files in S3. Contrast with Athena, which is standalone/serverless and needs no Redshift cluster. Do NOT confuse with [[AQUA]]: Spectrum extends queries OUT to S3; AQUA reduces network/CPU bottlenecks INSIDE the cluster.

AQUA (Advanced Query Accelerator) — a cache + hardware-accelerated compute layer between [[Amazon Redshift]] RA3 compute nodes and Redshift Managed Storage. It pushes filtering/aggregation DOWN close to storage, so less data crosses the network to the compute nodes — reducing both network-bandwidth and CPU bottlenecks. Available on RA3, no extra charge. Now AUTO-MANAGED: the aqua-configuration-status setting is retired and Redshift decides when to use it (so it's the 'minimize operational overhead' answer). Exam keyword: 'Redshift performance issues due to network bandwidth and CPU processing limits' → AQUA, NOT [[Redshift Spectrum]] or ElastiCache.

Elastic MapReduce — managed cluster platform for big-data frameworks (Spark, Hadoop, Hive, Presto, HBase). You control cluster size and instance types. Master/core/task node roles; task nodes commonly run on Spot to cut cost. Use for custom big-data processing vs serverless ETL (Glue).

Serverless business-intelligence (BI) service for dashboards and visualizations. Connects directly to S3, Athena, Redshift, RDS. SPICE in-memory engine for fast queries; ML Insights adds anomaly detection and forecasting without separate ML infrastructure.

Formerly Kinesis Data Firehose. Fully managed, near-real-time delivery of streaming data to S3, Redshift, OpenSearch, or Splunk. No code, no servers, auto-scaling; optional Lambda transform and format conversion (e.g. JSON → Parquet). Buffers by size/time (min ~60s) — not sub-second.

Formerly Kinesis Data Analytics. Processes and analyzes streaming data in real time using SQL or Apache Flink (e.g. windowed aggregations, filtering, enrichment) before delivery downstream.

Central metadata store (databases, tables, schemas) for data assets across S3, RDS, Redshift. Shared by Athena, Redshift Spectrum, and EMR. Stores WHAT data exists and its schema — not the data itself, and not access control (→ Lake Formation).

Glue component that connects to a data source (e.g. S3, DynamoDB), infers the schema, and populates the Glue Data Catalog with table metadata. Classifiers help it recognize custom formats. Exam trigger: "determine schema and populate the Data Catalog" → Crawler.

In Glue terminology, a repository that persistently stores your actual data (e.g. an S3 bucket or a relational database). The data store is what a Crawler crawls to obtain the metadata it writes into the Data Catalog. Same physical thing as a "data source"/"data target" — those just name its role in a job.

In Glue terminology, a data store used as the INPUT to a process or transform (an ETL job reads from it). Contrast with Data Target (the output). Both are ordinary data stores; the term only describes the role.

In Glue terminology, a data store that a process or transform WRITES to (the output of an ETL job, e.g. an S3 bucket of Parquet, or Redshift). Contrast with Data Source (the input).

A metadata definition in the Glue Data Catalog representing a dataset: column names, data types, partition info, and other schema metadata. The actual data stays in its original data store — a table (and a database) holds metadata ONLY, not the data itself. Exam trigger: "metadata definition representing the data" → Table.

Super-fast Parallel In-memory Calculation Engine — QuickSight’s in-memory store that caches imported data for fast, repeatable dashboard queries without re-hitting the source.

Online Analytical Processing — read-heavy analytical workloads: aggregates, joins, and reporting over large datasets (e.g. Redshift). Optimized by columnar storage. Contrast with OLTP.

Online Transaction Processing — many small, fast reads/writes of individual rows (e.g. RDS/Aurora, DynamoDB). Row-oriented. Exam trap: a "transactional application" should NOT be answered with Redshift (that is OLAP).

Massively Parallel Processing — splits a query across many compute nodes that work in parallel, then combines results. Why Redshift handles huge aggregate/join queries quickly.

Sekumpulan komputer/server (EC2) yang diikat bersama dan dipaksa bekerjasama sebagai SATU entiti raksasa untuk buat satu kerja berat — bukan satu komputer gergasi super-mahal (yang ada had fizikal), tapi 10-20 komputer biasa yang agih beban. Terma ni bersepah merentas servis sebab konsep sama: [[Amazon Redshift]] Cluster = 1 Leader Node (plan + agih) + banyak Compute Node → pecah jadi Slices (unit [[MPP]]); [[Amazon EMR]] Cluster = Primary Node + Core/Task Nodes (Hadoop/Spark); [[EKS]]/ECS Cluster = pool EC2 worker nodes + managed control plane, pod dicampur merentas mana-mana node kosong; ElastiCache Cluster = pool node memori (Redis shard + replica); Aurora DB Cluster = 1 writer + Read Replicas atas shared storage 6-copy. Analogi: satu KOLONI SEMUT usung bangkai lipas gergasa (data petabyte) — semut ketua (Leader) jerit agih kerja, 100 semut kuli (Compute Nodes) usung serentak (parallel); seekor semut mati, koloni terus jalan (HA). Exam hack: nampak perkataan "Cluster" → auto-fikir "banyak node bekerjasama serentak di belakang tabir = PERFORMANCE + tahan kalau satu node crash = HIGH AVAILABILITY".

RDS encryption-at-rest (KMS) cuma boleh ENABLE masa CREATE DB instance — TAK boleh modify existing unencrypted in-place (butang turn-on TAK wujud). Cara encrypt existing unencrypted RDS: snapshot → COPY snapshot + tick Enable Encryption (pilih [[KMS]] key: aws/rds managed atau CMK) → restore NEW encrypted instance → update app endpoint → buang lama. [[Read Replica]] WARISI encryption source: primary unencrypted → replica unencrypted (same-region, tak boleh encrypt terus); buang RR lama, create RR baru dari encrypted primary → auto encrypted. Konsep sama macam encrypt [[EBS]] volume. Exam keyword: "encrypt existing unencrypted RDS / audit jumpa unencrypted" → snapshot→copy→restore, BUKAN modify in-place.

Storage layout that keeps each column together instead of each row. Analytics queries that scan a few columns over many rows read far less data and compress better — used by Redshift and file formats like Parquet/ORC.

Open columnar file format common in data lakes. Reduces the data Athena/Redshift Spectrum scan (lower cost) and improves query speed vs row formats like CSV/JSON. Converting raw data to Parquet is a frequent Glue ETL step.

Centralized repository (typically S3) storing raw structured and unstructured data at any scale. Queried in place by Athena, Redshift Spectrum, and EMR; cataloged by Glue; access governed by Lake Formation. Contrast with a data warehouse (structured, pre-modeled). Exam keyword: "store all/any data types at any scale" → Data Lake (S3).

Central store for structured, cleaned, pre-modeled data optimized for OLAP — complex SQL queries and BI/reporting over huge tables (e.g. Amazon Redshift). Data is loaded after cleaning (schema-on-write). Contrast with a data lake (raw, any data type, schema-on-read). Exam keyword: "complex SQL + BI on structured data" → Redshift.

Service that sits on top of S3 + Glue Data Catalog to (1) enforce fine-grained access control on a data lake — row-level, column-level, and cell-level — and (2) simplify/accelerate building a secure data lake (blueprints automate IAM, encryption, cleansing, cataloging). Glue Catalog only stores metadata; Lake Formation enforces who can access what. Itself free; pay only for the underlying S3/Glue/Athena.

Data is stored raw and its structure is interpreted only when queried (data lakes / S3 + Athena). Flexible, ingest anything. Contrast with schema-on-write (data warehouses like Redshift), where data must be cleaned and conform to a fixed schema before loading.

A data lake gone bad — data was dumped in without cataloging, governance, or cleansing, so nobody can find, trust, or use it. The failure mode a [[Data Lake]] falls into without a [[Glue Data Catalog]] (so data is discoverable) + [[AWS Lake Formation]] (so access is governed). Exam phrasing: "data lake became unmanageable / unsearchable" → it turned into a data swamp; fix = catalog + governance.

First zone of a multi-zone data lake (a.k.a. Landing or Bronze zone) — ingested data stored exactly as received (any format, uncleaned, immutable) so the original is never lost. Cleaned downstream into the [[Cleanse Zone]] by Glue [[ETL]].

Middle zone of a multi-zone data lake (a.k.a. Processed, Staging, or Silver zone) — data from the [[Raw Zone]] after Glue [[ETL]] removes duplicates/anomalies, standardizes formats, and converts to columnar [[Parquet]]. Feeds the [[Curated Zone]].

Final zone of a multi-zone data lake (a.k.a. Analytics or Gold zone) — cleaned, modeled, business-ready data optimized for consumption by Athena, Redshift, QuickSight, and ML. What analysts actually query.

Hadoop Distributed File System — Hadoop’s storage layer that splits files into blocks across cluster nodes. On EMR, Core nodes hold HDFS data, which is why Core nodes are risky on Spot (losing one loses data); EMRFS lets EMR use S3 instead so clusters can be transient.

EMR File System — lets Amazon EMR read/write data directly in S3 as the storage layer instead of local HDFS. Decouples compute from storage, so a cluster can terminate after a job while the data persists in S3 (transient cluster pattern).

Open-source framework for distributed storage (HDFS) and batch processing (MapReduce) of big data across a cluster. Runs managed on Amazon EMR.

Apache Spark — fast in-memory distributed processing engine for big data (batch, streaming, ML). The most common framework run on EMR and Glue; faster than classic MapReduce.

Apache Hive — SQL-like query layer (HiveQL) over data in Hadoop/S3 that compiles queries into distributed jobs. Available on EMR.

Distributed SQL engine for fast interactive queries across large datasets and multiple sources. Available on EMR; Amazon Athena is built on Presto/Trino.

Apache HBase — distributed NoSQL wide-column database on top of HDFS for real-time read/write to very large tables. Available on EMR.

HDFS master process that holds only the METADATA — which blocks make up each file and which DataNode holds each block. It does NOT store the file data itself. On EMR it runs on the Master node. Analogy: the front-desk clerk holding the record book.

HDFS worker process that actually stores the file blocks on disk and serves them on the NameNode’s instruction. On EMR, DataNodes run on Core nodes — which is why Core nodes are risky on Spot (losing one can lose data).

The fixed-size chunk (~128MB by default) a large file is split into and distributed across DataNodes. Each block is replicated (default ×3) to different nodes so a single node failure doesn’t lose data.

Number of copies HDFS keeps of each block across different nodes (default 3). If one node fails the data survives on another — HDFS fault tolerance. Higher factor = more durability but more storage used.

The throughput unit of Kinesis Data Streams. Each shard handles ~1 MB/s or 1,000 records/s in and 2 MB/s out; total stream capacity = number of shards. Records map to shards by partition key.

Query optimization where the engine skips data partitions that don’t match the WHERE filter (e.g. by date/region), so Athena and Redshift Spectrum scan less data — lower cost and faster queries.

Lower-cost, S3-backed storage tier in Amazon OpenSearch Service for older, less-frequently-queried data. Cheaper than hot storage but slower reads; Cold storage is cheaper still for archives.

Extract, Transform, Load — pull raw data from sources, clean/convert it (e.g. CSV → Parquet), then load it into a target for analytics. AWS Glue is the serverless ETL service.

Data Processing Unit — the compute/billing unit for AWS Glue jobs (a bundle of vCPU + memory). You pay per DPU-hour, with no cluster to manage.

QuickSight mode that queries the data source live on each request (always fresh, but loads the source) — contrast with SPICE, which caches imported data in memory for fast, repeatable dashboards.

Kinesis family member that ingests, durably stores (encrypted, time-indexed), and streams VIDEO/audio from devices/cameras for playback, analytics, and ML (e.g. Rekognition Video). NOT for text/log records — that is Kinesis Data Streams. Two modes: classic (ingest→store→playback) and WebRTC (two-way real-time).

Kinesis Video Streams mode for two-way, ultra-low-latency, peer-to-peer live media (video call, video doorbell talk-back, baby monitor). Fully managed signaling + media relay — no servers to run. Contrast classic KVS, which is one-way ingest→storage→playback.

Web Real-Time Communication — open standard for low-latency, peer-to-peer audio/video/data between browsers, apps, and devices. Uses ICE + STUN + TURN to establish a direct connection through NATs/firewalls.

In KVS WebRTC, the coordination path peers use to discover each other and exchange connection info (SDP offers/answers, ICE candidates) BEFORE the media flows. It carries setup messages, not the video itself.

Session Traversal Utilities for NAT — lets a device discover its own public IP/port so two peers can attempt a direct peer-to-peer connection through NAT.

Traversal Using Relays around NAT — a relay server that forwards media when a direct peer-to-peer connection is impossible (strict NAT/firewall). KVS WebRTC bills TURN streaming minutes.

Real-Time Streaming Protocol — common protocol IP/network cameras use to deliver live video. KVS can ingest an RTSP feed.

The GStreamer plugin element that pushes media from a device/camera into Kinesis Video Streams — one of the Producer paths (alongside the Producer SDK and RTSP).

HTTP Live Streaming — adaptive playback protocol (Apple) used to watch a KVS classic stream live or on-demand in browsers/players. Has a few seconds of buffer latency.

Dynamic Adaptive Streaming over HTTP — open-standard adaptive playback protocol, an alternative to HLS for viewing KVS classic streams.

The basic unit of a Kinesis Video stream: a self-contained sequence of media frames with a unique fragment number and producer/server timestamps used for time-indexing and retrieval.

Any data tied to a timeline that KVS can carry — not just video, but audio, thermal imagery, depth, RADAR/LIDAR — indexed by timestamp for replay/processing.

Centrally manage multiple AWS accounts: consolidated billing, volume discounts, and grouping accounts into Organizational Units (OUs). Apply SCPs to set permission guardrails across accounts.

Service Control Policy — Organizations guardrail that sets the MAXIMUM permissions for accounts/OUs. Does NOT grant access — it only limits what IAM can allow. An explicit deny in an SCP overrides any IAM allow.

Monitoring for metrics, logs, alarms, and dashboards. Standard metrics every 5 min; detailed monitoring 1 min. EC2 memory & disk are NOT default — they need the CloudWatch agent. Answers "is it performing?".

Audit log of every API call (who did what, when, from where) across the account. Management + data events; can log to S3 / an org trail. Answers "who did this?". NOT performance (CloudWatch) or config state (Config).

Records resource configuration history and evaluates it against rules for compliance (e.g. "all EBS volumes must be encrypted"), with optional auto-remediation. Answers "is it compliant / what changed?".

The AWS Config engine that detects and records every configuration change to your resources. Must be turned ON — if it is off, Config records nothing. One per region.

A point-in-time snapshot of a single resource's configuration (state + relationships + metadata) in AWS Config. This is the billable unit — $0.003 per CI recorded per region.

The AWS Config component that delivers configuration snapshots and history to an S3 bucket and sends notifications via SNS/EventBridge.

Infrastructure as Code via declarative templates (YAML/JSON). Provisions resources as a Stack. Change sets preview edits; drift detection finds manual changes; StackSets deploy across accounts/regions.

CloudFormation feature to deploy the same stack across MULTIPLE accounts and regions from one operation. Common with Organizations to roll out baseline guardrails fleet-wide.

Account-level checks across 5 pillars: cost optimization, security, fault tolerance, performance, and service limits. Full checks require Business/Enterprise Support.

Uses ML on CloudWatch metrics to recommend right-sizing for EC2, ASG, EBS, and Lambda — reduces over-provisioning. Recommendation engine, NOT an enforcement tool.

Sets up and governs a secure multi-account AWS environment (landing zone) using Organizations + guardrails + SSO. Higher-level automation on top of Organizations. Exam: "automated landing zone / governed baseline / provision many accounts at scale" → Control Tower, NOT raw Organizations.

The pre-configured, secure, multi-account baseline Control Tower deploys for you — networking, centralized logging (CloudTrail/Config to a log archive account), SSO, and guardrails. The "ready-made foundation" so you do not hand-build account setup.

Control Tower feature that provisions new AWS accounts in a standardized, self-service way (consistent baseline + guardrails applied automatically). Exam keyword: "provision/onboard many accounts at scale with a consistent baseline".

A pre-packaged governance rule in Control Tower, implemented via SCPs (preventive) or AWS Config rules (detective). Three types: Mandatory (always on), Strongly-recommended, and Elective. Drift detection flags when an account strays from the baseline.

Control Tower auto-detects when an enrolled account strays from its landing-zone baseline — e.g. an SCP removed, an OU moved, or an account moved/removed from an OU — and publishes a notification to the AggregateSecurityNotifications SNS topic in the audit account. Subscribe (email/Lambda) to get alerted on org/OU hierarchy changes. Exam: "monitor OU hierarchy changes / alert when account governance drifts" → Control Tower drift notifications, NOT CloudFormation StackSets drift (that is infra-template drift) and NOT raw Config.

Personalized view of AWS operational issues, scheduled changes, and maintenance events affecting YOUR account's resources — different from the public Service Health Dashboard. Integrates with EventBridge for automated alerting. Full API access needs Business/Enterprise Support.

Interactive query language for CloudWatch Logs — SQL-like syntax to search, filter, aggregate, and visualize log data across multiple Log Groups. Runs in the console without external tools. Use for: "count errors by Lambda function in last 1 hour". Athena is for S3 data; Logs Insights is for CloudWatch log data.

A collection of Config rules and remediation actions packaged as a single YAML template — deployable across an entire AWS Organization via StackSets. Used for compliance frameworks (CIS AWS Foundations, NIST, PCI DSS). One pack replaces dozens of manually configured individual rules.

CloudFormation stacks that are referenced and created by a parent stack using the AWS::CloudFormation::Stack resource type. Enables modular, reusable templates — e.g. one VPC stack referenced by multiple app stacks. Each nested stack has its own lifecycle (update/rollback) but is orchestrated by the parent.

AWS Systems Manager feature for centralized, hierarchical storage of configuration data and secrets. Standard tier: free, up to 10,000 params, no expiration. Advanced tier: parameter policies (auto-expiry, change notifications), higher limits. SecureString type = KMS-encrypted at rest. No auto-rotation — use Secrets Manager when rotation is needed.

AWS Systems Manager feature providing a browser-based interactive shell to EC2 instances (and on-premises servers) without opening port 22, managing SSH keys, or running a bastion host. All session activity is logged to S3 / CloudWatch Logs and the session-start event appears in CloudTrail. Requires SSM Agent + AmazonSSMManagedInstanceCore policy on the instance.

AWS Systems Manager feature to run scripts/commands on many EC2 (or on-prem) instances AT SCALE without SSH. Non-interactive (good for patching/config). Requires SSM Agent + AmazonSSMManagedInstanceCore policy. Unlike EC2 User Data (which runs only at launch), Run Command works on existing, already-running fleets.

A Parameter Store parameter type whose value is encrypted at rest with KMS (default aws/ssm key or a custom CMK). Used for passwords and API keys; decrypted only for callers with KMS decrypt permission. Note: SecureString does NOT auto-rotate — use Secrets Manager when rotation is required.

CloudFormation feature that PREVIEWS the changes (which resources will be created/modified/deleted) before you execute a stack update — review before applying, especially on production. Different from Drift Detection (which finds changes already made manually outside CloudFormation).

CloudFormation feature that detects when stack resources have been changed MANUALLY outside CloudFormation (e.g. via the console), making the stack "DRIFTED" from its template. It only detects & reports — it does not auto-fix. Contrast with a Change Set, which previews edits before they are applied.

Sharing a value (e.g. a VPC ID, Security Group ID) from one CloudFormation stack to another. The producing stack declares an Output with an Export name; the consuming stack pulls it with [[Fn::ImportValue]]. Exam keyword: "share/import values between stacks" → Outputs + Export + Fn::ImportValue (NOT Parameters, which only feed values INTO one stack).

CloudFormation intrinsic function that imports a value EXPORTED by another stack's Output — the consumer side of a [[cross-stack reference]]. An exported value cannot be deleted or modified while another stack still imports it.

Optional CloudFormation template section that applies a macro to the template before deployment. Most common value is AWS::Serverless-2016-10-31, which enables [[SAM]] shorthand. Exam keyword: "serverless + CloudFormation" → Transform / SAM.

Serverless Application Model — an extension of CloudFormation (via the [[Transform]] section) with shorthand for serverless resources (Lambda, API Gateway, DynamoDB). Write far less YAML for serverless apps; deploys as a normal CloudFormation stack underneath.

JSON policy attached to a CloudFormation stack that protects critical resources (e.g. a database) from being modified or replaced during a stack UPDATE. Different from DeletionPolicy, which controls what happens on stack DELETE. Exam keyword: "prevent accidental updates to specific resources during stack update" → Stack Policy.

CloudFormation stack-level setting that prevents the STACK itself from being deleted (must be disabled before a delete succeeds). Contrast: Termination Protection blocks stack DELETE; DeletionPolicy: Retain keeps a specific resource if the stack IS deleted; [[Stack Policy]] protects a resource during a stack UPDATE.

CloudFormation helper script on EC2 that reads AWS::CloudFormation::Init metadata and INSTALLS packages/files/services at launch. Exam keyword: "read metadata + install software when instance launches" → cfn-init (init = setup). Borderline SAA-C03 topic — knowing this one is usually enough.

CloudFormation helper script that sends a SUCCESS/FAILURE signal back to CloudFormation, paired with CreationPolicy/WaitCondition so the stack waits until EC2 setup finishes before marking CREATE_COMPLETE.

CloudFormation daemon on EC2 that watches for metadata changes and re-runs [[cfn-init]] when the stack is updated.

CloudFormation helper script that only retrieves metadata — it does NOT install anything (contrast [[cfn-init]]).

AWS Config feature that collects configuration and compliance data from MULTIPLE accounts and regions into one central account, enabling org-wide compliance reporting from a single view.

AWS X-Ray visual graph of an application showing each service/component a request passes through (API Gateway → Lambda → DynamoDB → SQS …) with latency and error rates per node — used to pinpoint the bottleneck or failing component across microservices.

AWS X-Ray feature that automatically detects anomalies (latency or error-rate spikes) in trace data and sends notifications via SNS/EventBridge — answers "automatic anomaly detection with notifications" for distributed apps.

AWS PaaS that deploys and manages a web application from your code — it auto-provisions the underlying infrastructure (EC2, ASG, ELB, health monitoring) using CloudFormation under the hood. "Deploy app fast without managing infra"; you keep full control of the resources it creates.

Beanstalk deployment policy — deploys the new version to ALL instances simultaneously. Fastest + cheapest, but causes a short downtime (app unavailable while instances update). Pick when "fastest deploy + can tolerate brief downtime".

Beanstalk deployment policy — deploys the new version one batch of instances at a time. No downtime, no extra cost, but capacity is REDUCED during the deploy (a batch is out of service while updating). Failed batch runs the new version; rollback = manual redeploy.

Beanstalk deployment policy — launches an EXTRA batch of instances first, then does a rolling update, so FULL capacity is maintained the entire time. Slower than plain Rolling. Pick when "no downtime AND maintain full capacity" at low cost.

Beanstalk deployment policy — deploys the new version to a brand-new set of instances in a SECOND Auto Scaling group; only after they pass health checks does traffic shift over. Safest in-place option; rollback is quick (just terminate the new instances). Slowest, and briefly doubles instance count.

Beanstalk canary deployment policy — deploys the new version to fresh instances and routes a configurable PERCENTAGE of incoming traffic to them for evaluation, keeping the rest on the old version. Rollback = reroute traffic + terminate new instances.

The daemon that runs on each instance of a Beanstalk Worker environment tier — it polls the environment's SQS queue and POSTs each message to your application over local HTTP. This is how a Worker tier processes background/async jobs from a queue (vs the Web Server tier which handles inbound HTTP).

A Beanstalk environment type for background/async job processing — instances run the sqsd daemon that reads messages from an SQS queue and forwards them to your app. Contrast Web Server tier (handles HTTP requests behind an ALB). Exam keyword "process background jobs from a queue" → Worker tier.

A folder of YAML/JSON config files in a Beanstalk source bundle that customize the environment's resources and options (env vars, packages, instance type, additional AWS resources) without leaving Beanstalk — Infrastructure-as-Code scoped to your Beanstalk app.

Visualize, understand, and FORECAST AWS spend over time with filters by service/tag/account. Analysis & forecasting tool — NOT alerting (use Budgets).

Set custom cost/usage thresholds and get ALERTED (or trigger actions) when forecast or actual spend exceeds them. Proactive alerting — NOT historical analysis (use Cost Explorer).

CUR — the most detailed, line-item billing data AWS produces, delivered to S3 for deep analysis (e.g. via Athena/QuickSight). Granular raw data, not a dashboard.

Tags (user-defined or AWS-generated) activated in the billing console so costs can be grouped and reported by project, team, or environment.

AWS Organizations feature where one management (payer) account pays for all member accounts; combined usage shares volume pricing tiers and unused Reserved Instances / Savings Plans across accounts. Free. Discounts shared org-wide — restricting member actions is SCPs, not billing.

AWS Budgets capability that automatically responds when a threshold is crossed — apply an IAM policy or SCP, or stop EC2/RDS instances — turning a budget alert into an enforcement control.

ML-powered AWS Cost Management feature: create a cost monitor → ML detects unusual/anomalous spend (accounts for seasonality) → alert via email/SNS → analyze root cause (account, service, Region, usage type). NOT fixed budget thresholds (Budgets) and NOT CloudWatch EstimateCharges (cannot distinguish unusual vs normal growth). Exam: "unusual spending patterns / alert departments" → create cost monitor in Billing console.

The single AWS Organizations account that pays all bills (a.k.a. PAYER account). Open Cost Explorer here + Group by Linked Account to see every member account's cost in one place — no need to log into each account.

A member account inside an AWS Organization. In Cost Explorer (run from the Management/payer account) "Group by Linked Account" splits cost per account — the standard answer for "combined/consolidated cost across all accounts".

Newer name for the AWS Cost and Usage Report (CUR) delivery — scheduled, line-item billing data exported to S3 (CSV/Parquet) for SQL/BI analysis via Athena or QuickSight.

The Cost Explorer service category where NAT Gateway, EBS volumes, EIP, and data-transfer charges land — NOT under "EC2-Instances". To find NAT GW cost: filter Service = EC2-Other, Group by Usage Type.

Cost Explorer Usage Type for NAT Gateway hourly rental (~$0.045/hr). Paired with NatGateway-Bytes (data processed) — together they are the whole NAT GW bill.

Cost Explorer Usage Type for NAT Gateway data-processing charge (~$0.045/GB). The per-GB half of the NAT GW bill; heavy S3/DynamoDB traffic should use a Gateway VPC Endpoint to avoid it.

EC2 in a public subnet used as the only SSH/RDP entry point into private subnet instances — connect to bastion first, then hop to private instances

Another name for a bastion host — a hardened EC2 in a public subnet that you jump through to reach private subnet instances

Static public IPv4 address allocated to your AWS account — stays fixed until released, survives instance stop/start; NAT Gateway requires one

Authorised simulated attack to find vulnerabilities — AWS allows pentest on 8 services (EC2, RDS, CloudFront, Aurora, API GW, Lambda, Lightsail, Elastic Beanstalk) without prior approval

AWS Acceptable Use Policy — defines what is permitted and prohibited on AWS infrastructure, including security testing rules

DR strategy with highest RTO/RPO and lowest cost. Data backed up to DR region; entire infrastructure must be redeployed during disaster. Best for non-critical workloads or data protection only.

DR strategy: core data continuously replicated to DR region, minimal infrastructure pre-provisioned (switched off). Scale up only when disaster strikes. Lower RTO than Backup & Restore, higher than Warm Standby.

DR strategy: scaled-down but fully functional copy of production running in DR region at all times. Scale up to full capacity during failover. Faster RTO than Pilot Light, costs more.

Multi-Site DR strategy: full production workload running in multiple AWS Regions simultaneously. Traffic load-balanced across regions. Lowest RTO/RPO (near zero), highest cost. Also called Hot Standby.

DR category for Backup & Restore, Pilot Light, and Warm Standby — the DR region does not serve full production traffic until failover. Cheaper than active/active because less compute runs continuously.

DR category for Multi-Site Active/Active — both regions run full production capacity and serve live traffic simultaneously. Highest cost, near-zero RTO/RPO.

Infrastructure as Code — managing and provisioning infrastructure through machine-readable configuration files (e.g. CloudFormation, Terraform) instead of manual processes. Enables repeatable, version-controlled deployments.

Deployment strategy with two identical environments (Blue = current, Green = new). Traffic switched from Blue to Green after testing. Instant rollback by switching back. Zero downtime deployments.

Gradual traffic shift to a new version — e.g. 5% of users get v2, 95% get v1. Monitor for errors, then increase percentage. Reduces blast radius of bad deployments.

Pattern where one SNS topic delivers messages to multiple SQS queues simultaneously. Decouples producers from consumers. E.g. one S3 upload event triggers 3 different Lambda functions via SNS→SQS.

Architecture pattern where services communicate by producing and consuming events, not direct calls. Services are loosely coupled. E.g. S3 upload → EventBridge → Lambda → SQS → EC2.

Pattern letak SQS queue antara producer (app) dan consumer (DB/worker) untuk SERAP lonjakan beban. Producer campak request masuk queue laju-laju; consumer proses ikut kadar yang ia MAMPU (tak kena banjir). Buffer ni lindungi backend (cth RDS hampir cecah IOPS limit, atau write spike masa product launch) tanpa perlu vertical scaling. Exam keyword: "write-heavy spike / smooth out load / nearing IOPS limit / cost-effective" → SQS buffer. Beza dgn Read Replica (scale READ je, BUKAN write).

SQS CloudWatch metric = bilangan mesej yang TENGAH BERATUR & visible (belum diproses, bukan in-flight). Metrik untuk queue-based scaling: bila naik → consumer (EC2/ECS) kena scale out. Bukan CPU/Memory (yang buta pada queue depth — container proses satu-satu, CPU kekal rendah walau ribuan mesej sangkut).

Queue-based scaling metric = ApproximateNumberOfMessagesVisible ÷ bilangan consumer (ECS target capacity / EC2 count). Berapa mesej beratur per pekerja — bila melebihi target, auto-scaling scale out tambah pekerja. Custom metric untuk ASG Target Tracking bila scaling consumer SQS. Keyword: scale based on SQS queue backlog → backlog per task, BUKAN CPU/Memory.

Property where an operation produces the same result regardless of how many times it is called. Critical for distributed systems — if a Lambda is retried, it should not double-process an order.

Ability to automatically scale resources UP during peak demand and scale DOWN when demand drops. Distinct from scalability (which just means ability to scale up). Elasticity = auto up + auto down.

Ability of a system to continue operating correctly despite the failure of one or more components — server mati pun app tak down. Achieved through redundancy (Multi-AZ, Multi-Region), circuit breakers, and graceful degradation. Analogi: run-flat tyre — tayar bocor pun kereta terus jalan sampai jumpa kedai. Exam: "fault-tolerant + lowest cost" → Spot Instances (interruptible, can resume); "handle spike + stay fault-tolerant + cheap" → Auto Scaling dengan Mixed Instances Policy (On-Demand baseline + Spot), BUKAN Spot 100% (semua boleh kena rampas serentak).

System stays up with MINIMAL downtime — when a component fails, a standby takes over after a short failover (~seconds to minutes). There is a small gap. Achieved via Multi-AZ, redundancy, eliminating single points of failure. Differs from Fault Tolerance, which is ZERO downtime. Exam: "minimize downtime / automatic failover / eliminate SPOF" → HA.

Ability to handle a growing load by adding capacity. Vertical (scale up = bigger instance) or horizontal (scale out = more instances). Scalability = CAN grow; Elasticity = grows AND shrinks automatically. Exam: "handle increased load / grow capacity" → scalability.

Scale Up — increase the size of a single resource (e.g. EC2 from 8 GB → 32 GB RAM, or a bigger RDS instance class). Usually needs a stop/restart and has a hardware ceiling. Contrast: Horizontal Scaling.

Scale Out — add more instances of the same resource that work together (e.g. 1 EC2 → 5 EC2 behind a load balancer). The preferred AWS pattern for elasticity and fault tolerance (no single big box to fail). Driven by Auto Scaling Groups.

AWS is responsible for security OF the cloud (physical infra, hardware, hypervisor). Customer is responsible for security IN the cloud (data, OS patches, IAM config, application security, encryption).

No servers to manage — AWS handles provisioning, scaling, patching. Pay only for what you use. Examples: Lambda (compute), Fargate (containers), DynamoDB (database), Aurora Serverless (DB), S3 (storage).

Architecture where an application is broken into small, independent services each with a single responsibility. Services communicate via APIs or events. Each can be deployed, scaled, and updated independently. Analogi: food court banyak gerai berasingan — gerai mee tutup, gerai lain tetap jalan. Lawan [[Monolithic]].

Satu aplikasi besar di mana SEMUA fungsi (login, payment, profil, report) tergabung jadi SATU ketul kod yang deploy sekali gus. Analogi: kedai serbaneka satu bangunan tanpa dinding — satu bahagian terbakar (dapur), seluruh kedai tutup; susah scale satu bahagian je. Lawan [[Microservices]] (food court banyak gerai). Exam: "legacy monolithic / tightly-coupled / modernize" → pecah ke microservices (ECS/EKS/[[Fargate]]/Lambda) + decouple guna SQS/SNS.

Sistem lama/warisan yang masih dipakai tapi guna teknologi ketinggalan zaman, selalunya jalan on-premise. Analogi: kereta model lama — masih boleh jalan tapi takde ciri moden, susah cari alat ganti. Exam: "legacy application on-premises" biasanya soalan nak kau migrate/modernize ke AWS — lift-and-shift dengan [[MGN]], atau re-architect ke serverless/containers/managed services untuk kurangkan operational overhead.

Strategi migration "rehost" — angkat aplikasi sedia ada dari on-prem dan pindah ke AWS SEPERTI ADANYA (tanpa ubah kod/architecture). Paling cepat & rendah risiko, tapi tak dapat manfaat penuh cloud. Tool utama = [[MGN]] (replicate server). Lawan: re-platform (ubah sikit, cth pindah DB ke [[RDS]]) atau re-architect (rombak penuh ke microservices/serverless). Exam: "migrate quickly / minimal changes / minimal downtime" → lift-and-shift (MGN); "modernize / reduce operational overhead" → re-architect.

Packaging an application and all its dependencies into a portable container image. Containers run consistently across environments. Docker is the standard format; ECS and EKS orchestrate containers on AWS.

A platform that gives frontend/mobile developers ready-made backend building blocks — auth, database, storage, serverless functions — so they ship apps without managing infrastructure. Google Firebase is the classic example; AWS Amplify is the AWS equivalent (wrapping Cognito, DynamoDB/AppSync, S3, Lambda). Exam: "build a mobile/web app quickly with auth + NoSQL, no cloud management" → Amplify.

Latency when Lambda creates a new execution environment from scratch (download code, initialize runtime + init code). Adds 100ms–1s+ delay; worse for heavy runtimes like Java. Mitigated by SnapStart (Java/Python/.NET, cheap) or Provisioned Concurrency (any runtime, paid). Note: Lambda Layers do NOT reduce cold start.

Lambda feature that takes a Firecracker microVM snapshot of the already-initialized execution environment (at version publish), caches it, then resumes from the snapshot instead of cold-initializing — cutting startup to sub-second. Supports Java 11+, Python 3.12+, .NET 8+ ONLY (no Node.js/Ruby/OS-only/container). Much cheaper than Provisioned Concurrency (no 24/7 warm cost). Cannot combine with Provisioned Concurrency, EFS, or /tmp >512MB; works only on published versions/aliases. Exam: "Java cold start + most cost-effective" → SnapStart.

Lambda feature that pre-initializes a specified number of execution environments, eliminating cold starts. Pay extra (hourly) for pre-warmed capacity — works on ANY runtime. Use for latency-sensitive workloads with predictable spikes, or runtimes SnapStart does not support (Node.js, Ruby, container images).

Lambda resource that POLLS a stream/queue source (SQS, Kinesis, DynamoDB Streams) and invokes your function in batches — the source does not push, Lambda pulls. Controls batch size, batching window, and concurrency. Contrast with push sources (S3, SNS, API Gateway) that invoke Lambda directly.

Routes the result of an ASYNCHRONOUS Lambda invocation (onSuccess / onFailure) to an SQS queue, SNS topic, another Lambda, or EventBridge. Richer alternative to a Dead Letter Queue (DLQ) — carries full invocation context, not just the failed event.

Sets the maximum concurrent executions for a specific Lambda function (throttles above this limit). Also guarantees that capacity is reserved — other functions cannot use it. Setting to 0 = disable function.

A .zip archive containing libraries, runtime, or other dependencies shared across multiple Lambda functions. Reduces deployment package size. Up to 5 layers per function.

Serverless compute engine for containers — runs ECS tasks or EKS pods without managing EC2 instances. AWS manages the underlying infrastructure. Pay per vCPU and memory used by each task.

Fully managed service for running batch / long-running compute jobs at scale. You submit jobs to a [[Job Queue]]; Batch provisions, scales, and tears down the [[Compute Environment]] (EC2 or [[Fargate]], can use [[Spot]]) automatically. No 15-minute limit like Lambda. Batch itself is free — pay only for the underlying compute.

In AWS Batch, where submitted jobs wait (with priority) until a [[Compute Environment]] has capacity to run them. A queue maps to one or more compute environments.

In AWS Batch, the set of compute resources (managed EC2/[[Fargate]] or unmanaged) that Batch provisions to run jobs. Can be configured to use [[Spot]] Instances for big savings.

In AWS Batch, the blueprint for a job — which container image to run, vCPU/memory, environment variables, and the IAM role. Analogous to an ECS [[Task Definition]].

Controls how EC2 instances are placed on physical hardware. Cluster = same rack, low latency HPC. Spread = different racks, max resilience. Partition = groups on separate partitions for large distributed apps.

Container untuk DNS record satu domain (cth example.com) dalam Route 53. PUBLIC hosted zone = record untuk domain internet awam (resolve kat luar). PRIVATE hosted zone = record HANYA untuk VPC kau (resolve dalaman, orang luar tak nampak — sesuai internal apps/database, split-horizon). Satu domain = satu hosted zone. Exam: "internal DNS name dalam VPC / private domain untuk app dalaman" → private hosted zone.

Blueprint/resipi EC2 yang simpan config (AMI, instance type, key pair, security group, user data, IAM role). ASG guna launch template untuk launch instance baru. Ganti Launch Configuration (legacy). Boleh version. Exam: "ASG launch instance guna template" → Launch Template (bukan Configuration yang legacy).

ASG feature: PAUSE instance dalam wait state (default 1 JAM) sebelum launch selesai atau sebelum terminate. Masa pause ni kau boleh invoke Lambda / connect ke instance untuk copy data, drain, atau install software. Notifikasi via EventBridge/SNS. Exam: "copy data before instance termination / data loss on scale-in / custom action sebelum terminate" → Lifecycle Hooks (bukan cooldown, bukan termination policy).

API Gateway CloudWatch logging yang tangkap request & response PAYLOADS + error traces untuk debug "apa jadi" dalam invocation. Bezakan dari ACCESS logging (rekod siapa akses API + method) dan CloudTrail (audit API call AWS, BUKAN payload app). Exam: "log request & response payloads + error traces" → CloudWatch EXECUTION logging.

Open API specification (dulu Swagger) — format piawai YAML/JSON untuk tulis blueprint/dokumentasi API (endpoints, methods, auth). BUKAN servis. Kau import fail OpenAPI ke Amazon API Gateway → ia auto-provision endpoints ikut blueprint. Exam: "standardize API docs + build API from blueprint" → import OpenAPI definition ke API Gateway.

AWS can reclaim Spot Instances with 2-minute warning when capacity is needed. Applications must handle interruption gracefully. Use Spot for fault-tolerant, stateless, or checkpointable workloads.

Amazon Resource Name — unique identifier for every AWS resource. Format: arn:partition:service:region:account-id:resource. Example: arn:aws:s3:::my-bucket. Used in IAM policies to specify exact resources.

Entity that can make requests to AWS: IAM user, IAM role, AWS service (e.g. Lambda), federated user, or AWS account. Specified in resource-based policies to define WHO can access the resource.

IAM policy attached to an IAM identity (user, group, role). Defines what actions that identity can perform on which resources. Most common policy type. Can be AWS managed, customer managed, or inline.

IAM policy attached to a resource (S3 bucket, SQS queue, KMS key, Lambda). Defines who can access the resource and what they can do. Enables cross-account access without requiring role assumption. For cross-account S3/SQS/KMS you need BOTH this (on the resource, with a [[Principal]]) AND an [[Identity-based policy]] on the source side — set one side only and the request is denied.

In a cross-account scenario, the AWS account where the user/app (Lambda, EC2, IAM role) that INITIATES the action lives. It must have an [[Identity-based policy]] (IAM policy) allowing the action (e.g. sqs:SendMessage) toward the resource in the [[Destination Account]].

In a cross-account scenario, the AWS account where the RESOURCE (S3 bucket, SQS queue, KMS key) lives. It must have a [[Resource-based policy]] (bucket/queue/[[Key Policy]]) naming the [[Source Account]] as [[Principal]]. Both the source IAM policy AND this resource policy must allow — the "two keys" rule.

The resource-based policy attached directly to a KMS key — the ROOT of trust for that key. By default it must explicitly grant access (or delegate to IAM via Principal = account-root). Unlike S3/SQS, an IAM Allow alone is NOT enough: if the key policy does not permit it, even an admin is blocked. Cross-account KMS = source IAM policy (kms:Decrypt) + this key policy naming the source account.

IAM managed policy that sets the MAXIMUM permissions an IAM entity (user or role) can have. Even if identity-based policies grant more, the boundary caps it. Does not grant permissions by itself.

Standalone IAM policy that can be attached to multiple users, groups, or roles. AWS managed = created by AWS (e.g. AdministratorAccess). Customer managed = created by you. Easier to reuse and update than inline.

IAM policy embedded directly into one specific user, group, or role. Not reusable. Deleted when the entity is deleted. Use sparingly — managed policies are preferred for maintainability.

Resource-based policy on an IAM role that defines which principals (services, accounts, users) can ASSUME the role. Every role has exactly one trust policy. Example: allow EC2 service to assume the role.

A predefined IAM role linked directly to one AWS service (e.g. Elastic Load Balancing, Lex). AWS creates and manages its permissions; you cannot edit them. Lets the service perform actions on your behalf. Contrast with a normal service role, whose permissions you control.

In IAM Identity Center (SSO), a reusable collection of IAM policies that acts as a "role template". When assigned, Identity Center renders it as an IAM role inside each target AWS account. Edit it once → applies across every assigned account. The multi-account answer vs creating IAM roles per account.

In IAM Identity Center, the mapping of (User or Group) × ([[Permission Set]]) × (AWS Account) that grants who can access which account with what permissions. Removing the assignment instantly revokes that access across the org.

Using the temporary credentials from one assumed role to assume ANOTHER role (AssumeRole again). Common in cross-account access. Note: when you chain roles, the session is capped at 1 hour — requesting a longer DurationSeconds fails.

A policy statement with "Effect": "Deny". Always wins — overrides any Allow in any policy type (identity, resource, SCP, boundary, session). The strongest force in IAM evaluation. Exam: Allow + Deny on the same action = DENIED.

The default outcome when no policy explicitly Allows an action (and nothing explicitly Denies it either). Every request starts as an implicit Deny; you need an explicit Allow to permit it. Weaker than an explicit Deny.

An inline policy passed at the moment you AssumeRole (or get federation token) to further RESTRICT that session. Effective permissions = intersection of the role policy and the session policy — it can only narrow, never expand, the role’s permissions.

Organizational Unit — a container for AWS accounts within AWS Organizations (macam folder dalam laptop — kumpul akaun serupa supaya senang tampal SCP pukal). SCPs can be applied to OUs to restrict all accounts within (termasuk akaun baru yang masuk kemudian). OUs can be nested. Management account is at the root.

When IAM evaluation results in Deny. Explicit Deny always overrides Allow. A missing Allow = implicit Deny. Order: explicit Deny → SCP limit → permissions boundary → resource policy → identity policy.

AWS technology powering Interface VPC Endpoints. Creates private connectivity to AWS services or third-party services via ENIs in your VPC. Traffic never leaves AWS network. Used by all Interface endpoints. Two sides: CONSUMER (Interface Endpoint to use a service) and PROVIDER (Endpoint Service + NLB to expose your own service).

PrivateLink provider-side resource: you put your application behind a Network Load Balancer (or GWLB) and register it as an Endpoint Service so consumers in other VPCs/accounts connect via Interface Endpoints — no VPC Peering, no internet, CIDRs may overlap. Basis of AWS Marketplace SaaS private offerings.

Gateway Load Balancer Endpoint — the third VPC endpoint type (also PrivateLink-powered). Routes traffic to a fleet of inline security appliances (firewall, IDS/IPS) fronted by a Gateway Load Balancer, then back to its destination.

Traffic flowing OUT of your network or VPC to the internet or another network. Egress charges apply when data leaves AWS. NAT Gateway, Internet Gateway, and Direct Connect all handle egress traffic.

Traffic flowing INTO your network or VPC from the internet or another network. Security groups and NACLs control ingress. No AWS charge for ingress data transfer.

Random high-numbered ports (1024–65535; Linux 32768–60999, Windows 49152–65535) a server uses to send REPLY traffic back to a client. Because a [[NACL]] is [[stateless]], you must add an OUTBOUND allow rule for this range — otherwise return traffic is blocked even when the inbound request was allowed. [[stateful]] Security Groups handle this automatically.

Fully Qualified Domain Name — complete domain name specifying exact location in DNS hierarchy. Example: my-alb-1234567890.us-east-1.elb.amazonaws.com. Alias records in Route 53 can point to FQDNs.

Time delay between a request being sent and the response being received. Affected by geographic distance, network congestion, processing time. Reduce with: CloudFront, Global Accelerator, multi-region deployments.

Amount of data transferred per unit of time (MB/s, Gbps) or records processed per second. Higher throughput = more capacity. EBS st1 optimized for throughput; EBS io2 optimized for IOPS (random I/O).

Network Load Balancer — Layer 4 (TCP/UDP) load balancer. Handles millions of requests per second with ultra-low latency. Has static IP per AZ. Use for: non-HTTP traffic, static IP requirement, extreme performance needs.

Classic Load Balancer — legacy (Layer 4 + Layer 7). Use ALB or NLB instead for new deployments. Still used for EC2-Classic or very old apps.

ALB/NLB routing destination — a group of registered targets (EC2 instances, IPs, Lambda functions, other ALBs). Health checks run against each target. Listener rules route traffic to specific target groups by path/host/header.

The ALB/NLB component that listens for incoming connections on a specific port + protocol (e.g. HTTP:80, HTTPS:443). The HTTPS listener is where you attach the ACM certificate for SSL/TLS termination.

Ordered conditions on an ALB listener that decide which target group a request goes to, based on path, host header, HTTP header, query string, or source IP. Evaluated by priority, with a default rule as fallback.

What an ALB/NLB target group can point to: instance (EC2 by instance ID), ip (any IP in a peered VPC or on-prem via DX/VPN), or lambda (an ALB can invoke a Lambda function directly). One target group holds one type.

Periodic probe an ALB/NLB sends to each target (e.g. GET /health). A target must pass the healthy threshold to receive traffic; failing the unhealthy threshold removes it from rotation so traffic only goes to working servers — the basis of high availability.

Decrypting HTTPS at the load balancer: the client→ALB hop is encrypted (ACM cert on the HTTPS listener), while ALB→target can run plain HTTP inside the private subnet — offloading crypto from the servers. Use HTTPS all the way to the target for end-to-end encryption.

Time (default 300s, range 0–3600) Elastic Load Balancing waits after a target is deregistered before fully removing it: it stops sending NEW requests but lets in-flight requests finish (state draining → unused). Prevents dropped connections / 5xx errors during scale-in, deploys, or Spot reclamation. Called "Connection Draining" on the Classic Load Balancer.

The Classic Load Balancer name for what ALB/NLB call Deregistration Delay — finish in-flight requests to a target being removed before terminating it.

Auto Scaling feature that proactively launches a replacement EC2 Spot Instance when AWS signals an elevated risk of interruption (before the 2-minute termination notice), so the ASG + ALB can drain the doomed instance gracefully and keep capacity.

HTTP header an ALB (Layer 7) adds to carry the original client IP to the backend, since the target otherwise sees the ALB's IP. An NLB (Layer 4) preserves the client IP natively, so no header is needed.

Time-limited URL that grants temporary access to a private S3 object without requiring AWS credentials. Generated using AWS SDK with an expiry time (max 7 days). Used to share private files securely with external users.

S3 feature that preserves every version of an object. When an object is overwritten or deleted, the previous version is retained. Enables recovery from accidental deletes or overwrites. Required for S3 Object Lock.

Automated rules to transition S3 objects between storage classes (downward waterfall only: Standard → IA/Intelligent-Tiering/Glacier tiers) or expire (delete) them after a defined age in days. No max day limit for transitions — can set 730 days (2 years). Example: transition to Standard-IA or Glacier after 2 years. Reduces storage costs automatically. NOT the same as EFS lifecycle (max 365 days).

Allowed one-way lifecycle transitions between S3 storage classes — always downward from hot to cold (Standard at top → Deep Archive at bottom). Each tier can skip to lower tiers. Used in exam for "move old files to cheaper class" — S3 Lifecycle can do 730+ days; EFS lifecycle cannot (max 365 days).

EFS feature that automatically moves files to Infrequent Access (IA) storage class after a period of no access. Transition period: minimum 1 day, maximum 365 days. Exam trap: cannot meet "older than 2 years (730 days)" requirement — use S3 Lifecycle instead for long-term age-based transitions.

Speeds up S3 uploads by routing traffic through CloudFront edge locations instead of directly to S3. Data enters AWS network at the nearest edge point. Useful for large file uploads from distant locations.

Same-Region Replication — automatically copies S3 objects between buckets in the SAME region. Use for: compliance (separate account copy), log aggregation, live replicas for test environments.

DynamoDB Accelerator — fully managed in-memory cache for DynamoDB. Microsecond read latency (vs millisecond for DynamoDB). Drop-in compatible, no application code changes. Only for READ caching.

Time To Live — DynamoDB feature that auto-deletes items after a specified timestamp. No extra cost. Items expired within ~48 hours. Useful for session data, temp records, log expiry. Does NOT consume write capacity.

Dead Letter Queue — SQS queue that receives messages which failed processing after the maximum number of retries (maxReceiveCount). Used for debugging, manual reprocessing, alerting. Prevents poison-pill messages blocking the queue.

Threshold set in a queue's RedrivePolicy — the number of times a message can be received (ReceiveCount) before SQS auto-moves it to the Dead-Letter Queue. E.g. maxReceiveCount=3 → after the 3rd failed processing attempt, the message goes to the DLQ. Tunes how many retries before a message is treated as "poison".

Feature to move messages from a Dead-Letter Queue back to the source (or another) queue for reprocessing — used after a bug is fixed. Done via the SQS console redrive UI or the StartMessageMoveTask API, with no custom code to shuffle messages.

A corrupted/malformed message that consistently fails processing no matter how many times it is retried. Without a DLQ, the consumer keeps re-receiving and re-failing on it, burning throughput and cost while blocking healthy messages. The DLQ (triggered by maxReceiveCount) isolates it.

First-In-First-Out SQS queue. Guarantees: (1) exact ordering of messages, (2) exactly-once processing. Max 300 transactions/second (3,000 with batching). Use when order matters (e.g. financial transactions, sequential steps).

Fully managed, MongoDB-compatible document database. Stores JSON/BSON documents in collections; existing MongoDB apps connect via the same driver without code changes. Compute and storage are separate (storage auto-scales 10GB→64TB, 6 copies/3 AZ like Aurora). Instance-based billing, not serverless. Keyword "migrate MongoDB" → DocumentDB.

Fully managed graph database for highly connected data. Stores nodes + edges and is optimized to traverse deep relationships fast — used for social networks, fraud rings, recommendations, knowledge graphs. Supports [[property graph]] ([[Gremlin]]/[[openCypher]]) and [[RDF]] ([[SPARQL]]). Keyword "relationship/connected/mutual friends/fraud ring" → Neptune.

Fully managed, serverless Apache Cassandra-compatible database. Uses [[CQL]] and a [[wide-column]] model, so existing Cassandra apps migrate without rewriting queries. No clusters/nodes to manage; data replicated across 3 AZs. Keyword "Cassandra/CQL/wide-column" → Keyspaces (not DynamoDB).

Graph traversal query language (from Apache TinkerPop) used by [[Amazon Neptune]] on a [[property graph]]. You "walk" from node to node along edges — e.g. g.V().has(name,"A").out("knows") = "friends of A". Good for social/fraud traversal queries.

Declarative, pattern-matching graph query language (originally from Neo4j) supported by [[Amazon Neptune]] on a [[property graph]]. Reads like ASCII-art: MATCH (a)-[:KNOWS]->(b). Easier to read than [[Gremlin]] and eases migration from Neo4j.

W3C-standard query language for [[RDF]] graphs, supported by [[Amazon Neptune]]. Queries triples (subject-predicate-object). Use for knowledge graphs and linked open data. The RDF counterpart to [[Gremlin]]/[[openCypher]] which target property graphs.

Graph data model where both nodes and edges can carry properties (key-value pairs), e.g. node Person{name} —[:KNOWS{since}]→ Person. Queried with [[Gremlin]] or [[openCypher]] in [[Amazon Neptune]]. Contrast with [[RDF]] triples.

Resource Description Framework — a graph model that stores data as triples (subject-predicate-object), e.g. "Ali knows Abu". W3C standard, used for knowledge graphs and linked data. Queried with [[SPARQL]] in [[Neptune]]. Contrast with [[property graph]].

Cassandra Query Language — the SQL-like language used by Apache Cassandra and [[Amazon Keyspaces]]. Because Keyspaces speaks CQL, an existing Cassandra app migrates without rewriting queries. The keyword "CQL" in an exam question points to Keyspaces.

NoSQL data model where each row can have a different, large set of columns grouped into column families (rows are sparse and very wide). Used by Apache Cassandra, [[Amazon Keyspaces]], and [[HBase]]. Distinct from key-value (DynamoDB) and document (DocumentDB).

In Cassandra/[[Amazon Keyspaces]], the top-level container for tables — analogous to a "database" or schema in SQL. It defines replication settings for the tables inside it. (Amazon Keyspaces the service is named after this concept.)

Neptune Capacity Unit — the scaling/billing unit for [[Neptune]] Serverless. Capacity auto-scales up and down in NCUs (each ≈ 2 GiB memory + matching CPU/network) to follow graph workload, so you pay for the capacity actually used instead of a fixed instance size.

A cluster storage configuration (DocumentDB, Aurora) where you pay a higher instance + storage rate but I/O requests are FREE. Cheaper overall for I/O-heavy workloads vs the standard config that charges $0.20 per million I/O requests; predictable billing with no I/O line item.

Serverless, purpose-built time-series database for data where every point has a timestamp and arrives fast (IoT sensors, app/DevOps metrics). Auto-tiers data from [[memory store]] (recent, fast) to [[magnetic store]] (old, cheap), and offers built-in time functions (interpolation, smoothing). Keyword "time-series / IoT telemetry / metrics over time" → Timestream, not DynamoDB or Redshift.

The hot tier of [[Amazon Timestream]] holding the most recent data in memory — fast for writes and latest-value queries, but priced per GB-hour (relatively expensive), so retention here is kept short.

The cold tier of [[Amazon Timestream]] holding older data on cheaper storage (per GB-month) for historical queries. Timestream auto-moves data from [[memory store]] to magnetic store once it passes the retention period you set.

Durable in-memory database (Valkey / Redis OSS compatible) that can serve as a PRIMARY database, not just a cache. Microsecond reads + single-digit-ms writes, with durability from a [[Multi-AZ transactional log]] (writes are logged across AZs before acknowledgment). Contrast with ElastiCache (a cache whose data can be lost) and [[DAX]] (a cache specific to DynamoDB).

The durability mechanism in [[Amazon MemoryDB]]: every write is recorded to a distributed transaction log spanning multiple Availability Zones before being acknowledged. If a node fails, no committed data is lost and failover recovers from the log — this is what lets an in-memory store act as a durable primary database.

Open-source, Redis-compatible in-memory data store (a community fork of Redis OSS). Supported by [[Amazon MemoryDB]] and ElastiCache, so existing Redis clients/commands work without rewrites.

Managed message broker for ActiveMQ and RabbitMQ. Supports AMQP, MQTT, STOMP, OpenWire protocols. Use for lift-and-shift migration of existing on-premises messaging apps to AWS without code changes. New cloud-native apps should use SQS/SNS instead.

SNS subscription filter policy (JSON) that lets subscribers receive only messages matching specific attribute criteria. Without filtering, all subscribers get all messages. Reduces unnecessary processing and costs.

SNS topic with strict message ordering and exactly-once delivery. Pairs with SQS FIFO queues for ordered fan-out. Max 300 publishes/sec (3,000 with batching). Use when downstream processing requires message order.

EventBridge feature that auto-discovers and stores event schemas from your event bus. Generates code bindings (Java, Python, TypeScript) from schemas. Speeds up development by providing typed event structures.

Point-to-point integration connecting a source (SQS, Kinesis, DynamoDB Streams) directly to a target with optional filtering, enrichment, and transformation. Simpler alternative to writing Lambda glue code for source-to-target integrations.

Serverless scheduler for one-time or recurring tasks (cron/rate expressions). Replaces CloudWatch Events scheduled rules. Supports timezone-aware scheduling, flexible time windows, and 14,000+ targets.

AWS Solution (NOT a native service) — deploy the ready-made CloudFormation template to auto START/STOP tagged EC2 and RDS instances on a schedule (e.g. weekdays office hours only). Architecture: EventBridge timer → Lambda reads schedules from DynamoDB → start/stop EC2/RDS; uses IAM, KMS, SNS, CloudWatch. Saves ~70% vs 24/7 if used ~50h/week. Exam: "office hours / weekday only / minimal ops overhead" → Instance Scheduler CFN template. NOT RI/Savings Plans (24/7 hourly commit). NOT Compute SP for RDS (RDS not covered). NOT custom CloudWatch CPU alarm + Lambda (more ops + RDS CPU stop risk).

Step Functions workflow type: exactly-once execution, up to 1 year duration, full execution history. Use for long-running, auditable workflows (e.g. order processing, ETL pipelines). Higher cost per state transition.

Step Functions workflow type: up to 5 minutes duration. Two sub-types: Asynchronous Express (at-least-once, fire-and-forget) and Synchronous Express (at-most-once, wait for result). Use for high-volume, short-duration workflows (e.g. IoT data processing, streaming transforms). Lower cost, priced per execution.

Fully managed GraphQL API service with real-time subscriptions (WebSocket), offline data sync with conflict resolution, and resolvers for DynamoDB, Lambda, Aurora, OpenSearch, HTTP. Use for mobile/web apps needing real-time updates or offline capability.

Platform for building fullstack web/mobile apps. Amplify Hosting = Git-based CI/CD + CDN (SSR/SSG/SPA). Backend powered by Cognito (auth), AppSync (API), DynamoDB (data), S3 (storage). Like Heroku/Vercel for AWS.

API query language that lets clients request exactly the data they need in a single query. Unlike REST (multiple endpoints, fixed response shape), GraphQL uses one endpoint with flexible queries. AWS AppSync is the managed GraphQL service.