Glossary
This glossary defines the terms, services, and concepts used throughout the book and on the CLF-C02 exam. Service names are sorted by the word that follows “Amazon” or “AWS”, so Amazon S3 appears under S and AWS Lambda under L. Service features and names change over time, so confirm details in the AWS documentation before relying on them at work. Numbers
7 Rs
The seven migration strategies AWS describes: Retire, Retain, Rehost, Relocate, Replatform, Repurchase, and Refactor (re-architect).
A
Access key
A long-term credential pair (access key ID and secret access key) used to sign programmatic requests to AWS. Avoid them for the root user and prefer roles where possible.
Agility
The ability to experiment and deliver changes quickly because resources can be created and removed in minutes. One of AWS’s six advantages of cloud computing (“increase speed and agility”).
Amazon API Gateway
A managed service for creating, publishing, securing, and monitoring REST, HTTP, and WebSocket APIs, often in front of AWS Lambda.
Application Load Balancer
An Elastic Load Balancing type that routes HTTP and HTTPS traffic at layer 7, with path- and host-based routing.
AWS Application Migration Service
The primary service for lift-and-shift (rehost) migrations of servers to AWS using continuous block-level replication.
AWS Artifact
A self-service portal for AWS’s compliance reports (such as SOC and PCI reports) and for accepting agreements such as the Business Associate Addendum.
Amazon Athena
A serverless, interactive query service that runs standard SQL directly on data stored in Amazon S3. You pay for the data your queries scan.
AWS Audit Manager
A service that continuously collects evidence about your AWS usage and maps it to compliance frameworks to help you prepare for audits.
Amazon Aurora
A MySQL- and PostgreSQL-compatible relational database built for the cloud. It stores six copies of data across three Availability Zones.
Auto Scaling group
A collection of EC2 instances that Amazon EC2 Auto Scaling keeps at a desired size, adding or removing instances based on demand or schedules.
Availability Zone (AZ)
One or more discrete data centers with redundant power, networking, and connectivity within an AWS Region. Each Region has at least three.
B
AWS Backup
A service to centrally manage and automate backups across AWS services.
Bastion host
A hardened server that administrators connect through to reach instances in private subnets. AWS Systems Manager Session Manager can remove the need for one.
AWS Batch
A service that runs batch computing jobs at any scale, provisioning compute for you.
Amazon Bedrock
A fully managed service that offers foundation models from Amazon and other providers (such as Anthropic, Meta, and Mistral AI) through one API for building generative AI applications.
AWS Billing Conductor
A tool for customizing billing data, for example to show pricing to internal teams or end customers in chargeback or reseller scenarios.
Bring your own license (BYOL)
Using existing eligible software licenses on AWS instead of buying license-included instances.
AWS Budgets
A tool that tracks cost or usage against amounts you set and alerts you, or takes actions, when actual or forecasted values cross a threshold.
Business Associate Addendum (BAA)
An agreement required under HIPAA when a customer stores protected health information with AWS. It is accepted through AWS Artifact.
C
Capital expense (CapEx)
Up-front spending on physical assets, such as servers and data centers, that is depreciated over time. AWS Certificate Manager (ACM)
A service that provisions, manages, and renews SSL/TLS certificates for use with AWS services such as Elastic Load Balancing and CloudFront.
Cloud Adoption Framework (AWS CAF)
AWS guidance for cloud transformation organized into six perspectives (Business, People, Governance, Platform, Security, Operations) and four phases (Envision, Align, Launch, Scale).
Cloud computing
The on-demand delivery of IT resources over the internet with pay-as-you-go pricing.
AWS CloudFormation
An infrastructure as code service that creates and manages AWS resources from JSON or YAML templates as stacks.
Amazon CloudFront
AWS’s content delivery network (CDN). It caches and delivers content from edge locations close to viewers to reduce latency.
AWS CloudHSM
Dedicated, single-tenant hardware security modules in the AWS Cloud for generating and using encryption keys under your exclusive control.
AWS CloudShell
A browser-based shell in the AWS Management Console with the AWS CLI already installed and authenticated.
AWS CloudTrail
A service that records API calls and account activity, including who made a request, when, and from where. Event history keeps 90 days of management events.
Amazon CloudWatch
The monitoring service for AWS resources and applications: metrics, alarms, logs, and dashboards.
AWS CodePipeline
A continuous delivery service that automates build, test, and deploy stages of software releases.
Amazon Cognito
Identity for customer-facing web and mobile apps: user sign-up, sign-in, and federation with social and enterprise identity providers.
Compliance program
A certification, attestation, or framework (such as ISO 27001, SOC 2, or PCI DSS) that AWS has been audited against.
Amazon Comprehend
A natural language processing (NLP) service that finds sentiment, key phrases, entities, and language in text.
AWS Compute Optimizer
A service that uses machine learning on utilization metrics to recommend optimal sizes for EC2 instances, Auto Scaling groups, EBS volumes, Lambda functions, and more.
AWS Config
A service that records the configuration of AWS resources over time and evaluates it against rules for compliance.
Amazon Connect
A cloud contact center service for voice and chat customer service.
Consolidated billing
A feature of AWS Organizations that combines the bills of all member accounts and pools usage for volume discounts.
AWS Control Tower
A service that sets up and governs a secure multi-account AWS environment (landing zone) with preconfigured controls.
Cost allocation tag
A tag that you activate in the billing console so that costs can be grouped and filtered by that tag in billing reports. AWS Cost and Usage Report (CUR)
The most detailed set of AWS cost and usage data, delivered as files to Amazon S3. It is now created through AWS Data Exports.
AWS Cost Anomaly Detection
A feature that uses machine learning to detect unusual spending and alert you.
AWS Cost Explorer
A tool to visualize, analyze, and forecast AWS costs and usage, with Reserved Instance and Savings Plans recommendations.
D
AWS Data Exports
The billing feature that delivers cost and usage data, including the Cost and Usage Report, to Amazon S3.
Amazon Data Firehose
A fully managed service (formerly Amazon Kinesis Data Firehose) that captures streaming data and delivers it to destinations such as Amazon S3, Amazon Redshift, and Amazon OpenSearch Service.
AWS Database Migration Service (AWS DMS)
A service that migrates databases to AWS with minimal downtime, between the same or different database engines.
AWS DataSync
An online data transfer service that moves data between on-premises storage and AWS storage services, with scheduling and integrity checks.
Dedicated Host
A physical EC2 server dedicated to your use, which helps with server-bound software licenses and compliance needs.
Dedicated Instance
An EC2 instance that runs on hardware dedicated to a single customer, without the host-level visibility and control of a Dedicated Host.
Amazon Detective
A security service that collects and graphs log data so analysts can investigate the root cause of potential security issues.
AWS Direct Connect
A dedicated private network connection from your premises to AWS, offering more consistent performance than the internet.
Distributed denial of service (DDoS)
An attack that floods a system with traffic from many sources to make it unavailable.
Amazon DocumentDB
A managed document database that is compatible with MongoDB workloads.
Durability
The likelihood that stored data will not be lost. Amazon S3 is designed for 11 nines of durability.
Amazon DynamoDB
A serverless NoSQL key-value and document database that delivers single-digit millisecond performance at any scale.
E
Amazon EBS (Elastic Block Store)
Persistent block storage volumes for EC2 instances. A volume lives in one Availability Zone and keeps its data when the instance stops.
Amazon EC2 (Elastic Compute Cloud)
Resizable virtual servers (instances) in the cloud. A classic example of infrastructure as a service.
Economies of scale
Lower costs per unit that come from operating at very large scale. AWS passes these savings to customers as lower prices.
Amazon ECR (Elastic Container Registry)
A managed registry for storing and sharing container images.
Amazon ECS (Elastic Container Service)
AWS’s own managed container orchestration service. It runs containers on EC2 or on AWS Fargate.
Edge location
A site used by CloudFront and Route 53 (and some other services) to serve users with low latency. There are hundreds worldwide.
Amazon EFS (Elastic File System)
A serverless, elastic NFS file system that many Linux instances and containers can share across Availability Zones. Amazon EKS (Elastic Kubernetes Service)
A managed Kubernetes service that runs the Kubernetes control plane for you.
AWS Elastic Beanstalk
A platform as a service for deploying web applications. You upload code and it handles capacity, load balancing, scaling, and health monitoring.
Elastic IP address
A static public IPv4 address that you can associate with an EC2 instance or network interface.
Elastic Load Balancing (ELB)
A service that automatically distributes incoming traffic across multiple targets, such as EC2 instances, in one or more Availability Zones.
Amazon ElastiCache
A managed in-memory caching service compatible with Valkey, Redis OSS, and Memcached.
Elasticity
The ability to automatically add or remove resources to match demand.
Amazon EMR
A managed big data platform for running frameworks such as Apache Spark and Hadoop.
Encryption at rest
Encrypting stored data, for example in S3, EBS, or RDS, usually with keys managed in AWS KMS.
Encryption in transit
Encrypting data as it moves across a network, usually with TLS (HTTPS).
Amazon EventBridge
A serverless event bus that routes events from AWS services, your applications, and SaaS partners to targets based on rules. It also schedules events.
F
AWS Fargate
A serverless compute engine for containers that works with Amazon ECS and Amazon EKS, so you do not manage servers.
Fault tolerance
The ability of a system to keep operating without interruption when one or more components fail.
Federation
Letting users sign in to AWS with identities from an external identity provider, such as a corporate directory, instead of IAM users.
AWS Firewall Manager
A security management service that centrally configures firewall rules, such as AWS WAF and Shield Advanced protections, across accounts in AWS Organizations.
Foundation model (FM)
A large machine learning model trained on broad data that can be adapted to many tasks, such as text generation. Available through Amazon Bedrock.
Free Tier
AWS’s free offers. Accounts created on or after July 15, 2025 get a free plan with credits of up to 200 USD for up to six months; Always Free offers continue. Older material describes Always Free, 12 Months Free, and Trials.
Amazon FSx
A family of managed file systems: FSx for Windows File Server, FSx for Lustre, FSx for NetApp ONTAP, and FSx for OpenZFS.
G
Generative AI
AI that creates new content, such as text, images, or code, from prompts.
AWS Global Accelerator
A networking service that provides static anycast IP addresses and routes traffic over the AWS global network to optimal endpoints.
AWS Glue
A serverless data integration service for discovering data, maintaining a Data Catalog, and running ETL jobs.
Amazon GuardDuty
A threat detection service that analyzes sources such as CloudTrail events, VPC Flow Logs, and DNS logs to find malicious or unauthorized activity.
H
AWS Health Dashboard
Shows the status of AWS services and, in your account view, events that affect your own resources, such as scheduled maintenance.
High availability
Designing a system to stay accessible with minimal downtime, typically by spreading it across multiple Availability Zones.
Horizontal scaling
Adding or removing instances to handle load (“scaling out” or “scaling in”).
Hybrid cloud
A deployment model that connects on-premises infrastructure with cloud resources.
I
IAM Access Analyzer
An IAM feature that identifies resources shared with external entities and helps validate and refine policies toward least privilege.
IAM credential report
A downloadable report listing all IAM users in an account and the status of their passwords, access keys, and MFA devices.
IAM group
A collection of IAM users that share the permissions attached to the group.
AWS IAM Identity Center
The recommended service (successor to AWS Single Sign-On) for workforce single sign-on to multiple AWS accounts and business applications.
IAM policy
A JSON document that defines permissions by allowing or denying actions on resources.
IAM role
An identity with permissions that can be assumed by users, applications, or AWS services to receive temporary credentials.
IAM user
An identity in an AWS account with long-term credentials for one person or application.
AWS Identity and Access Management (IAM)
The service that controls authentication and authorization in AWS through users, groups, roles, and policies. There is no extra charge for it.
Infrastructure as a service (IaaS)
A cloud model that provides basic building blocks such as virtual servers, storage, and networking, for example Amazon EC2.
Infrastructure as code (IaC)
Defining and provisioning infrastructure with code or templates, such as AWS CloudFormation or the AWS CDK.
AWS Infrastructure Composer
A visual tool (formerly AWS Application Composer) for designing serverless and other applications and generating infrastructure as code.
Amazon Inspector
An automated vulnerability management service that scans EC2 instances, container images in Amazon ECR, and Lambda functions for software vulnerabilities and network exposure.
Instance store
Temporary block storage physically attached to the EC2 host. Data is lost when the instance stops or terminates.
Instance type
A combination of CPU, memory, storage, and networking capacity for an EC2 instance, grouped into families such as general purpose and compute optimized.
Internet gateway
A VPC component that allows communication between resources in public subnets and the internet.
K
Amazon Kendra
An intelligent enterprise search service powered by machine learning.
AWS Key Management Service (AWS KMS)
A managed service for creating and controlling encryption keys, integrated with many AWS services and logged in CloudTrail.
Amazon Kinesis Data Streams
A service for capturing and storing real-time streaming data so that multiple applications can process it.
L
AWS Lake Formation
A service that helps build, secure, and manage data lakes with fine-grained access control.
AWS Lambda
A serverless compute service that runs code in response to events. You pay per request and duration, and each invocation can run for up to 15 minutes.
Latency
The delay between a request and its response. Reduced by placing resources close to users.
Least privilege
Granting only the permissions required to perform a task.
Amazon Lex
A service for building conversational interfaces (chatbots) using voice and text.
Amazon Lightsail
Simple virtual private servers, databases, and networking with predictable monthly pricing, aimed at simple workloads.
Local Zone
An extension of a Region that places compute, storage, and other services close to a large population center for single-digit millisecond latency.
M
Machine learning (ML)
Techniques that let computers learn patterns from data to make predictions or decisions.
Amazon Macie
A data security service that uses machine learning and pattern matching to discover sensitive data, such as personally identifiable information, in Amazon S3.
AWS Management Console
The web-based user interface for accessing and managing AWS services.
AWS Marketplace
A curated digital catalog for finding, buying, and deploying third-party software, data, and services, billed through your AWS bill.
Amazon MemoryDB
A durable, in-memory database compatible with Valkey and Redis OSS.
Amazon MQ
A managed message broker for Apache ActiveMQ and RabbitMQ, useful when migrating existing messaging applications.
Multi-AZ deployment
Running resources, such as an RDS database with a standby, in more than one Availability Zone for high availability. Multi-factor authentication (MFA)
Sign-in that requires a second factor, such as a hardware key, passkey, or authenticator app code, in addition to a password.
N
NAT gateway
A managed service that lets instances in private subnets start outbound connections to the internet while blocking unsolicited inbound connections.
Amazon Neptune
A managed graph database for highly connected data such as social networks, recommendations, and fraud detection.
Network ACL
An optional stateless firewall at the subnet level that supports both allow and deny rules, evaluated in number order.
Network Load Balancer
An Elastic Load Balancing type that routes TCP, UDP, and TLS traffic at layer 4 with very high performance.
O
On-Demand Instance
EC2 capacity paid for by the second or hour with no long-term commitment.
Amazon OpenSearch Service
A managed service for search, log analytics, and observability using OpenSearch.
Operational expense (OpEx)
Ongoing spending on services as they are used, such as monthly cloud bills.
AWS Organizations
A service to centrally manage multiple AWS accounts, with consolidated billing, organizational units, and policies such as SCPs.
AWS Outposts
Fully managed AWS infrastructure installed in your own data center or on-premises location.
P
AWS Partner Network (APN)
The global community of AWS consulting and technology partners that help customers build and migrate on AWS.
Amazon Personalize
A machine learning service that creates real-time personalized recommendations.
Platform as a service (PaaS)
A cloud model where the provider manages the underlying infrastructure and platform so you focus on your application, for example AWS Elastic Beanstalk.
Amazon Polly
A text-to-speech service that turns text into lifelike speech.
AWS Pricing Calculator
A free web tool for estimating the cost of AWS services before you deploy them.
Private subnet
A subnet whose route table has no direct route to an internet gateway.
AWS Professional Services
An AWS team of experts that helps customers achieve outcomes on AWS, often alongside partners.
Public subnet
A subnet whose route table has a route to an internet gateway.
Q
Amazon Q Business
A generative AI assistant that answers questions and completes tasks using a company’s own data while respecting existing permissions.
Amazon Q Developer
A generative AI assistant for software development and for working with AWS resources.
Amazon QuickSight
AWS’s business intelligence service for interactive dashboards and reports, now offered as part of Amazon Quick Suite.
R
Amazon RDS (Relational Database Service)
A managed relational database service for engines such as MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Db2. AWS handles patching, backups, and failover.
AWS re:Post
A community question-and-answer service for AWS topics, moderated with help from AWS experts.
Amazon Redshift
A fully managed, petabyte-scale data warehouse for analytics using SQL.
Refactor
The migration strategy of re-architecting an application to use cloud-native features, such as serverless services.
Region
A physical geographic area containing multiple, isolated Availability Zones. AWS has more than 30 Regions.
Rehost
The “lift and shift” migration strategy: moving an application to AWS without changes.
Amazon Rekognition
A computer vision service that analyzes images and videos to detect objects, faces, text, and unsafe content.
Relocate
The migration strategy of moving workloads to a cloud version of the same platform, such as moving VMware-based virtual machines at the hypervisor level.
Replatform
The “lift, tinker, and shift” strategy: making a few cloud optimizations, such as moving to a managed database, without changing core architecture.
Repurchase
The migration strategy of moving to a different product, often SaaS (“drop and shop”).
Reserved Instance (RI)
A billing discount for committing to a specific EC2 instance configuration for one or three years. Standard RIs give the largest discount; Convertible RIs allow changes.
Retain
The migration strategy of keeping an application where it is for now.
Retire
The migration strategy of decommissioning applications that are no longer needed.
Root user
The identity created with an AWS account that has complete access. Protect it with MFA and use it only for tasks that require it.
Amazon Route 53
A highly available DNS service and domain registrar with routing policies such as latency, weighted, geolocation, and failover.
Route table
A set of rules that determines where network traffic from a subnet is directed.
S
Amazon S3 (Simple Storage Service)
Object storage with virtually unlimited capacity, designed for 99.999999999% (11 nines) durability. Objects are stored in buckets.
S3 Glacier storage classes
Low-cost Amazon S3 storage classes for archive data: Glacier Instant Retrieval (milliseconds), Glacier Flexible Retrieval (minutes to hours), and Glacier Deep Archive (hours; the lowest cost).
S3 Intelligent-Tiering
An S3 storage class that automatically moves objects between access tiers based on changing access patterns.
S3 lifecycle policy
Rules that automatically transition objects to cheaper storage classes or delete them after a set time.
S3 Standard-Infrequent Access
An S3 storage class for data accessed less often but needing millisecond access, with a lower storage price and a retrieval fee.
Amazon SageMaker AI
A fully managed service to build, train, and deploy machine learning models.
Savings Plans
A pricing model that gives lower prices in exchange for a commitment to a consistent amount of compute usage (USD per hour) for one or three years. Compute Savings Plans also apply to Fargate and Lambda.
Scalability
The ability of a system to handle increased load by adding resources.
AWS Secrets Manager
A service that stores secrets such as database passwords and API keys and can rotate them automatically.
Security group
A stateful virtual firewall for an instance’s network interface that supports allow rules only.
AWS Security Hub
A service that gives a central view of security findings and posture across accounts and runs automated checks against standards.
Serverless
A way of running applications where AWS manages servers, scaling, and availability, and you pay for use. Examples include Lambda, Fargate, and DynamoDB.
Service control policy (SCP)
An AWS Organizations policy that sets the maximum available permissions for member accounts. It does not grant permissions by itself.
Service quota
The maximum number of resources or operations allowed per account and Region for a service, many of which can be increased on request.
Amazon SES (Simple Email Service)
A service for sending and receiving email, such as marketing and transactional messages.
Shared responsibility model
The division of security duties: AWS is responsible for security of the cloud, and customers are responsible for security in the cloud.
AWS Shield
Managed DDoS protection. Shield Standard is automatic and free for all customers; Shield Advanced adds enhanced protection, response team access, and cost protection.
AWS Snow Family
Physical devices, such as AWS Snowball Edge, for offline data transfer and edge computing where network transfer is impractical. Check current availability before planning a project.
Amazon SNS (Simple Notification Service)
A publish/subscribe service that pushes messages to many subscribers, such as SQS queues, Lambda functions, email, and SMS.
Software as a service (SaaS)
A complete application delivered over the internet and managed by the provider.
Spot Instance
Spare EC2 capacity offered at up to 90% off On-Demand prices. AWS can reclaim it with a two-minute warning. Amazon SQS (Simple Queue Service)
A fully managed message queue that decouples application components. Messages wait in the queue until a consumer processes them.
AWS Step Functions
A serverless orchestration service that coordinates multiple steps and services into visual workflows with retries and error handling.
AWS Storage Gateway
A hybrid cloud storage service that gives on-premises applications access to AWS storage through file, volume, and tape interfaces.
Subnet
A range of IP addresses in a VPC, located in a single Availability Zone.
AWS Support plans
Tiers of technical support. The exam tests Basic, Developer, Business, Enterprise On-Ramp, and Enterprise, which differ in response times and features.
Sustainability pillar
The Well-Architected pillar focused on reducing the environmental impact of cloud workloads.
AWS Systems Manager
A service for operating EC2 and on-premises servers at scale: patching, running commands, inventory, Parameter Store, and Session Manager.
T
Tag
A key-value label attached to an AWS resource for organization, automation, access control, and cost allocation. Technical Account Manager (TAM)
An AWS technical contact who provides guidance and advocacy. Enterprise Support includes a designated TAM; Enterprise On-Ramp provides access to a pool of TAMs.
Amazon Textract
A machine learning service that extracts printed and handwritten text, forms, and tables from documents. Total cost of ownership (TCO)
The full cost of running a workload, including hardware, facilities, power, staff, and software, used to compare on-premises and cloud options.
Amazon Transcribe
A speech-to-text service.
AWS Transfer Family
Managed SFTP, FTPS, FTP, and AS2 file transfer into and out of Amazon S3 and Amazon EFS.
AWS Transit Gateway
A network transit hub that connects many VPCs and on-premises networks through one central gateway.
Amazon Translate
A neural machine translation service between languages.
AWS Trust and Safety team
The AWS team that handles reports of abuse involving AWS resources, such as spam, phishing, or attacks.
AWS Trusted Advisor
A service that inspects your account and recommends improvements in cost optimization, performance, security, fault tolerance, service limits, and operational excellence.
V
Vertical scaling
Increasing the size of a resource, such as moving to a larger instance type (“scaling up”).
Amazon VPC (Virtual Private Cloud)
A logically isolated virtual network in an AWS Region where you launch resources and control IP ranges, subnets, and routing.
VPC endpoint
A private connection from a VPC to supported AWS services or PrivateLink-powered services without using the internet.
VPC peering
A networking connection between two VPCs that lets them route traffic privately. Peering is not transitive.
W
Aws waf
A web application firewall that filters HTTP and HTTPS requests to protect against attacks such as SQL injection and cross-site scripting.
AWS Wavelength
Infrastructure that embeds AWS compute and storage inside telecommunications providers’ 5G networks for ultra-low latency to mobile devices.
Well-Architected Framework
AWS’s set of best practices organized into six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.
AWS Well-Architected Tool
A free console tool for reviewing workloads against the Well-Architected Framework and tracking improvements.
Amazon WorkSpaces
A managed virtual desktop service (desktop as a service).