Glossary
Every term in one place, in plain words. Each one links to the lesson that explains it properly.
.dockerignore
A file listing what to leave out of the build context, like .git and .env. It keeps builds fast and secrets out of images. Explained in Writing a Dockerfile.
504 Gateway Timeout
What a load balancer returns when it couldn't get an answer from a server in time. Behind an AWS load balancer, often a security group dropping traffic. Explained in Security groups.
Abort criteria
The rules, written before a canary release starts, for when to stop it and send all traffic back. Explained in Ways to release.
Access key
A long-lived ID and secret that let a program call AWS. It works until deleted, so a leaked one is dangerous. Prefer roles. Explained in Who can do what: IAM.
ACM
AWS Certificate Manager: free, trusted TLS certificates for load balancers and other AWS services, renewed automatically. Explained in Domain names and HTTPS.
Alarm (CloudWatch)
A rule that watches one metric against a threshold and changes state — OK, ALARM or INSUFFICIENT_DATA — sending a notification when it fires. Explained in Alarms that actually fire.
Alarm fatigue
What happens when alarms fire without needing action: people learn to ignore them, including the real ones. Explained in Alarms that actually fire.
Alias record
A Route 53 record that points a name, even the domain's root, at an AWS resource such as a load balancer, and follows its addresses as they change. Explained in Domain names and HTTPS.
AMI
Amazon Machine Image: the starting disk every EC2 instance is copied from — an operating system and anything already installed. Explained in Servers on EC2.
Application Load Balancer (ALB)
AWS's load balancer for HTTP and HTTPS. It can route by path or hostname, and handle HTTPS for the servers behind it. Explained in Load balancers.
Apply (Terraform)
The command that carries out a plan: creating, changing or destroying real resources. Explained in Your first resource.
Approval gate
A pause in a pipeline where a person must agree before it continues, usually before production, with a time limit. Explained in Continuous delivery.
ARN
Amazon Resource Name: the unique ID of an AWS resource, like arn:aws:s3:::quickcart-menu-photos-111122223333. Explained in Who can do what: IAM.
Auto Scaling group
A set of identical servers that AWS keeps at the number you ask for. It launches servers when there are too few, terminates them when there are too many, and replaces any that fail. Explained in Auto scaling.
Autocommit
MySQL's default: any statement run outside a transaction is committed, and so permanent, the moment it finishes. Explained in Running SQL safely.
Availability zone
One of several separate data centre sites inside a region. Running in two means one can fail and you stay up. Explained in Regions and zones.
AWS account
Your own space inside AWS. Everything you create belongs to it, and it gets the bill. Explained in What the cloud is.
AWS Budgets
Sends you an alert when spending crosses, or is forecast to cross, a limit you set. It warns; it never stops anything. Explained in What the cloud is.
AWS CLI
The aws command: AWS from the terminal. It finds credentials in a fixed order and uses the first it finds. Explained in Set up your computer.
AWS Health Dashboard
Where AWS reports problems with its own services, by region and zone. Worth checking early in an incident. Explained in Regions and zones.
AWS Load Balancer Controller
A program installed inside an EKS cluster that watches for Ingress objects and builds real AWS load balancers for them. Explained in Kubernetes and EKS.
awsvpc network mode
The ECS network mode where each task gets its own network card, private IP and security group. The only mode on Fargate. Explained in ECS on Fargate.
Backend (Terraform)
Where Terraform keeps its state file. For a team, an S3 bucket. Explained in Terraform state.
Bake time
How long each canary step runs before it's judged, so slow-appearing problems have time to show. Explained in Canary from a pipeline.
Batch size
How many changes travel through the process together. Smaller batches ship faster and break less. Explained in The DevOps lifecycle.
Bind mount
A folder on your own machine shown inside a container. Useful for local development; there's no such folder on Fargate. Explained in Data and networking.
Blameless
Investigating incidents by asking what made a mistake possible, not who made it, so people can say what really happened. Explained in Real incidents.
Block Public Access
Four S3 switches, on by default for new buckets, that override any setting or policy that would make a bucket or its objects public. Explained in Files on S3.
Blue/green deployment
Building a full copy of the environment with the new version, then switching all traffic to it at once. Switching back is instant. Explained in Ways to release.
Bridge network (user-defined)
A Docker network you create with docker network create. Containers on it can reach each other by name, through built-in DNS. Explained in Data and networking.
Bucket policy
A JSON policy attached to an S3 bucket, saying what anyone may or may not do to it and its objects. Explained in Files on S3.
Budget alert
An AWS Budgets email sent when your spending passes a threshold. It warns you; it doesn't stop anything. Explained in How this course works.
Build cache (layer cache)
Docker reuses a saved layer when a line and the files it reads haven't changed. Once one line changes, every line below it rebuilds. Explained in Writing a Dockerfile.
Canary release
Sending a small share of traffic to a new version first, and growing it only while it behaves as well as the old one. Explained in Ways to release.
cgroups
A Linux kernel feature that limits how much CPU and memory a group of processes, such as a container, may use. Explained in Images and containers.
Change failure rate
The share of deployments that cause a problem needing a fix, rollback or hotfix. A DORA stability metric. Explained in Measuring delivery.
CIDR
A way of writing an IP address range. 10.0.0.0/16 means 65,536 addresses; /24 means 256. A smaller number after the slash means a bigger range. Explained in Subnets and IP ranges.
ClickOps
Building infrastructure by clicking in a console. Quick once, but nothing records exactly what was done, so it can't be repeated reliably. Explained in Why Terraform.
CloudTrail
AWS's record of every API call in your account: who made it, what it was, when, from where, and whether it worked. Explained in Who changed what.
CloudWatch
AWS's service for logs, metrics and alarms. Where you watch what your system is doing. Explained in Logs and metrics.
CloudWatch agent
A program installed on a server that ships its log files, and metrics like memory and disk use, to CloudWatch. Explained in Logs and metrics.
COMMIT and ROLLBACK
The two ways to end a transaction. COMMIT makes its changes permanent and visible to everyone; ROLLBACK throws them all away. Explained in Running SQL safely.
Composite alarm
An alarm that combines other alarms with a rule, such as A AND B, so one incident sends one notification. Explained in Alarms that actually fire.
Container
A running copy of an image. Many containers can start from one image. Explained in Images and containers.
Container runtime
The software that starts and stops containers on a machine, such as Docker or containerd. Explained in Images and containers.
Continuous delivery
Keeping every change that passes the pipeline ready for production, so releasing is a routine, repeatable step. Explained in Continuous delivery.
Continuous integration
Merging small changes often, with every change built and tested automatically before it can join the main branch. Explained in Continuous integration.
Control plane
The part of Kubernetes that makes decisions: its API, controllers, scheduler and store of desired state. On EKS, AWS runs it for an hourly fee. Explained in Kubernetes and EKS.
count (Terraform)
Makes a number of copies of a resource, known by position. Removing an item from the middle of a list shifts the positions and destroys the wrong things. Explained in Loops and lifecycle.
Credentials store
Where Jenkins keeps secrets such as tokens, encrypted, so pipelines can use them without the values appearing in code or logs. Explained in Jenkins from zero.
Data event
A CloudTrail event for reading or writing inside a resource, such as an S3 file. Only recorded by a trail that has them turned on. Explained in Who changed what.
Datapoints to alarm
The "M out of N" setting: how many of the last N periods must cross the threshold before an alarm fires. Explained in Alarms that actually fire.
DB subnet group
The list of subnets RDS may place a database in. It must cover at least two availability zones, and should hold only private subnets. Explained in Managed databases: RDS.
DDL
Statements that change a database's structure, such as CREATE, ALTER, DROP and TRUNCATE. In MySQL they commit at once and can't be rolled back. Explained in Running SQL safely.
Declarative
Saying what you want to exist, and letting the tool work out the steps. Terraform and Kubernetes both work this way. Explained in Why Terraform.
Declarative pipeline
The structured Jenkinsfile style that starts with pipeline { and uses fixed sections: agent, stages, steps, environment, when and post. Explained in The Jenkinsfile.
Delete marker
What S3 adds on top of an object when you delete it in a versioned bucket. The object looks deleted; delete the marker and it's back. Explained in Files on S3.
Dependency lock file
The file that records exactly which provider versions a project uses, so everyone gets the same ones. Commit it to git. Explained in Your first resource.
Deployment (Kubernetes)
A Kubernetes object that says how many pods of which image to run, and replaces them gradually when you release. Explained in Kubernetes and EKS.
Deployment circuit breaker
An ECS setting that notices when a release's new tasks keep failing to start, stops the release, and goes back to the last working version by itself. Explained in Releases without downtime.
Deployment frequency
How often a team puts changes into production. A DORA speed metric. Explained in Measuring delivery.
Deregistration delay
How long a load balancer lets requests already in progress finish on a target it's removing, while sending it nothing new. The default is 300 seconds. Explained in Releases without downtime.
Desired capacity
How many servers an Auto Scaling group should have right now, between its minimum and maximum. Scaling policies change this number. Explained in Auto scaling.
Desired count
How many tasks an ECS service should run. The service keeps comparing it with what is running and closes the gap. Explained in ECS on Fargate.
Desired state
What you've declared should be running, such as replicas: 2. Controllers keep comparing reality with it and closing the gap. Explained in Kubernetes and EKS.
DevOps lifecycle
The loop every change goes round: plan, code, build, test, release, deploy, operate, monitor, and back to plan. Explained in The DevOps lifecycle.
DNS
The Domain Name System: turns a name like example.com into an IP address, through a chain of servers. Explained in Domain names and HTTPS.
Docker Compose
A tool that starts several containers, their network and volumes from one file, compose.yaml. Each service name becomes a hostname. Explained in Data and networking.
Dockerfile
A text file of instructions that Docker runs, top to bottom, to build an image. Explained in Writing a Dockerfile.
DORA metrics
Four numbers that describe how well a team delivers: deployment frequency, lead time for changes, change failure rate and time to restore. Explained in Measuring delivery.
Drift
When what is really in AWS no longer matches your Terraform code — usually because someone changed it in the console. Explained in Operating Terraform.
Dry run (runbook)
Following a runbook for real, with a stopwatch, to find gaps before an incident does. Explained in Runbooks.
EC2 instance
A virtual server you rent from AWS by the second. It starts as a copy of an AMI. Explained in Servers on EC2.
ECR
Elastic Container Registry: AWS's private registry for container images, inside your account. ECS and EKS pull images from it. Explained in Storing images: ECR.
ECS
Elastic Container Service: AWS's service for running containers. You describe a task and a desired count, and ECS keeps it running. Explained in ECS on Fargate.
ECS service
Keeps a desired number of ECS tasks running, replaces any that stop, and registers them with a load balancer. Explained in ECS on Fargate.
EKS
Amazon Elastic Kubernetes Service: AWS runs the Kubernetes control plane for you; you choose how the nodes run. Explained in Kubernetes and EKS.
EKS extended support
The period after a Kubernetes version leaves EKS standard support. The control plane then costs about six times more per hour. Explained in ECS or EKS?.
EKS Pod Identity
The way to give one Kubernetes service account its own IAM role, so only the pods that need AWS permissions get them. Explained in Kubernetes and EKS.
eksctl
AWS's command-line tool that creates and deletes a whole EKS cluster, with its nodes and IAM roles, in one command. Explained in Kubernetes and EKS.
Elastic IP
A public IP address that stays yours until you release it, instead of changing when a server restarts. Explained in Routes, gateways and NAT.
Ephemeral port
The random high-numbered port a client uses for one connection, where the reply comes back. Usually somewhere in 1024 to 65535. Explained in Security groups.
Error budget
The failure an SLO allows: 100% minus the target. Spent on releases and experiments; when it runs out, the team slows down. Explained in Reliability targets.
Event history (CloudTrail)
The free, always-on view of the last 90 days of management events in one region. Explained in Who changed what.
Execution role
The IAM role ECS uses before your app starts: pulling the image, sending logs and fetching secrets. Explained in ECS on Fargate.
Expand and contract
Changing a database so old and new versions both work: add the new thing, move the code over, remove the old thing later. Explained in Ways to release.
Explicit deny
A policy statement with Effect Deny that matches a request. It beats every Allow. Explained in Who can do what: IAM.
Failover
Switching from a failed primary to a standby. In RDS Multi-AZ, the endpoint name moves to the standby, typically in 60 to 120 seconds. Explained in Managed databases: RDS.
Fargate
A way to run ECS tasks (and EKS pods) with no servers of your own. You pay for the CPU and memory each task asks for. Explained in ECS on Fargate.
Feature flag
An if in the code whose answer comes from a setting, so a feature can be switched on or off without a deploy. Explained in Feature flags.
Flag debt
Old feature flags left in the code after their job is done. Each one is a hidden branch nobody tests. Explained in Feature flags.
Flapping
An alarm switching back and forth between OK and ALARM, usually because the threshold sits on the metric's normal level. Explained in Alarms that actually fire.
for_each
Makes one copy of a resource per item in a map or set, keyed by name, so removing one item removes only that one. Explained in Loops and lifecycle.
Forces replacement
A change Terraform can't make in place, so it destroys the resource and creates a new one. Read these lines in a plan carefully. Explained in Your first resource.
Free tier
AWS's free offers. What you get depends on when your account was created. Check Billing and Cost Management, then Free Tier. Explained in How this course works.
Gateway endpoint
A free VPC endpoint for S3 or DynamoDB. It works by adding a route for the service's prefix list to your route tables. Explained in Routes, gateways and NAT.
Global service
An AWS service that isn't tied to one region, such as IAM. The console's region selector shows Global on its pages. Explained in What the cloud is.
Graceful shutdown
An app hearing the stop signal, finishing the requests it's handling, and then exiting, instead of dying mid-request. Explained in Releases without downtime.
Health check
A small request, like GET /health, a load balancer sends each target every few seconds. Fail enough in a row and the target gets no traffic. Explained in Load balancers.
Health check grace period
How long ECS ignores failed load balancer health checks after a task starts, so a slow starter isn't replaced before it's ready. Explained in Releases without downtime.
Homebrew
A package manager for macOS and Linux, including Ubuntu on Windows through WSL. It installs and updates command-line tools by name. Explained in Set up your computer.
Hosted zone
Where a domain's DNS records live in Route 53. It only takes effect once the registrar points to its name servers. Explained in Domain names and HTTPS.
Hypervisor
The software that splits one physical server into virtual machines, each with its own operating system and kernel. Explained in Images and containers.
IAM
Identity and Access Management: the part of AWS that decides, for every request, whether the caller is allowed to do it. Explained in Who can do what: IAM.
IAM Identity Center
The AWS service for people's everyday sign-in. It hands out credentials that expire after hours, instead of long-lived keys. Explained in How this course works.
IAM policy
A JSON document of statements, each with an Effect, Actions and Resources, that allows or denies requests. Explained in Who can do what: IAM.
IAM role
An identity with no password and no permanent keys. Whatever assumes it gets temporary credentials that expire on their own. Explained in Who can do what: IAM.
Idempotent
Safe to run more than once: running it twice gives the same result as running it once. Explained in Continuous delivery.
Image
A packaged app: code, libraries and a small operating system. It never changes once built. Explained in Images and containers.
Image digest
A sha256 fingerprint calculated from an image's contents. Unlike a tag, it can never point at a different image. Explained in Images and containers.
Image layer
One set of file changes in an image, usually made by one Dockerfile line. Layers are shared between images and downloaded only once. Explained in Images and containers.
Image tag
The label after the colon in an image name, like v1 in quickcart-orders:v1. Tags can be moved to a different image unless the registry forbids it. Explained in Images and containers.
IMDSv2
Version 2 of the instance metadata service. Every request needs a token from a PUT first, which protects the instance's role credentials. Explained in Servers on EC2.
Immutable tag
A repository setting that stops a tag such as v1 ever being moved to a different image, so every version name means exactly one build. Explained in Storing images: ECR.
Implicit deny
The default answer in IAM: if no policy allows a request, it is denied. Explained in Who can do what: IAM.
Import (Terraform)
Bringing a resource that already exists into Terraform's state, so the code manages it from now on. Explained in Operating Terraform.
Infrastructure as code
Describing servers, networks and everything else in text files, so they can be reviewed, versioned and rebuilt the same way every time. Explained in Why Terraform.
Ingress
A Kubernetes request for a load balancer with routing rules. On EKS, the AWS Load Balancer Controller builds an ALB for it. Explained in Kubernetes and EKS.
Input variable
A setting passed into Terraform code, like the environment name, so the same code builds different copies. Explained in Variables, locals and outputs.
Instance profile
The wrapper that attaches an IAM role to an EC2 instance, so software on it gets short-lived AWS credentials with no stored keys. Explained in Servers on EC2.
Instance refresh
Replacing every server in an Auto Scaling group in batches, waiting for each new one to be healthy. Used to roll out a new launch template version. Explained in Auto scaling.
Interface endpoint
A VPC endpoint for most other AWS services. It puts a network interface with a private address in your subnet, and bills by the hour. Explained in Routes, gateways and NAT.
Internet gateway
The door between your VPC and the internet. A subnet only uses it if its route table says so. Explained in What is a VPC?.
Jenkins agent
A machine that runs builds for the controller. Agents can be added, replaced or thrown away. Explained in Jenkins from zero.
Jenkins controller
The Jenkins server that holds the jobs, settings, credentials and history, and hands builds to agents. It shouldn't run builds itself. Explained in Jenkins from zero.
JENKINS_HOME
The folder where Jenkins keeps everything: jobs, build history, plugins and credentials. Back it up. Explained in Jenkins from zero.
Jenkinsfile
A file in the repository that describes a pipeline as code, so it's reviewed and versioned like everything else. Explained in The Jenkinsfile.
Kernel
The core of an operating system, which runs programs and talks to the hardware. Every container on a machine shares the host's kernel. Explained in Images and containers.
Key pair
An SSH public and private key for logging in to an instance. QuickCart uses Session Manager instead, so there are no keys to lose. Explained in Servers on EC2.
Kill switch
A flag that turns a misbehaving feature off for everyone at once, with no deploy. Explained in Feature flags.
kubectl
The command-line tool for talking to a Kubernetes cluster: apply files, list pods, read events, roll releases back. Explained in Kubernetes and EKS.
Kubernetes
Open-source software that runs containers across many servers and keeps making what's running match the desired state you describe in files. Explained in Kubernetes and EKS.
Launch template
A saved, versioned recipe for launching a server: image, instance type, security group, role and start-up script. An Auto Scaling group launches every server from one. Explained in Auto scaling.
Lead time for changes
How long a change takes from being committed to running in production. A DORA speed metric. Explained in Measuring delivery.
Least privilege
Giving each identity exactly the actions and resources it needs, and nothing more. Explained in Who can do what: IAM.
Lifecycle block
Settings on a resource that change how Terraform replaces or protects it, such as prevent_destroy and create_before_destroy. Explained in Loops and lifecycle.
Lifecycle policy (ECR)
Rules that expire old images from an ECR repository automatically, such as untagged images after 7 days. Explained in Storing images: ECR.
Lifecycle rule
An S3 rule that moves objects to cheaper storage classes, or deletes old versions, on a schedule. Explained in Files on S3.
Listener
A port and protocol a load balancer listens on, like HTTPS on 443, and the rules for what to do with requests that arrive. Explained in Load balancers.
Liveness probe
A regular check that decides whether a container is stuck. When it keeps failing, Kubernetes restarts the container. Explained in Kubernetes and EKS.
Load balancer
One fixed address in front of many servers. Sends each request to a healthy one. Explained in Load balancers.
Local route
The route for the VPC's own range, present in every route table and impossible to remove. It lets everything in a VPC reach everything else. Explained in Routes, gateways and NAT.
Local value
A name for a value worked out once inside the code, like a standard name prefix, so it isn't repeated everywhere. Explained in Variables, locals and outputs.
Lock (state lock)
A marker Terraform places on the state while it works, so two people cannot apply at the same time. Explained in Terraform state.
Log group
A set of log streams that belong together, such as every server's logs for one app. Retention is set here. Explained in Logs and metrics.
Log retention
How long CloudWatch keeps log events before deleting them. Defaults to never expire, so always set it. Explained in Logs and metrics.
Log stream
The log lines from one source, such as one server, in time order, inside a log group. Explained in Logs and metrics.
Logs Insights
CloudWatch's query tool for logs: filter, count and group log lines with commands joined by |. Explained in Logs and metrics.
Longest prefix match
The rule for choosing between routes: when several match a packet, the one with the biggest number after the slash wins. Explained in Routes, gateways and NAT.
Main route table
The route table a VPC starts with. Any subnet not given its own table uses it, so it is safest left with only the local route. Explained in Routes, gateways and NAT.
Management event
A CloudTrail event for creating, changing, deleting or describing a resource. Recorded in event history by default. Explained in Who changed what.
Metric filter
A rule on a log group that turns matching log lines into a metric, such as a count of ERROR lines. Only counts lines that arrive after it exists. Explained in Logs and metrics.
Missing data treatment
What an alarm assumes when a period has no data: missing, good, bad, or keep the current state. Explained in Alarms that actually fire.
Module (Terraform)
A folder of Terraform code used as a building block, with its own inputs and outputs, like a function. Explained in Modules.
Moved block
Tells Terraform a resource was renamed in the code, so it updates the state instead of destroying and recreating the resource. Explained in Operating Terraform.
Multi-AZ
An RDS setting that keeps a synchronous standby copy of the database in another availability zone, and switches to it automatically if the primary fails. Explained in Managed databases: RDS.
Multi-stage build
A Dockerfile with more than one FROM. Early stages build things; only the last stage becomes the image, so build tools don't ship. Explained in Writing a Dockerfile.
Multibranch pipeline
A Jenkins job that finds every branch and pull request in a repository and runs its Jenkinsfile for each one. Explained in Continuous integration.
Name servers
The servers in charge of a domain's records. The registrar tells the world which ones they are. Explained in Domain names and HTTPS.
Namespace (Kubernetes)
A named folder for Kubernetes objects inside one cluster, such as default or kube-system. Explained in Kubernetes and EKS.
NAT gateway
Lets servers in a private subnet reach the internet — to download updates — while nothing on the internet can reach them. Explained in Routes, gateways and NAT.
Network ACL
A stateless firewall on a whole subnet. Unlike a security group, it can deny traffic, and replies need their own rule. Explained in Security groups.
Node group
A set of EC2 instances that run a cluster's pods. In a managed node group, AWS launches and helps update them. Explained in Kubernetes and EKS.
Object key (S3)
An object's full name in its bucket, like receipts/order-1001.pdf. S3 has no real folders; the slashes are just part of the name. Explained in Files on S3.
Octet
One of the four numbers in an IPv4 address, from 0 to 255. Each is 8 bits, so an address is 32 bits. Explained in Subnets and IP ranges.
Output value
A value Terraform prints after apply and passes to other code, like a VPC's ID. Explained in Variables, locals and outputs.
Parameter group
The engine settings for an RDS database, such as max_connections. The default one can't be edited, so you create your own to change a setting. Explained in Managed databases: RDS.
Parameter Store
Part of AWS Systems Manager: a store for settings. Standard parameters cost nothing to store; a SecureString parameter is encrypted. Explained in Secrets.
Percentile (p95)
The value that 95% of measurements are below. For response times it shows the slow minority that an average hides. Explained in Logs and metrics.
Permission set
A named bundle of permissions, like AdministratorAccess, that IAM Identity Center gives to people in an account. Explained in How this course works.
Plan (Terraform)
Terraform's list of what it would create, change or destroy. Read it before you apply. Explained in Your first resource.
Pod
The smallest thing Kubernetes runs: one or more containers sharing a network address. One running copy of your app, like an ECS task. Explained in Kubernetes and EKS.
Point-in-time restore
Creating a new database as it was at any second within the backup retention period, using RDS automated backups and change logs. Explained in Managed databases: RDS.
Port forwarding (Session Manager)
A Session Manager tunnel from a port on your laptop, through an instance in the VPC, to a private host such as a database. No inbound port or SSH key needed. Explained in Running SQL safely.
Port publishing
Connecting a port on the host to a port in a container, like -p 8080:8080. The host's port comes first. Explained in Data and networking.
Postmortem
A short written account of an incident — what happened, why, and what will change — shared so everyone learns. Explained in Real incidents.
Prefix length
The number after the slash in a CIDR range, like the 24 in /24. It is how many bits are fixed; the rest decide how many addresses the range holds. Explained in Subnets and IP ranges.
Prefix list
A named list of address ranges, with an ID starting pl-. AWS keeps one per service, such as S3, and gateway endpoint routes point at it. Explained in Routes, gateways and NAT.
Presigned URL
A link to one private S3 object that anyone can use until it expires. It is signed with the credentials of someone allowed to read the object. Explained in Files on S3.
Private subnet
A subnet with no route to the internet gateway. Nothing on the internet can reach it directly. Explained in What is a VPC?.
Promotion
Moving the same, already-tested artifact to the next environment, instead of building it again. Explained in Continuous delivery.
Provider (Terraform)
The plugin that lets Terraform talk to one platform, such as hashicorp/aws for AWS. Explained in Your first resource.
Provider alias
A second configuration of the same provider, usually for another region, chosen per resource or per module. Explained in Environments and regions.
Public subnet
A subnet whose route table sends internet traffic to the internet gateway. Explained in What is a VPC?.
RDS
Relational Database Service: AWS runs a database server such as MySQL or PostgreSQL for you, including patching, backups and failover. Explained in Managed databases: RDS.
Read replica
An asynchronous copy of a database, with its own endpoint, that you can query to take read work off the primary. It can lag slightly behind. Explained in Managed databases: RDS.
Readiness gate
An extra condition on a Kubernetes pod: it only counts as ready once the load balancer says it is healthy, so old pods are not removed too early during a release. Explained in Kubernetes and EKS.
Readiness probe
A regular check that decides whether a pod gets traffic. A failing pod is taken out of the Service but keeps running. Explained in Kubernetes and EKS.
Refresh-only plan
A plan that only reads what's really in AWS and shows how the state would change, without proposing any changes to AWS. Explained in Operating Terraform.
Region
A geographic area where AWS runs, like us-east-1 in Virginia. Each has several availability zones. Explained in Regions and zones.
Registrar
The company you bought a domain from. It sets which name servers answer for the domain. Explained in Domain names and HTTPS.
Registry (container)
A server that stores images. You push an image to it and servers pull from it. Docker Hub is public; ECR is private to your AWS account. Explained in Images and containers.
ReplicaSet
Created by a Deployment, one per version: keeps exactly the right number of pods of that version running. Explained in Kubernetes and EKS.
Reserved addresses
The five addresses AWS keeps in every subnet: the first four and the last. A /24 has 256 addresses but only 251 you can use. Explained in Subnets and IP ranges.
Resource (Terraform)
One thing Terraform manages, like a bucket or a VPC, written as a resource block with a type and a name. Explained in Your first resource.
Rolling deployment
A release that replaces the old copies of an app with new ones a few at a time, while the service keeps running. Explained in Releases without downtime.
Rolling release
Replacing servers with the new version a few at a time, so the service never stops. Explained in Ways to release.
Root module
The folder you run terraform in. It calls child modules and holds the backend and provider settings. Explained in Modules.
Root user
The email address an AWS account was created with. It can do anything, so it's protected with MFA and almost never used. Explained in How this course works.
Rotation (secrets)
Changing a secret on a schedule, so an old leaked copy stops working by itself. Secrets Manager can do it for you. Explained in Secrets.
Route table
The rules that decide where a subnet's traffic goes. It is the only thing that makes a subnet public or private. Explained in What is a VPC?.
Runbook
A written, tested procedure for one situation, exact enough that anyone on call could follow it at 3am. Explained in Runbooks.
S3 bucket
A container for files (objects) in S3. It lives in one region, and its name must be unique across every AWS account. Explained in Files on S3.
Scan on push
ECR image scanning that checks each image for known vulnerabilities as soon as it is pushed. Basic scanning is free. Explained in Storing images: ECR.
Secret
Any value that lets someone in, such as a database password or an API key. Keep it in one place, and give everything else only its name. Explained in Secrets.
Secrets Manager
AWS's store for secrets. It encrypts them, hands them only to callers IAM allows, keeps the previous value, and can change them on a schedule. Explained in Secrets.
SecureString
A Parameter Store parameter encrypted with a KMS key. Read it with --with-decryption. Explained in Secrets.
Security group
A firewall attached to a resource, listing what may connect to it and what it may connect to. Explained in Security groups.
Self-signed certificate
A certificate you made yourself. The traffic is encrypted, but nobody trusted vouches for it, so browsers warn. Explained in Domain names and HTTPS.
Service (Kubernetes)
A stable name and address inside a cluster in front of a changing set of ready pods. Explained in Kubernetes and EKS.
Session Manager
A way to open a shell on a server from the AWS console, with no SSH key and no open inbound port. The server needs an IAM role and a route to Systems Manager. Explained in Servers on EC2.
Shared library
Jenkins pipeline code kept in its own repository and reused by many Jenkinsfiles, so common steps are written once. Explained in Continuous integration.
Shared responsibility model
How security is split: AWS secures the buildings, hardware and its own services; you secure what you put in them, such as access, network rules, patches and data. Explained in What the cloud is.
SIGTERM
The polite "please stop" signal sent to a container before it's stopped. If the process is still running after the stop timeout, SIGKILL ends it by force. Explained in Releases without downtime.
SLA
Service level agreement: a promise to customers with a penalty if it's missed. Looser than your internal SLO. Explained in Reliability targets.
SLI
Service level indicator: something you measure about what users experience, usually good events divided by all events. Explained in Reliability targets.
SLO
Service level objective: the target for an SLI over a window of time, such as 99.9% of orders succeeding over 30 days. Explained in Reliability targets.
Smoke test
A few quick checks right after a deploy that the release really runs in that environment. Explained in Continuous delivery.
Snapshot (RDS)
A saved copy of a whole RDS database at one moment. Manual snapshots are kept until you delete them, even after the database is gone. Explained in Managed databases: RDS.
SNS topic
A named channel in Simple Notification Service. Alarms publish to it; its subscriptions deliver the message by email, text or to other systems. Explained in Alarms that actually fire.
SSE-S3
S3's default encryption at rest, with keys AWS creates and manages. Applied to every new object automatically, at no extra cost. Explained in Files on S3.
State (Terraform)
Terraform's memory: a file linking each resource in your code to the real thing in AWS. Explained in Terraform state.
Stateful firewall
A firewall that remembers each allowed connection and lets its replies back automatically. Security groups are stateful. Explained in Security groups.
Stopped reason
The message ECS writes on a stopped task explaining why it stopped. The first place to look when a task won't start. Explained in ECS on Fargate.
Storage class
How S3 stores an object, trading monthly price against how quickly and cheaply it can be read: Standard, Standard-IA, Glacier and others. Explained in Files on S3.
Structured logging
Writing each log line as JSON with named fields, so logs can be filtered, counted and averaged instead of just read. Explained in Logs and metrics.
Subnet
A slice of a VPC's address range. Each subnet lives in exactly one availability zone. Explained in What is a VPC?.
System log (EC2)
A server's boot output, fetched by AWS without any network access to the server. The place to look when an instance won't boot. Explained in Where to look first.
Target group
The list of servers behind a load balancer, plus the health check that decides which of them get traffic. Explained in Load balancers.
Target tracking
A scaling policy that keeps a metric near a target, such as average CPU at 50%, by adding or removing servers. Adds quickly, removes slowly. Explained in Auto scaling.
Task (ECS)
One running copy of an ECS task definition. On Fargate each task has its own network card and private IP. Explained in ECS on Fargate.
Task definition
ECS's recipe for a task: image, CPU, memory, port, logs and roles. Every change makes a new numbered revision. Explained in ECS on Fargate.
Task role
The IAM role your code uses for its own AWS calls while an ECS task runs. Explained in ECS on Fargate.
tfvars file
A file of values for input variables, usually one per environment, such as dev.tfvars. Explained in Variables, locals and outputs.
Time to restore
How long it takes to recover when a deployment causes a problem. A DORA stability metric. Explained in Measuring delivery.
TLS certificate
A file proving a key belongs to a domain, signed by an authority browsers trust. It is what puts the padlock on HTTPS. Explained in Domain names and HTTPS.
TLS termination
Decrypting HTTPS at the load balancer, so the servers behind it never handle certificates. Explained in Domain names and HTTPS.
Trail (CloudTrail)
A CloudTrail setting that copies events to files in an S3 bucket, so you keep them as long as you like, from every region. Explained in Who changed what.
Transaction
A group of database changes that happen all together or not at all. Nothing in it is permanent or visible to anyone else until you COMMIT. Explained in Running SQL safely.
Trust policy
The part of a role that says who or what may assume it, such as the EC2 service. Explained in Who can do what: IAM.
TTL
Time to live: how many seconds a DNS answer may be cached before it must be asked for again. Explained in Domain names and HTTPS.
Undo script
A statement, written and saved before a change to production data, that puts the old values back if the change turns out to be wrong after it's committed. Explained in Running SQL safely.
User data
A script an EC2 instance runs once, as root, on its first boot. How a plain AMI becomes your server without anyone logging in. Not secret. Explained in Servers on EC2.
Value stream map
A stage-by-stage record of how long a change spent being worked on, and how long it spent waiting. Explained in The DevOps lifecycle.
Versioning (S3)
S3 keeping every past version of a file, so a damaged or deleted one can be brought back. Explained in Files on S3.
Virtual machine
A software computer with its own operating system and kernel, running on a hypervisor. An EC2 instance is one. Explained in Images and containers.
Volume
Storage that Docker creates and manages, mounted into a container. It outlives the container, so a database's files survive docker rm. Explained in Data and networking.
VPC
Virtual Private Cloud: your own private section of AWS's network. Nothing gets in unless you open a way. Explained in What is a VPC?.
VPC endpoint
A private way from inside your VPC to an AWS service such as S3 or Secrets Manager, without going through the internet or a NAT gateway. A gateway endpoint is a route; an interface endpoint is a private address in your subnet. Explained in Routes, gateways and NAT.
VPC peering
A private connection between two VPCs. It only works if their address ranges don't overlap. Explained in Subnets and IP ranges.
Webhook
A message a service like GitHub sends to another system when something happens, such as a push, so builds start at once. Explained in Continuous integration.
Workspace (Terraform)
Several state files for one folder of code. Useful for short-lived copies; separate folders per environment are clearer for dev and prod. Explained in Environments and regions.
Zone ID
A code like use1-az2 that names the same availability zone in every AWS account. Zone names like us-east-1a can point at different zones in different accounts. Explained in Regions and zones.