AWS Glossary

A glossary of 63 core AWS services and terms that commonly trip up certification candidates, explained with the angle each is tested from. Organized by category so you can quickly look up terms as you study. See Service Guides for detailed service explanations and Exam Guide for exam-specific trends.

Computing

Amazon EC2: A foundational cloud computing service for provisioning on-demand virtual servers (instances). You control the OS and middleware; choose from instance types optimized for compute, memory, or storage. Pricing options (On-Demand, Savings Plans, Reserved, Spot) and the contrast with managed services like Lambda are common exam topics.
AWS Lambda: A serverless compute service that runs code in response to events (S3 uploads, API Gateway requests, SQS messages, etc.) without managing servers. Billing is based on execution count and duration; no idle cost. Automatic scaling and reduced operational burden are frequently tested in cost-optimization and architecture questions.
Auto Scaling: Automatically increases or decreases the number of EC2 instances based on demand metrics such as CPU utilization. Enables 'high availability at low cost' and is a key component of resilient architectures alongside ELB and CloudWatch.
ELB（ALB / NLB）: A load balancer that distributes incoming traffic across multiple targets. ALB (Application Load Balancer) operates at Layer 7 (HTTP/HTTPS) supporting path- or host-based routing; NLB (Network Load Balancer) operates at Layer 4 for ultra-high throughput and low latency. Choosing between ALB and NLB is a frequent exam topic.
Amazon ECS: AWS's native container orchestration service for running and managing Docker containers. Supports EC2 launch type (self-managed hosts) and serverless Fargate. No Kubernetes knowledge required, with deep AWS integration — the ECS vs. EKS choice is a common exam question.
Amazon EKS: A managed Kubernetes service where AWS operates the control plane. Compatible with open-source Kubernetes, making it the choice when existing Kubernetes assets or the broader ecosystem matter. ECS (AWS-native) vs. EKS (standards-based) is the key container strategy contrast.
AWS Fargate: A serverless compute engine for ECS and EKS containers that eliminates the need to provision or patch EC2 instances. Specify resources at the container level — no host management. Appears in comparisons with EC2 launch type for reducing operational burden.
AWS Elastic Beanstalk: A PaaS-like service that automatically provisions EC2, ELB, and Auto Scaling when you upload application code. Developers deploy without managing infrastructure details, while retaining control of underlying resources. Common in scenarios requiring rapid setup and simplified operations.

Storage

Amazon S3: An object storage service for storing files (objects) with virtually unlimited capacity and 99.999999999% durability. Broad use cases: static site hosting, data lakes, backups. Bucket policies, Block Public Access, encryption, and lifecycle rules are frequent exam topics.
S3 ストレージクラス: Storage tiers within S3 differentiated by access frequency and cost — Standard (frequent access), Standard-IA (infrequent), Glacier variants (archival). Cost-optimization questions typically ask you to select the class that best matches a given access pattern.
Amazon EBS: Block storage attached to EC2 instances, serving as OS disks or database storage. Data persists after instance stop or termination and can be backed up via snapshots to S3. The key distinction from EFS is that EBS typically attaches to a single instance at a time.
Amazon EFS: A fully managed shared file storage (NFS) that multiple EC2 instances can mount simultaneously. Capacity scales automatically based on usage. The go-to choice for Linux workloads requiring shared file access across servers — contrasted with EBS (single-instance attach) in exam questions.
Amazon FSx: A managed file system service providing industry-standard file systems such as Windows File Server and Lustre. FSx for Windows integrates with SMB protocol and Active Directory; FSx for Lustre is designed for HPC. Appears as the option for Windows shared storage or HPC needs.
AWS Storage Gateway: A hybrid storage service that seamlessly connects on-premises environments to AWS storage (S3, etc.) via file, volume, or tape interfaces. Used in migration and backup scenarios that bridge data centers and the cloud.
AWS Backup: A centralized backup management service for multiple AWS services (EBS, RDS, DynamoDB, EFS, etc.). Define backup plans and schedules in one place. The answer for exam scenarios requiring unified backup management across an organization.
Amazon S3 Glacier: Archive storage for data accessed very rarely — low cost per GB but with retrieval delays compared to standard S3. Ideal for compliance log retention and other rarely accessed data. The correct choice in cost-optimization questions for long-term archival workloads.

Networking

Amazon VPC: A service that creates a logically isolated virtual network within your AWS account. You define the IP address range, subnets, route tables, and gateways. The foundation of network design — subnet layout, routing, and gateway combinations are tested across all exam levels.
サブネット: A segment of a VPC's IP address range, residing in a single Availability Zone. Public subnets have a route to an Internet Gateway; private subnets do not. Distributing subnets across multiple AZs for high availability is a standard exam topic.
セキュリティグループ: A stateful virtual firewall applied at the instance (ENI) level. Only allow rules are defined; return traffic is automatically permitted. The contrast with the stateless network ACL (subnet-level, supports deny rules, no automatic return traffic) is a classic exam question.
ネットワークACL: A stateless virtual firewall applied at the subnet level. Both allow and deny rules are evaluated in numbered order; return traffic must be explicitly allowed. The comparison with security groups (stateful, instance-level) is a core exam topic.
Amazon Route 53: A DNS service that resolves domain names to IP addresses, with domain registration and health checking. Supports multiple routing policies — failover, latency, weighted, geolocation — for availability and traffic control. Frequently tested in disaster recovery and multi-region designs.
Amazon CloudFront: A CDN (Content Delivery Network) that caches content at edge locations worldwide to reduce latency and offload origin (S3, ELB) traffic. Tested in questions about delivery acceleration, DDoS resilience, and secure S3 integration.
NAT Gateway: A managed service enabling private subnet resources to make outbound internet connections without accepting inbound connections. Used when servers need internet access (e.g., for software updates) but should not be publicly reachable. A standard component of private subnet design.
VPCエンドポイント: A private gateway into AWS services without traversing the internet. Gateway endpoints (S3 and DynamoDB) add a route to the route table at no charge; Interface endpoints (PrivateLink) use an ENI. Tested in designs that keep traffic within the AWS network to enhance security and avoid NAT costs.
AWS Direct Connect: A dedicated physical connection between on-premises environments and AWS that bypasses the internet, delivering stable bandwidth, consistent low latency, and reliable network quality. Compared with VPN (internet-based, encrypted) in hybrid connectivity questions where bandwidth and reliability matter.
AWS Transit Gateway: A hub that aggregates multiple VPCs and on-premises networks for interconnection. Solves the full-mesh VPC peering management problem (which grows as N×(N-1)/2) with centralized routing. Tested in large-scale multi-VPC connection designs.

Database

Amazon RDS: A managed service for relational databases including MySQL, PostgreSQL, Oracle, and SQL Server. AWS handles patching, backups, and replication. The distinction between Multi-AZ (availability/automatic failover) and Read Replicas (read scalability) is the most-tested topic.
Amazon Aurora: AWS's cloud-native relational database, compatible with MySQL and PostgreSQL, using a distributed storage architecture to deliver commercial database-level performance. Selected over standard RDS when higher throughput, faster failover, or automatic storage expansion is required.
Amazon DynamoDB: A fully managed NoSQL (key-value/document) database with millisecond response at any scale. No server management; automatic scaling. Tested for its use cases (vs. schema-fixed RDS), high-throughput low-latency scenarios, and key-based access pattern design.
Amazon ElastiCache: A managed in-memory cache service providing Redis or Memcached. Keeps frequently accessed data in memory to offload the database and accelerate responses. The caching layer in architecture questions that solve read performance bottlenecks.
Amazon Redshift: A fully managed data warehouse for high-speed aggregation and analysis of large datasets using column-oriented storage and parallel processing. Positioned against RDS (OLTP) as the solution for analytical (OLAP) workloads.
Amazon DocumentDB: A managed document database compatible with MongoDB for storing and querying JSON documents. The choice for MongoDB workloads requiring managed AWS infrastructure. Appears as the document-oriented option in 'right tool for the job' database questions.
Amazon Neptune: A managed graph database for data expressed as nodes and edges. Efficiently handles traversal queries for social networks, recommendation engines, and fraud detection. Tested in 'purpose-built database' questions requiring the right fit for relationship data.

Security / IAM

AWS IAM: The foundational access control service managing who (authentication) can do what (authorization) on which AWS resources — composed of users, groups, roles, and policies. Least-privilege principle, root user protection, and MFA are tested at every exam level.
IAMロール: A set of temporary permissions that users or services can 'assume' (AssumeRole). Grants EC2 and Lambda instances safe access to AWS APIs without embedding long-term access keys. Avoiding hardcoded access keys by using roles is one of the most frequently correct answers across all exams.
IAMポリシー: A JSON document defining allow or deny rules for specific API actions. Composed of Effect, Action, Resource, and Condition elements. The evaluation logic (explicit Deny always wins; no Allow = implicit deny) and least-privilege design are tested in scenario questions.
AWS KMS: A key management service for centrally creating and managing encryption keys. Integrates with S3, EBS, RDS, and many other services for at-rest encryption. Tested in contexts of key rotation, access control, and audit logging via CloudTrail.
AWS Secrets Manager: A service for securely storing and retrieving secrets such as database passwords and API keys, with automatic credential rotation. Prevents plaintext credentials in code. The correct answer for 'secure secret storage without hardcoding.'
AWS WAF: A Web Application Firewall that protects against attacks like SQL injection and cross-site scripting. Works with CloudFront, ALB, and API Gateway. Tested as the Layer 7 (application layer) defense mechanism, contrasted with Shield (Layer 3/4 DDoS protection).
AWS Shield: A DDoS protection service. Standard (free) provides automatic protection against common attacks; Advanced (paid) adds enhanced protection and expert support. Contrasted with WAF (application-layer attack defense) as the Layer 3/4 DDoS mitigation service.
Amazon Cognito: A service for adding user sign-up and sign-in to web and mobile apps. Consists of User Pools (user management/authentication) and Identity Pools (temporary AWS credentials). The answer for app user authentication and external identity provider (IdP) federation.
Amazon GuardDuty: A security monitoring service that uses machine learning to analyze logs (CloudTrail, VPC Flow Logs, DNS) and automatically detect threats. No agent installation required. The answer for automated continuous threat detection requirements.
AWS Organizations / SCP: AWS Organizations manages multiple accounts centrally with consolidated billing and OU-based structure. SCPs (Service Control Policies) define the maximum allowed operations (guardrails) for accounts in the organization. Frequently tested in cross-account governance and cost consolidation scenarios.

Monitoring / Operations

Amazon CloudWatch: A monitoring service that collects, visualizes, and acts on metrics, logs, and events from AWS resources and applications. Sets alarms that trigger notifications, Auto Scaling, or automated actions. The foundation for monitoring, alerting, and log aggregation (CloudWatch Logs).
AWS CloudTrail: A service recording API call history (audit logs) — who called which API at what time. Tracks account activity for security investigations and compliance. The key distinction: CloudWatch = performance/state monitoring; CloudTrail = API operation auditing.
AWS Config: A service that continuously records AWS resource configurations and tracks change history. Define rules for desired states and detect non-compliant resources. The answer for compliance requirements, drift detection, and tracking resource configuration over time.
AWS Systems Manager: A suite of services for operating and managing EC2 and on-premises servers at scale. Includes Session Manager (shell access without SSH), Parameter Store (configuration values), and automated patch application. Tested for server operation automation and secure management without long-lived credentials.
AWS CloudFormation: An IaC (Infrastructure as Code) service that defines infrastructure in JSON or YAML templates and automatically provisions it. Enables reproducible, consistent deployments managed as stacks. Tested in contexts of automation, environment consistency, and eliminating manual build errors.
AWS CDK: An IaC framework for defining infrastructure using general-purpose programming languages like TypeScript or Python. Code is compiled to CloudFormation templates internally. Allows higher-abstraction, more efficient infrastructure definition compared to writing raw templates.
AWS Trusted Advisor: A service that inspects your account across cost optimization, security, fault tolerance, performance, and service limits, then recommends improvements. Automatically checks for best-practice compliance. Appears in exam questions about obtaining cost reduction or security improvement guidance.

Cost / Billing

Savings Plans: A pricing model where committing to a specific usage level (spend per hour) for 1 or 3 years earns discounts over On-Demand pricing. More flexible than Reserved Instances, with some types applicable across instance types and regions. Frequently tested in long-term compute cost optimization.
リザーブドインスタンス: A purchasing option for EC2 and RDS that reserves capacity for 1 or 3 years at significant discounts vs. On-Demand. Best for stable, predictable, always-running workloads. Compared with flexible Savings Plans and cheap-but-interruptible Spot in cost optimization questions.
スポットインスタンス: An EC2 purchasing option using AWS spare capacity at up to ~90% off On-Demand. AWS may reclaim capacity with short notice, so only interruption-tolerant batch jobs or stateless workloads are appropriate. Tested as the cost-reduction strategy for fault-tolerant workloads.
AWS Cost Explorer: A tool that visualizes and analyzes historical costs and usage in graphs, and forecasts future spend. Break down costs by service or tag to identify spending drivers. Appears as the analysis and investigation tool in cost management questions (vs. Budgets for alerts).
AWS Budgets: A budget management service that sets cost or usage thresholds and sends alerts via email or SNS when actual or forecasted spend nears or exceeds the threshold. Proactive cost control — distinguished from Cost Explorer (historical analysis) by its alerting capability.
S3 Intelligent-Tiering: A storage class that automatically monitors object access patterns and moves objects to the appropriate cost tier with no retrieval fee. Even low-frequency-tier objects maintain millisecond access. The answer for data with unknown or irregular access patterns.

AI / Analytics

Amazon Bedrock: A fully managed service for accessing foundation models from multiple providers (Claude, Titan, etc.) through a unified API without hosting models yourself. Build text generation, chatbots, and RAG applications. Appears in recent exam questions as the choice for integrating generative AI into applications.
Amazon SageMaker: A managed service covering the full ML workflow: data preparation, model training, and deployment. Handles everything from preprocessing to publishing inference endpoints. Tested as the complete platform for building and operating custom ML models.
Amazon Kinesis: A streaming data service for real-time collection and processing of logs, IoT data, and clickstreams. Includes Data Streams and Data Firehose. The answer when continuous real-time data processing is required rather than batch processing.
AWS Glue: A serverless ETL (Extract, Transform, Load) service with a Data Catalog for automatic schema discovery. Streamlines pre-analysis data preparation. Tested as a component of data lake ingestion and transformation pipelines.
Amazon Athena: A serverless analytics service that runs standard SQL queries directly against data in S3 — no server provisioning, billed per data scanned. Frequently tested for 'analyze S3 data directly with minimal setup' scenarios.
Amazon QuickSight: A cloud-native BI (Business Intelligence) service that visualizes data as interactive dashboards and charts. Connects to various data sources. Appears as the visualization tool for presenting analysis results to stakeholders.
Amazon Comprehend: An NLP machine learning service that automatically extracts sentiment, language, key phrases, and named entities from text via API — no model building required. Tested for text analytics use cases such as review sentiment analysis and document classification.

References

Last updated: 2026-06-24

This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.