Skip to content

☁ AWS Cloud FoundationsA free course by PITC

Home › Labs & Reference › Glossary

📖 Glossary

Every term used anywhere in this course, defined in one sentence. Use the search box in your browser (Ctrl+F) or jump by letter.

116 termsNetworking LinuxAWS

A B C D E F G H I K L M N O P Q R S T U V W

A

Term	Meaning
ACL	Access Control List. In Linux, per-user file permissions beyond owner/group/other. In AWS, a network ACL filters traffic at the subnet boundary.
Alias record	A Route 53 record type that points at an AWS resource, works at the zone apex where a CNAME cannot, and is free to query.
APIPA	Automatic Private IP Addressing, 169.254.0.0/16. A host self-assigns one of these when DHCP fails.
ARN	Amazon Resource Name. The globally unique identifier of an AWS resource, used in IAM policies.
Attenuation	The weakening of a signal with distance. The reason a copper Ethernet run is limited to about 100 metres.
Auto Scaling group	A set of EC2 instances managed as one unit, with a minimum, maximum and desired capacity.
Availability Zone	One or more discrete data centres in a Region with independent power, cooling and networking. The unit of failure in AWS.

B

Term	Meaning
Bastion host	A hardened instance in a public subnet used to reach private instances. Largely replaced by Systems Manager Session Manager.
Block Public Access	An S3 setting, on by default, that overrides bucket policies and ACLs to prevent public exposure.
Broadcast address	The last address in a subnet, reaching every host on it. Not assignable.

C

Term	Meaning
CIDR	Classless Inter-Domain Routing. Writing a network as address/prefix, such as 10.0.0.0/16.
CloudFront distribution	A CloudFront configuration with its own domain name, one or more origins and a set of cache behaviours.
CNAME	A DNS record pointing one name at another. Cannot be used at a zone apex.
Collision domain	A network segment where two transmissions can interfere. A hub creates one shared domain; a switch gives every port its own.
Composite alarm	A CloudWatch alarm combining other alarms with AND, OR and NOT to reduce alert noise.
Consolidated billing	One invoice for every account in an AWS Organization, with volume discounts pooled.
CSMA/CD	Carrier Sense Multiple Access with Collision Detection. The legacy Ethernet mechanism for sharing a medium.
CVE	Common Vulnerabilities and Exposures. The unique identifier for one published software vulnerability.
CVSS	Common Vulnerability Scoring System. The 0–10 industry-standard severity score for a CVE.

D

Term	Meaning
DAX	DynamoDB Accelerator. An in-memory cache giving microsecond reads with no application rewrite.
Decapsulation	Removing protocol headers as data travels up the OSI stack at the receiver.
Default action	In a WAF web ACL, what happens to a request that matched no rule — Allow or Block.
Detailed monitoring	One-minute CloudWatch metrics for EC2, charged per instance. Basic monitoring is five-minute and free.
DHCP	Dynamic Host Configuration Protocol. Assigns IP addresses automatically. Ports 67 and 68.
Direct Connect	A dedicated private network circuit from your premises into AWS.
DNS	Domain Name System. Translates names into IP addresses. Port 53.
Durability	The probability that stored data survives. S3 is designed for eleven nines.

E

Term	Meaning
Edge location	A CloudFront and Route 53 point of presence. There are far more of these than Regions.
Elastic IP	A static public IPv4 address you allocate and can move between resources. Charged whether attached or not.
Encapsulation	Adding protocol headers as data travels down the OSI stack at the sender.
Ephemeral port	A high-numbered source port (1024–65535) used for the client side of a connection. Matters when writing NACL rules.
Explicit deny	An IAM statement with Effect: Deny. It always wins over any allow.

F

Term	Meaning
FHS	Filesystem Hierarchy Standard. Why /etc, /var and /home mean the same thing on every Linux distribution.
Finding	A security observation reported by GuardDuty, Inspector, Security Hub or Macie.
FLSM	Fixed Length Subnet Masking. Every subnet gets the same mask, and therefore the same size.
Free Tier	AWS's introductory allowance. An allowance, not a spending cap.
Full duplex	Transmitting and receiving at the same time. What a switched port provides.

G

Term	Meaning
Gateway endpoint	A free VPC endpoint for S3 or DynamoDB that keeps traffic on the AWS network.
Global table	A DynamoDB table replicated across Regions, with multi-active writes.

H

Term	Meaning
Hard link	A second directory entry pointing at the same Linux inode. Cannot cross filesystems.
High availability	Designing so the failure of one component does not take the service down. In AWS this starts with multi-AZ.
Hosted zone	A Route 53 container for the DNS records of one domain.
Hot partition	A DynamoDB partition receiving far more traffic than the others, causing throttling. Caused by a poor partition key.
Hub	A Layer 1 device that repeats every signal to every port. Obsolete.

I

Term	Meaning
IaaS	Infrastructure as a Service. You manage the operating system upwards — EC2 and VPC.
IAM policy	A JSON document with Effect, Action, Resource and optional Condition.
IAM role	A set of permissions that can be assumed temporarily. How EC2 instances and Lambda functions get permission.
IMDS	Instance Metadata Service, at 169.254.169.254. IMDSv2 requires a session token and should be enforced.
Inode	The Linux structure holding a file's metadata and data-block pointers. The filename is just a pointer to it.
Internet gateway	The VPC component that allows communication with the internet. A route to it makes a subnet public.
Invalidation	Force-expiring a CloudFront cached object before its TTL. Versioned filenames are usually better.

K

Term	Meaning
Kernel	The core program that talks to hardware. The only part that is literally 'Linux'.
KMS	AWS Key Management Service. Creates and controls the encryption keys other services use.

L

Term	Meaning
Latency-based routing	A Route 53 policy that sends users to the Region with the lowest measured latency.
Least privilege	Granting the minimum permissions needed, then widening only when something genuinely breaks.
Local Zone	An extension of a Region placed near a large city for very low latency.

M

Term	Meaning
MAC address	The hardware address of a network interface. Layer 2.
Managed rule group	A pre-built, AWS- or vendor-maintained set of WAF rules, such as the core rule set.
MFA	Multi-Factor Authentication. A second factor beyond the password. Enable it on the root user first.
MPP	Massively Parallel Processing. A leader node plans; compute nodes each process their slice — how Redshift works.
Multi-AZ	Running across at least two Availability Zones. The baseline for high availability in AWS.

N

Term	Meaning
NACL	Network Access Control List. A stateless, allow-and-deny filter at the subnet boundary.
Namespace	In CloudWatch, the grouping of metrics by service, such as AWS/EC2.
NAT gateway	A managed service in a public subnet that lets private instances reach the internet outbound only. Chargeable.
NVD	National Vulnerability Database. Where CVEs and their CVSS scores are published.

O

Term	Meaning
OAC	Origin Access Control. Lets CloudFront read a private S3 bucket so the bucket never has to be public.
OLAP	Online Analytical Processing — large aggregations over history. Redshift.
OLTP	Online Transaction Processing — many small reads and writes. RDS and DynamoDB.
On-Demand	EC2 pricing with no commitment, charged per second or hour.
Origin	Where CloudFront fetches content on a cache miss — an S3 bucket, a load balancer or any HTTP server.
OSI model	A seven-layer reference model for networking, published by ISO.

P

Term	Meaning
PaaS	Platform as a Service. You manage the application and data only — Elastic Beanstalk, RDS, Lambda.
Partition key	The DynamoDB attribute hashed to decide which physical partition stores an item.
PDU	Protocol Data Unit. The name for the data at each OSI layer: data, segment, packet, frame, bits.
Pilot light	A DR strategy where only core services, usually the database, run and replicate continuously.
Port	A number identifying an application or process on a host. Layer 4.
Private subnet	A subnet whose route table has no route to an internet gateway.
Public subnet	A subnet whose route table sends 0.0.0.0/0 to an internet gateway.

Q

Term	Meaning
Query (DynamoDB)	Reads items by partition key — fast and cheap. Contrast with Scan.

R

Term	Meaning
Rate-based rule	A WAF rule that counts requests per source IP over a window and blocks those above a limit.
Region	A geographic area containing at least three Availability Zones.
Reserved Instance	A one- or three-year EC2 commitment in exchange for a large discount.
RFC 1918	The standard defining the private address ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
Root user	The account owner identity, created with the account's email address. Enable MFA and then stop using it.
Route table	The set of routes controlling where subnet traffic goes. Always contains a local route for the VPC CIDR.
RPO	Recovery Point Objective. How much data you can afford to lose.
RTO	Recovery Time Objective. How long you can afford to be down.

S

Term	Meaning
SaaS	Software as a Service. You manage only your data and users.
Savings Plan	A commitment to a fixed hourly spend for one or three years, in exchange for a discount.
Scan (DynamoDB)	Reads the whole table and filters afterwards. Slow and expensive — usually a sign of poor key design.
SCP	Service Control Policy. An Organizations guardrail that caps what an account can do. It never grants.
Security group	A stateful, allow-only virtual firewall attached to a network interface.
Shared Responsibility Model	AWS secures the cloud; the customer secures what they put in it.
Shield	AWS DDoS protection. Standard is free and always on; Advanced is paid.
SNS topic	The publish/subscribe channel other resources publish to and subscribers attach to.
Spot Instance	Spare EC2 capacity at a large discount, reclaimable with two minutes' notice.
SSH	Secure Shell. Encrypted remote login. Port 22.
Sticky bit	A Linux directory permission meaning only a file's owner can delete it. The t in drwxrwxrwt on /tmp.
Subnet mask	The pattern of bits that separates the network portion of an IP address from the host portion.
SUID	A Linux permission making a program run as the file's owner rather than the caller.
Symbolic link	A small Linux file containing a path to another file. Can cross filesystems; breaks if the target is deleted.

T

Term	Meaning
TCO	Total Cost of Ownership. Everything a workload really costs, including facilities, staff and idle capacity.
TCP	Transmission Control Protocol. Connection-oriented, reliable, ordered. Layer 4.
Transit Gateway	A hub connecting many VPCs, VPNs and Direct Connect links, replacing a mesh of peerings.
Trusted Advisor	Automated checks across cost, performance, security, fault tolerance, service limits and operational excellence.
TTL	Time To Live. In DNS and CDNs, how long a cached answer may be reused. In DynamoDB, when an item auto-deletes.

U

Term	Meaning
UDP	User Datagram Protocol. Connectionless and best-effort. Good for DNS, voice and video.
umask	The Linux mask subtracted from default permissions on new files and directories. Commonly 022.
User data	A script that runs at an EC2 instance's first boot, as root.

V

Term	Meaning
VLSM	Variable Length Subnet Masking. Each subnet gets the mask it needs. Allocate largest first.
VPC endpoint	A private connection from a VPC to an AWS service, without using the internet.
VPC peering	A one-to-one private connection between two VPCs. Not transitive; CIDRs must not overlap.

W

Term	Meaning
WAF	Web Application Firewall. Filters HTTP requests at Layer 7 — injection, XSS, bots and floods.
Warm standby	A DR strategy with a scaled-down but fully working copy of the environment always running.
Web ACL	The ordered set of rules, plus a default action, that AWS WAF evaluates for each request.
Well-Architected Framework	AWS's six-pillar review method for judging and improving an architecture.