Glossary
A
- Access key
a long-lived static credential that must be copied to wherever it is used, and so ends up in source control, config files, and images.
- Active-active
every copy serves traffic at once, so a failure removes capacity rather than the service. The normal mode for stateless tiers.
- Active-passive
one copy serves and another waits to be promoted. The normal mode for a database, which needs one place that takes writes.
- Asynchronous replication
acknowledging a write and copying it afterwards, so the copy lags and the writes in flight are lost on failover. The only option across regions.
- At-least-once delivery
the promise that no message is lost, at the cost that some arrive twice. Every consumer must be safe to run twice.
- Autoscaling group
a managed set of identical machines that grows and shrinks against a metric and replaces any machine that fails its health check.
- Availability zone (availability zones, zone)
an isolated data centre or group of them inside a region, with its own power and network. The everyday unit of resilience.
B
- Block storage
a network-attached volume that behaves as a local disk and outlives the machine it is attached to. One machine, one zone, at a time.
- Bucket (buckets)
the container that holds objects and carries their access rules. Private by default. Making one public takes a deliberate act, and it stays public for every object added later.
C
- CIDR
the notation for an address range, such as 10.0.0.0/16, where the number after the slash says how many bits are fixed and so how many addresses the range holds.
- Cold start
the delay when a function runs after a quiet period and the provider has to start a container and load the code first.
- Connection pooler
a proxy that holds a fixed number of real database connections and lends them to callers for the length of a query.
- Container (containers)
a process packaged with its dependencies and given its own view of the filesystem, so it runs the same wherever it lands.
- Container image
the layered, versioned filesystem a container starts from, built once in a pipeline and pushed to a registry.
- Container registry
the versioned store a cluster pulls container images from, addressed by tag. If a tag can be overwritten, the deployment that used it cannot be reproduced.
D
- Dead-letter queue
where a message goes after it has failed every retry, so it stops blocking the messages behind it and a person can look at it.
- Deployment
the desired count and image for a set of pods. Change the image and it replaces the pods a few at a time. Rolling back does the same in reverse.
- Disaster recovery (DR)
the multi-region rung of availability, from backups kept in a second region through a warm standby to two live regions.
- Document store
a database that holds JSON-like documents, each with its own structure, and indexes fields inside them.
E
- Egress
data leaving a provider's network or a region, billed per gigabyte. Traffic in is usually free. Traffic out is the charge that most often surprises people.
- Eventually consistent (eventual consistency)
a read that may return the value from a moment ago rather than the latest write, because the write reached one copy before the others.
F
- Failover
promoting the passive copy and moving traffic to it, by the provider within a zone or by DNS or a global load balancer across regions.
- Failure domain
the largest thing that can fail at once. A system is as available as its ability to lose one whole domain and keep serving.
- File storage
a shared filesystem many machines mount at once over the network, for software that expects a folder several servers can see.
- Function (functions)
a single-entry-point piece of code the provider runs in response to a trigger, with a maximum run time and no memory between runs.
H
- High availability (HA, highly available)
arranging a system so that the failure of any one piece, a machine, a zone, or a region, does not take the service down.
I
- Identity and access management (IAM)
the provider's service holding every identity and the policies that bind identities to actions on resources. Every API call is checked against it.
- Image (machine image)
a disk snapshot with an operating system and software installed, used to start new machines that need no manual setup.
- Infrastructure as code (IaC)
describing cloud resources in versioned files and letting a tool make the provider match them, so a change can be reviewed, reverted, and replayed.
- Ingress
a rule mapping an external hostname and path to a service inside the cluster, wired to a provider load balancer on the managed offerings.
K
- Key management service (KMS)
a service that holds encryption keys and controls which identities may use each one, adding a second gate on the most sensitive data.
- Key-value store
a database that returns a value for a key, fast, at any scale, and does nothing else.
- Kubernetes
software that places containers on a pool of machines, restarts them when they die, and moves them when a machine goes away. Every large provider sells a managed version.
- Kubernetes service
a stable name and address in front of a changing set of pods, so callers never need to know where a pod is.
L
- Least privilege
giving an identity the permissions its job needs and nothing more, because the policy is the blast radius if the identity is compromised.
- Lifecycle rule
a schedule on a bucket that moves objects to a colder tier or deletes them by age.
- Load balancer
the service that holds the public address and certificate and spreads incoming requests across a set of interchangeable, health-checked targets.
M
- Managed container runtime
a service that runs a container image and scales the copies with traffic, often to zero, with no cluster to own. Where most new HTTP services should start.
- Managed database
a database engine installed, patched, backed up, and failed over by the provider, with a connection string handed to you at the end.
N
- NAT gateway
the way out for a private subnet, letting traffic leave and replies return while admitting nothing that was not asked for. Billed per gigabyte.
- Node (nodes)
a machine in a Kubernetes cluster's pool. On a managed offering the provider runs the control plane and you pay for the nodes.
O
- Object storage
files stored whole in a flat namespace and read over HTTP, with no machine attached. It is the cheapest and most durable of the three kinds, and it cannot change part of a file.
P
- Partition key
the field that decides which machine holds a record, and so which queries are fast. Choosing it is most of a NoSQL design.
- Partitioning
splitting data by key across machines so that each owns its share and writes to different keys never contend.
- Peering
joining two private networks so their addresses can reach each other. Impossible if the ranges overlap.
- Persistent volume
block storage the cluster attaches when a pod is scheduled and re-attaches wherever the pod lands next.
- Pod (pods)
one or more containers scheduled together on one node, sharing an address. It is the unit Kubernetes places and restarts, and it is not meant to live long.
- Point-in-time recovery
restoring a database to any moment inside the retention window, rebuilt from the last snapshot plus the log of every change since.
- Policy
a statement of which identity may perform which actions on which resources. Anything not allowed is denied.
- Private endpoint
an address inside your network for a managed service, so calls to it never leave the network and are not billed as NAT traffic.
- Publish-subscribe (pub/sub, pub-sub)
the pattern where producers send to a topic and never know who receives, so subscribers can be added without changing anything upstream.
Q
- Queue
a buffer that delivers each message to one consumer and redelivers it after a timeout if the consumer fails.
R
- Read replica
a readable copy of a database that lags the primary slightly, used to move reports and heavy reads off it.
- Recovery point objective (RPO)
how much data the business accepts losing in a failover, measured as a span of time before the failure.
- Recovery time objective (RTO)
how long the business accepts being down, from the failure to serving again.
- Region (regions)
a geographic area with its own set of a provider's data centres, chosen for latency and for where the law says data must stay.
S
- Secrets manager
a store that keeps secrets encrypted, logs every read, rotates what it can, and hands values only to identities allowed to fetch them.
- Security group
a stateful allow-list of sources and ports attached to a resource. Name the source by group rather than by address.
- Serverless
running code without a server you can see, patch, or pay for while idle. Billed per run rather than per hour.
- Service identity
an identity belonging to a piece of software rather than a person. It is created with the workload and never reuses a person's credentials.
- Service level agreement (SLA)
a provider's promise of credits if a service falls below a stated availability. It covers the provider's service, not your system, and usually requires a multi-zone deployment.
the split between what the cloud provider secures, the building, hardware, and the software it runs for you, and what you secure, your data, access rules, and configuration.
- Snapshot (snapshots)
a point-in-time copy of a block volume or a database, stored in object storage, and the source of a block volume's resilience.
- Spot capacity (spot)
a provider's spare hardware, sold at a deep discount on the condition that it can be reclaimed at short notice. For work that can be interrupted.
- Standby replica
a copy of a database in another zone that receives every write and takes over when the primary fails. Usually not readable.
- Stream
an ordered, replayable log of events with a retention period, which consumers read at their own pace from their own position.
- Subnet (subnets)
a slice of the network in one zone. Public if it routes to the internet, private if not. Databases live in private ones.
- Synchronous replication
copying a write to the standby before acknowledging it, so the copy is never behind. Practical within a region, too slow across them.
T
- Topic
a channel that delivers each message to every subscriber, usually by pushing into a queue per subscriber.
V
- Virtual machine (virtual machines, VM)
a slice of a physical server sold as a whole computer, with its own operating system that you patch and its own billing clock that runs whether it is busy or not.
- Virtual private cloud (VPC)
your own private network inside the provider, with an address range you choose and no door in unless you build one.
W
- Wide-column store
a database of keyed, ordered rows with sparse columns, read by range. The shape for time series and event logs.
- Workload identity
short-lived credentials issued automatically to a machine, pod, or function through its attached identity, with nothing to store and nothing to leak.