Glossary

Every AWS word used on this site, in plain English. 39 terms, grouped by topic.

Accounts and organizations

AWS account: A container for AWS resources, with its own identities and its own bill.
Root user: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.
MFA (multi-factor authentication): A second proof of identity, like a code from an app or a security key, on top of a password.
AWS Organizations: Groups many AWS accounts under one management account, with one bill and shared guardrails.
SCP (service control policy): An organization-wide guardrail that sets the most any identity in an account may do.
IAM Identity Center: One place for people to sign in and get access to many AWS accounts.
Permission set: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.
AWS Control Tower: Sets up and governs a multi-account AWS environment (a landing zone) for you.
Landing zone: A ready-made, well-run multi-account AWS environment that your apps can "land" in.
Account Factory: Control Tower's way to create new AWS accounts from a standard template.
Controls (guardrails): Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.

IAM (Identity and Access Management): Decides who can do what to which AWS resource.
IAM role: An identity with permissions that something can "wear" temporarily. No password.
IAM policy: A JSON document listing allowed (or denied) actions on resources.
ARN (Amazon Resource Name): The unique full name of an AWS resource.
Temporary credentials: Short-lived AWS keys handed out for a role, which expire automatically.
Service-linked role: A role an AWS service creates and owns so it can act in your account on its own behalf.
iam:PassRole: The permission to hand an existing role to an AWS service.

Region: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).
VPC (Virtual Private Cloud): Your own private network inside an AWS Region.
Subnet: A slice of a VPC's addresses that lives in one Availability Zone.
Internet gateway: The VPC's door to the public internet.
Public IP address: An address the whole internet can reach.
Security group: A firewall attached to a network card, listing what traffic is allowed in and out.
ENI (Elastic Network Interface): A virtual network card that gives something an address in a subnet.
NAT gateway: Lets things in private subnets reach out to the internet, while nothing can reach in.

EC2 (Elastic Compute Cloud): Rent a virtual server by the second.
ECS and Fargate: Run containers on AWS. With Fargate, AWS also runs the servers underneath.
Lambda: Upload a function; AWS runs it only when something calls it.
API Gateway: A managed HTTPS front door that passes requests to your code.
WebSocket (API Gateway WebSocket API): An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.

RDS (Relational Database Service): A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.
DynamoDB: A fully managed NoSQL database you use through AWS API calls.
S3 (Simple Storage Service): Unlimited storage for files ("objects") in containers called buckets.

SQS (Simple Queue Service): A managed queue. One part of your system drops messages in, another takes them out later.
Dead-letter queue (DLQ): A side queue where messages go after failing too many times.

CloudWatch Logs: Where applications and AWS services send their log lines.
CloudTrail: A record of every AWS API call. Who did what, when, from where.
AWS Config: Records how your resources are configured over time and checks them against rules.