AWS accountAWS account
A container for AWS resources, with its own identities and its own bill.
Think of it asA flat in an apartment building. Separate locks, separate meter.
Flash cards
Every word up to Level 0. Answer out loud, flip, then mark it.
Root userRoot user
The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.
Think of it asThe master key to the whole building.
MFA (multi-factor authentication)MFA (multi-factor authentication)
A second proof of identity, like a code from an app or a security key, on top of a password.
Think of it asA PIN on top of the key card.
AWS OrganizationsAWS Organizations
Groups many AWS accounts under one management account, with one bill and shared guardrails.
Think of it asThe building management company that owns every flat.
SCP (service control policy)SCP (service control policy)
An organization-wide guardrail that sets the most any identity in an account may do.
Think of it asThe building's rules. Your lease can't give you permission to break them.
IAM Identity CenterIAM Identity Center
One place for people to sign in and get access to many AWS accounts.
Think of it asThe front desk that hands you a temporary key card for whichever flat you're cleared for.
Permission setPermission set
A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.
Think of it asA job description that comes with the right keys in every building.
AWS Control TowerAWS Control Tower
Sets up and governs a multi-account AWS environment (a landing zone) for you.
Think of it asA developer who builds the whole apartment complex to code, then inspects it regularly.
Landing zoneLanding zone
A ready-made, well-run multi-account AWS environment that your apps can "land" in.
Think of it asA finished business park, with roads, security gates, CCTV and empty units ready to rent.
Account FactoryAccount Factory
Control Tower's way to create new AWS accounts from a standard template.
Think of it asA vending machine for pre-furnished flats.
Controls (guardrails)Controls (guardrails)
Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.
Think of it asLocked doors, CCTV, and a plan check before building work starts.
RegionRegion
A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).
Think of it asA city where AWS has its buildings.
VPC (Virtual Private Cloud)VPC (Virtual Private Cloud)
Your own private network inside an AWS Region.
Think of it asA fenced-off private estate inside the city.
SubnetSubnet
A slice of a VPC's addresses that lives in one Availability Zone.
Think of it asOne street on the estate.
Internet gatewayInternet gateway
The VPC's door to the public internet.
Think of it asThe estate's front gate.
Public IP addressPublic IP address
An address the whole internet can reach.
Think of it asA street address printed on the outside of the building.
Security groupSecurity group
A firewall attached to a network card, listing what traffic is allowed in and out.
Think of it asA bouncer standing at one particular door, holding a guest list.
ENI (Elastic Network Interface)ENI (Elastic Network Interface)
A virtual network card that gives something an address in a subnet.
Think of it asA phone line installed in a particular room.
NAT gatewayNAT gateway
Lets things in private subnets reach out to the internet, while nothing can reach in.
Think of it asA one-way turnstile at the gate. Staff can go out, strangers can't walk in.
EC2 (Elastic Compute Cloud)EC2 (Elastic Compute Cloud)
Rent a virtual server by the second.
Think of it asRenting a computer you have to look after yourself.
ECS and FargateECS and Fargate
Run containers on AWS. With Fargate, AWS also runs the servers underneath.
Think of it asHanding over a packed lunchbox and letting someone else heat it up.
LambdaLambda
Upload a function; AWS runs it only when something calls it.
Think of it asA taxi. You pay for the ride, not for owning the car.
API GatewayAPI Gateway
A managed HTTPS front door that passes requests to your code.
Think of it asA receptionist who takes every visitor's request and phones the right person.
WebSocket (API Gateway WebSocket API)WebSocket (API Gateway WebSocket API)
An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.
Think of it asAn open phone line instead of sending letters back and forth.
IAM (Identity and Access Management)IAM (Identity and Access Management)
Decides who can do what to which AWS resource.
Think of it asThe building's security office that issues every badge.
IAM roleIAM role
An identity with permissions that something can "wear" temporarily. No password.
Think of it asA visitor badge that's handed out at the door and expires.
IAM policyIAM policy
A JSON document listing allowed (or denied) actions on resources.
Think of it asThe list of rooms printed on the back of a badge.
ARN (Amazon Resource Name)ARN (Amazon Resource Name)
The unique full name of an AWS resource.
Think of it asA full postal address, down to the flat number.
Temporary credentialsTemporary credentials
Short-lived AWS keys handed out for a role, which expire automatically.
Think of it asA wristband that's only valid for today.
Service-linked roleService-linked role
A role an AWS service creates and owns so it can act in your account on its own behalf.
Think of it asA contractor's own access badge, issued and controlled by the contractor's company.
iam:PassRoleiam:PassRole
The permission to hand an existing role to an AWS service.
Think of it asBeing allowed to lend your colleague's key card to a contractor.
RDS (Relational Database Service)RDS (Relational Database Service)
A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.
Think of it asA filing cabinet with a librarian AWS employs.
DynamoDBDynamoDB
A fully managed NoSQL database you use through AWS API calls.
Think of it asA giant labelled locker wall where you fetch lockers by their exact key.
S3 (Simple Storage Service)S3 (Simple Storage Service)
Unlimited storage for files ("objects") in containers called buckets.
Think of it asA warehouse of labelled boxes you can reach from anywhere.
CloudWatch LogsCloudWatch Logs
Where applications and AWS services send their log lines.
Think of it asThe building's logbook.
CloudTrailCloudTrail
A record of every AWS API call. Who did what, when, from where.
Think of it asThe building's CCTV and visitor book.
AWS ConfigAWS Config
Records how your resources are configured over time and checks them against rules.
Think of it asA building inspector with a notebook and a camera.
SQS (Simple Queue Service)SQS (Simple Queue Service)
A managed queue. One part of your system drops messages in, another takes them out later.
Think of it asA ticket rail in a restaurant kitchen. Waiters clip orders up, cooks take them down when ready.
Dead-letter queue (DLQ)Dead-letter queue (DLQ)
A side queue where messages go after failing too many times.
Think of it asThe "problem orders" tray, so one bad order doesn't block the kitchen.
You know every card in this set.
Turn off "Skip cards I know" or reset your progress.
Keys: Space flip · ← → move · K I know this · L still learning