Cloud computing2

Compute Services

Provide dynamically scalable compute capacity in the cloud. Compute resources are provisioned on-demand in the form of virtual machines.

Machine Image

A template that contains a software configuration (operating system, application server, and applications). VMs can be created from standard images (e.g., Ubuntu, Windows server) or custom images created by users.

Amazon EC2

An Infrastructure-as-a-Service (IaaS) from Amazon that delivers scalable, pay-as-you-go compute capacity in the form of virtual machines launched in Amazon's cloud.

General Purpose instances (EC2)

Provide a balance of compute, memory, and network resources; well suited for a wide range of applications. Families: M4, M5, M5a, T2, T3, A1.

Compute Optimized instances (EC2)

Optimized for compute-intensive workloads; cost-effective high performance at a low price per compute ratio. Families: C4, C5, C5n.

Memory Optimized instances (EC2)

Optimized for memory-intensive applications. Families: R4, R5, R5a, X1, X1e, z1d.

Storage Optimized instances (EC2)

Optimized for workloads that require high disk throughput. Families: H1, I3, D2.

Accelerated Computing instances (EC2)

Intended for graphics and general-purpose GPU compute applications. Families: P2, P3, G3, F1.

Amazon Machine Image (AMI)

An instance template that contains the software configuration (operating system and applications) required to launch an instance. Based on Linux or Windows. Sources: AMIs published by AWS, AWS marketplace, Community AMIs, your own AMIs.

EC2 Security Group

Like a virtual firewall that controls the traffic coming in and going out of your instances. By default, all incoming traffic is denied. Rules allow traffic based on port, protocol, and source or destination.

Shared Tenancy

The default tenancy for EC2. Instances run on shared hardware, so a single host can host instances from different customers.

Dedicated Instances

Instances run on single-tenant hardware, meaning the hardware is dedicated to a single customer.

Dedicated Hosts

The instance runs on an isolated physical server solely dedicated to a single customer. Gives more visibility and control over instance placement, lets you deploy to the same physical server over time, and lets you use existing server-bound software licenses and meet compliance requirements.

On-Demand Instances

No upfront costs or commitments. Charged by the hour or second (minimum of 60 seconds). Fixed price and always available.

Reserved Instances

Recommended for long term use or predictable workloads to save significantly on cost. Payment can be all-upfront, partial-upfront or no-upfront.

Spot Instances

You specify the price you are willing to pay for an instance type. Operate on a bidding system and are not guaranteed to be available.

Placement Group

A logical grouping of instances that defines how instances are placed on the underlying hardware. Types: Cluster, Partition, Spread.

Cluster placement group

Clusters instances into a low-latency group in a single availability zone.

Partition placement group

Spreads instances across logical partitions, so instances in one partition do not share underlying hardware with instances in other partitions.

Spread placement group

Spreads instances across underlying hardware.

AWS EC2 Auto Scaling

Automatically scales EC2 capacity up or down according to user-defined conditions. Adds instances during spikes (e.g. holiday season) to meet performance requirements and scales down when workload is low (e.g. at night) to save costs.

Launch Configuration

A template used by Auto Scaling to launch new instances within an Auto Scaling Group. Comprises AMI, instance type, security group, and key pair. All instances in the group have the same configuration.

Auto Scaling Group

A collection of instances managed by the Auto Scaling service. Comprises a launch configuration, desired capacity, maximum capacity, and scaling policies.

Scaling Policy

Defines how to adjust the capacity of an Auto Scaling Group dynamically. Types: Target tracking, Step, Simple.

Target tracking scaling

Increases or decreases capacity based on a target value for a specific metric (CPU, RAM, Storage). Works like a thermostat maintaining the temperature you set.

Step scaling

Increases or decreases capacity based on step adjustments that vary based on the size of the alarm breach (e.g. CloudWatch alarm). Allows multiple thresholds with different scaling actions for each.

Simple scaling

Triggers a scaling action when a specific CloudWatch alarm is breached. Ex: when average CPU usage exceeds 70% for 5 minutes, add two instances.

AWS Elastic Load Balancing (ELB)

A managed service that creates load balancers for distributing traffic across a group of EC2 instances. Supports HTTP, HTTPS, TCP, and TLS/SSL traffic.

Application Load Balancer (L7 / Software LB)

For web applications with HTTP and HTTPS traffic. Operates at the request level and provides advanced routing and visibility features.

Network Load Balancer (L4 / Hardware LB)

For TCP and TLS connections. Operates at the connection level and handles millions of requests per second with ultra-low latencies.

Classic Load Balancer

The previous generation load balancer that supports HTTP, HTTPS, and TCP traffic.

Internet-facing vs. Internal load balancer

Internet-facing: receives requests from clients over the Internet and is assigned a public DNS name. Internal: routes requests from clients to targets using private IP addresses.

Listener (ELB)

A process that checks for connection requests using the protocol and port specified. Each load balancer can have one or more listeners.

Health Checks (ELB)

Used to detect unhealthy targets, stop sending traffic to them, and spread the load across the remaining healthy targets. You can set the interval, timeout, unhealthy threshold, and healthy threshold.

Sticky Sessions (ELB)

Routes all requests from a user in the same session to the same instance. Used for session-based applications.

Connection Draining (ELB)

Stops sending requests to instances that are de-registering or unhealthy while keeping existing connections open so in-flight requests can complete. Max timeout is between 1 and 3600 seconds (1 hour).

Amazon Virtual Private Cloud (VPC)

Lets you create a virtual network within the AWS public cloud. An isolated portion of the AWS cloud where you can launch EC2 instances, RDS databases, and other resources, similar to a traditional on-premises network.

Subnet

A range of IP addresses in a VPC in which you can launch AWS resources. Can be public, private, or VPN-only. IP block is specified in CIDR format (e.g., 10.0.0.0/24), between /16 (65,536 IPs) and /28 (16 IPs).

Public Subnet

A subnet whose traffic is routed to the Internet using an Internet Gateway. Used for resources that must be connected to the Internet.

Private Subnet

A subnet that doesn't have a route to an Internet Gateway. Used for resources not connected to the Internet. Reaches the internet through a NAT Gateway in the public subnet.

VPN-only Subnet

A subnet that has a route to a Virtual Private Gateway and doesn't have a route to an Internet Gateway.

Internet Gateway (IGW)

A virtual router that connects a VPC to the Internet. Horizontally scaled, redundant, and highly available. Performs NAT for instances with public IPv4 addresses (translates between public and private IPs).

Network Address Translation (NAT)

A service that enables private IP networks to use the internet and cloud. Translates private IP addresses in an internal network to a single public IP address before packets are sent to an external network.

Route Table

Contains a set of rules that specify how network traffic is directed between subnets, the Internet, and VPN connections. A subnet can be associated with only one route table at a time. Every VPC has a main route table created automatically.

NAT Instance vs. NAT Gateway

Both let instances in a private subnet connect to the Internet while blocking connections from the Internet. A NAT instance is an EC2 instance with a NAT AMI and can be a single point of failure. AWS recommends NAT gateways for better availability and bandwidth.

Network ACL

An optional layer of security that acts as a firewall for controlling traffic in and out of a subnet. The default network ACL allows all inbound and outbound traffic.

Network ACL vs. Security Group

Network ACL: subnet level, allow and deny rules, stateless (return traffic must be explicitly allowed), rules processed in numerical order. Security Group: instance level, allow rules only (whitelisting), stateful (return traffic automatically allowed), all rules evaluated.

Security Group (VPC)

A virtual and stateful firewall for an instance to control inbound and outbound traffic. Allows allow rules (whitelisting), not deny rules (blacklisting). Default security group allows inbound traffic from the same group and all outbound traffic.

VPC Endpoint

A virtual device that lets you privately connect your VPC to supported AWS services without an Internet Gateway, NAT device, VPN, or Direct Connect. Traffic does not leave the Amazon network. Types: interface and gateway.

Interface Endpoint vs. Gateway Endpoint

Interface endpoint: an Elastic Network Interface (ENI) with a private IP that is an entry point to a service (EC2 API, SNS, SQS, API Gateway, CloudWatch, Kinesis). Gateway endpoint: a target for a route in your route table (Amazon S3 and DynamoDB).

DHCP (Dynamic Host Configuration Protocol)

Provides a standard for passing configuration information to hosts on a TCP/IP network. AWS automatically creates a DHCP option set for your VPC with domain-name (ec2.internal) and domain-name-servers (AmazonProvidedDNS).

VPC Peering

A networking connection between two VPCs that lets instances in either VPC communicate as if they are within the same network. The requester VPC sends a request and the accepter VPC accepts it. Each owner must manually add routes to their route tables.

Site-to-Site VPN

A connection between your VPC and your on-premises network. Consists of a virtual private gateway (VPG) and customer gateway (CGW).

AWS Client VPN

A managed client-based VPN service that lets you securely access your AWS resources from your on-premises network by connecting to an endpoint to establish a secure TLS VPN session.