AWS Certified Cloud Practitioner (CLF-C02) Comprehensive Review

Vocabulary practice flashcards covering core services, architectures, security models, billing mechanisms, and key mnemonics from the AWS Certified Cloud Practitioner (CLF-C02) cheat sheet.

AWS CloudTrail

A governance and auditing service that records API calls, user actions, and account activity to answer who did what, when, and from where.

Amazon CloudWatch

A monitoring and observability service that tracks metrics, collects log files, monitors performance dials live, and triggers alarms when thresholds such as CPU usage or spending limits are breached.

AWS Config

A management service that evaluates compliance rules, tracks resource configurations over time, and records what configuration changed.

AWS Trusted Advisor

An advisory tool that evaluates accounts against best practices across five core categories: cost optimization, performance, security, fault tolerance, and service limits.

Amazon GuardDuty

An intelligent threat detection service that continuously analyzes AWS logs and activity to identify malicious, unauthorized, or unusual behavior.

Amazon Inspector

An automated vulnerability management service that scans Amazon EC2 instances and container images for software vulnerabilities and unintended network exposure.

Amazon Macie

A data security and privacy service that uses machine learning and pattern matching to discover, monitor, and protect sensitive data, such as personally identifiable information (PII), stored in Amazon S3 buckets.

AWS Security Hub

A central security control room that aggregates, organizes, and prioritizes security findings and alerts from services like GuardDuty, Inspector, and Macie into a single unified view.

AWS Identity and Access Management (IAM)

The central identity service that manages users, groups, roles, and policies to enforce least-privilege access and grant temporary credentials without long-term passwords.

Principle of Least Privilege

An IAM security best practice that dictates giving identity entities and roles only the exact minimum permissions necessary to complete their required tasks.

Amazon Cognito

An identity platform providing sign-up, sign-in, and access management specifically for external customers and end-users of mobile and web applications, rather than internal AWS staff.

AWS Key Management Service (AWS KMS)

A managed encryption service that makes it easy to create and control cryptographic keys used to encrypt data across AWS services and applications.

AWS CloudHSM

A cloud-based dedicated Hardware Security Module (HSM) appliance under the direct administrative control of the customer for meeting strict corporate and regulatory compliance.

AWS WAF

A web application firewall that monitors and filters Layer 7 HTTP/HTTPS traffic to defend web applications against common web exploits like SQL injection and cross-site scripting (XSS).

AWS Shield

A managed Distributed Denial of Service (DDoS) protection service providing automatic inline mitigation (Standard is free; Shield Advanced is a paid, expanded tier).

AWS Secrets Manager

A credential management tool designed to securely store, rotate, manage, and retrieve database credentials, API keys, and other application secrets automatically.

AWS Artifact

A central compliance audit repository that provides on-demand access to AWS security and compliance documentation, certifications, agreements, and SOC/PCI reports.

AWS Shared Responsibility Model

A security framework dividing accountability: AWS manages security OF the cloud (physical infrastructure, hardware, data centers, host facilities, and managed hypervisors), while the customer manages security IN the cloud (customer data, IAM, OS patching on EC2, firewall rules, and encryption).

Security Group

A virtual, stateful firewall operating at the instance level that evaluates allow-only rules for inbound and outbound network traffic.

Network Access Control List (Network ACL)

A stateless subnet-level security boundary that inspects inbound and outbound network traffic using numbered rules containing explicit allow and deny statements.

Amazon Elastic Compute Cloud (Amazon EC2)

A web service providing secure, resizable compute capacity via virtual servers with full administrative control over the guest operating system and configuration.

On-Demand Instances

An Amazon EC2 pricing model with no upfront payment or long-term commitment, offering maximum flexibility at the highest hourly unit cost for short-term or unpredictable workloads.

Savings Plans

A flexible pricing model offering substantial cost savings in exchange for a committed consistent compute spend per hour over a $1$-year or $3$-year period across instance families and regions.

Reserved Instances

A billing model offering significant discounts compared to On-Demand pricing based on a steady, predictable usage commitment of $1$ or $3$ years.

Spot Instances

An EC2 purchasing option enabling the use of spare AWS compute capacity at up to $90\%$ discounts, suitable for fault-tolerant workloads because instances can be reclaimed with a $2$-minute notice.

Dedicated Hosts

Physical servers dedicated entirely to a single customer's use, primarily chosen to satisfy strict regulatory compliance or specific per-socket/per-core software licensing requirements.

AWS Lambda

A serverless compute engine running event-driven code in response to triggers with zero server management, priced per request and execution duration, with a maximum execution limit of $15$ minutes.

AWS Elastic Beanstalk

A platform-as-a-service deployment tool that automatically handles provisioning, load balancing, scaling, and health monitoring when application code is uploaded, while the customer retains underlying resource ownership.

AWS Fargate

A serverless compute engine for containerized applications running on Amazon ECS or Amazon EKS without requiring users to provision, manage, or scale EC2 instances.

Amazon Lightsail

An easy-to-use virtual private server service bundling compute, storage, networking, and DNS at a low, predictable monthly price for simple websites and starter workloads.

Amazon Simple Storage Service (Amazon S3)

An object storage service designed for $99.999999999\%$ ($11$ nines) durability, organizing unstructured data into objects within globally named, regionally hosted buckets.

Amazon S3 Glacier Deep Archive

The lowest-cost, slowest storage tier in Amazon S3 designed for long-term data archiving where retrieval times of multiple hours are acceptable.

Amazon Elastic Block Store (Amazon EBS)

Persistent block-level storage volumes attached directly to a single Amazon EC2 instance, behaving like a virtual hard drive that survives instance stoppage.

EC2 Instance Store

Temporary, ephemeral block storage directly attached to the host computer of an EC2 instance, where data is completely lost when the instance is stopped or terminated.

Amazon Elastic File System (Amazon EFS)

A managed, serverless Network File System (NFS) that scales storage capacity automatically and provides shared file storage accessible by multiple Linux EC2 instances simultaneously.

Amazon Relational Database Service (Amazon RDS)

A managed relational database engine supporting SQL systems like MySQL, PostgreSQL, MariaDB, Oracle, and Microsoft SQL Server, with automated provisioning, patching, and Multi-AZ capabilities.

Amazon Aurora

An enterprise-grade, AWS-engineered relational database engine compatible with MySQL and PostgreSQL, delivering superior speed, enhanced availability, and an auto-scaling serverless option.

Amazon DynamoDB

A fully managed, serverless NoSQL database service delivering seamless scalability and single-digit millisecond response times for massive key-value and document workloads.

Amazon Redshift

A petabyte-scale, column-oriented cloud data warehouse optimized for online analytical processing (OLAP) and complex business intelligence reporting across massive historical datasets.

Amazon ElastiCache

An in-memory data store supporting Redis and Memcached designed to accelerate application performance by caching frequently retrieved queries in RAM to reduce database load.

Amazon Virtual Private Cloud (Amazon VPC)

A logically isolated virtual network provisioning space within AWS where resources reside within customized subnets, IP ranges, routing tables, and network gateways.

Amazon Route 53

A highly scalable cloud Domain Name System (DNS) web service providing domain registration, global traffic routing, and endpoint health checks.

Amazon CloudFront

A global Content Delivery Network (CDN) service that caches data, videos, and web traffic at worldwide edge locations to minimize latency for end users.

Application Load Balancer (ALB)

An Elastic Load Balancing component that routes traffic at OSI Layer 7 (HTTP/HTTPS) utilizing advanced path-based, host-based, and query parameter routing rules.

Network Load Balancer (NLB)

An Elastic Load Balancing option operating at OSI Layer 4 (TCP/UDP) capable of managing millions of requests per second with ultra-low latency.

AWS Direct Connect

A dedicated physical private network link connecting an on-premises data center directly into AWS, bypassing the public internet for consistent bandwidth and reduced data transfer costs.

AWS Site-to-Site VPN

A fast-to-deploy IPsec connection that creates an encrypted virtual tunnel over the public internet between an on-premises network and an Amazon VPC.

Amazon Simple Queue Service (Amazon SQS)

A fully managed message queuing service operating on a pull model that decouples and coordinates distributed application components.

Amazon Simple Notification Service (Amazon SNS)

A push-based publish/subscribe messaging service that broadcasts notifications from publishers to many subscribed endpoints, such as emails, SMS, and other AWS services.

Amazon EventBridge

A serverless event bus service that routes real-time data events from applications and AWS services to target destinations based on configured rules or schedules.

AWS Step Functions

A visual workflow orchestration service that sequences and coordinates multiple distributed services and AWS Lambda functions with branching logic, error handling, and retries.

Amazon Athena

A serverless interactive query service that analyzes data stored in Amazon S3 directly using standard SQL syntax without managing underlying database infrastructure.

AWS Glue

A serverless data integration engine used to discover, catalog, clean, enrich, and transform data (extract, transform, load / ETL) for analytics.

Amazon EMR

A managed big data platform designed to process vast amounts of unstructured data using open-source distributed frameworks such as Apache Hadoop and Apache Spark.

Amazon Kinesis

A managed streaming platform engineered for real-time ingestion, processing, and analysis of large-scale streaming data feeds.

Amazon QuickSight

A cloud-native business intelligence (BI) service that connects to data sources to build interactive dashboards, charts, and visualizations.

AWS CloudFormation

An Infrastructure as Code (IaC) tool that provides a common declarative template language to model, automate, and provision AWS resources consistently.

AWS Systems Manager

A management hub providing unified operational control and automated remote management, configuration, and patching across large fleets of servers and instances.

AWS Organizations

An account governance service that consolidates multiple AWS accounts under single administration, enabling unified billing, volume discounts, and centralized policy enforcement.

Service Control Policies (SCPs)

Central governance rules applied within AWS Organizations that establish explicit permission guardrails by restricting actions across accounts (they can only restrict permissions, never grant them).

Amazon SageMaker

A comprehensive end-to-end machine learning platform that equips developers to build, train, tune, and deploy machine learning models at scale.

AWS Snow Family

A collection of physical, ruggedized hardware appliances (Snowcone, Snowball, and Snowmobile) used to migrate large volumes of data physically to AWS when network bandwidth is too slow.

AWS Database Migration Service (AWS DMS)

A managed data transfer engine designed to move relational databases, NoSQL stores, and data warehouses into or across AWS with minimal downtime.

AWS Cost Explorer

A financial visualization tool that allows users to graph historical spending trends, inspect past costs filtered by service or tag, and forecast future expenditure.

AWS Budgets

A cost monitoring service that sets customized spending limits and triggers automated notifications when actual or forecasted costs exceed specified thresholds.

AWS Cost and Usage Report (CUR)

The most granular and comprehensive cost and usage dataset provided by AWS, delivering itemized billing records directly to an Amazon S3 bucket for in-depth analysis.

Enterprise Support Plan

The premier AWS support tier offering a designated Technical Account Manager (TAM), Concierge operations, and guaranteed response times under $15$ minutes for business-critical system down events.