DevOps and AWS glossary

A

ACM (AWS Certificate Manager)

The AWS service that issues free TLS certificates for your domains and renews them automatically. Certificates for CloudFront must be created in us-east-1. Static site on S3 and CloudFront

AWS Budgets alert

An email or SNS message AWS sends when your actual or forecast spend passes a limit you set, so the first warning is not the invoice. 3 quick ways to cut your AWS bill

B

Base64

A way to write binary data as plain text. It is encoding, not encryption: anyone can decode it in one command. Base64 is not encryption

C

CIDR block

A range of IP addresses written as a base address and a prefix, like 10.0.0.0/16. A smaller prefix number means a bigger range. How to plan VPC CIDR ranges

CloudFront

AWS’s content delivery network. It serves your site from locations close to visitors and can read from a private S3 bucket through Origin Access Control. Static site on S3 and CloudFront

CloudTrail

The AWS log of who did what in your account and when. Without it, you cannot investigate an incident. 3 AWS IAM mistakes

CloudWatch alarm

A rule that watches a metric, such as errors or CPU, and sends a notification when it crosses a threshold for a set time. AWS alerts before your customers notice

Concurrency group (GitHub Actions)

A setting that lets only one workflow run with the same group name at a time, so two deploys or two Terraform applies never overlap. How to unlock Terraform state

Cron expression

A short schedule format, such as 0 9 * * 1-5 for 09:00 on weekdays. Standard cron has 5 fields; AWS EventBridge uses 6. Cron expression generator

E

EBS volume

A disk attached to an EC2 instance. It keeps billing even when the instance is stopped or the volume is no longer attached. 3 AWS charges billing you for nothing

EKS

Amazon’s managed Kubernetes service. AWS runs the control plane; you run the worker nodes and your apps. Kubernetes and EKS setup

Elastic IP / public IPv4

A fixed public IP address. AWS charges for every public IPv4 address, including ones not attached to anything. 3 AWS charges billing you for nothing

EventBridge schedule

The AWS way to run something on a timer. Its cron format has 6 fields and needs a question mark in either day-of-month or day-of-week. Cron expression explainer

G

gp3 (EBS volume type)

The current general-purpose EBS volume type: 20% cheaper per GB than gp2, with 3,000 IOPS and 125 MiB/s included at any size. A gp2 volume can be switched to gp3 while in use. gp2 vs gp3

I

IAM role

An AWS identity with permissions but no permanent password or keys. People and services assume it to get short-lived credentials. 3 AWS IAM mistakes

Infrastructure as code (IaC)

Describing servers, networks and permissions in code files, so they can be reviewed, versioned and rebuilt the same way every time. Terraform consulting

J

JWT (JSON Web Token)

A signed token made of three Base64URL parts: header, claims and signature. The claims are readable by anyone, so never put secrets in them. Base64 and JWT decoder

K

KMS key

An encryption key managed by AWS Key Management Service. You control who can use it, and every use is logged. Terraform remote state with KMS

Kubernetes Secret

An object for passwords and keys. By default its values are only Base64 encoded, so protect it with RBAC and encryption at rest. Base64 is not encryption

L

Least privilege

Giving each person or service only the permissions it needs for its job, and nothing more. IAM and S3 policy checker

O

OIDC (OpenID Connect)

A way for GitHub Actions to prove its identity to AWS and get short-lived credentials, instead of storing access keys as secrets. GitHub Actions to AWS without keys

Origin Access Control (OAC)

The CloudFront setting that lets a distribution read from a private S3 bucket, so the bucket never has to be public. Your S3 bucket should never be public

R

Readiness probe

A Kubernetes check that tells the cluster when a pod is ready for traffic. Without it, users hit pods that are still starting. 3 Kubernetes mistakes that crash pods

Remote state (Terraform backend)

Keeping the Terraform state file in shared storage such as S3 instead of on one laptop, so the whole team uses the same state. Terraform remote state on S3

Requests and limits (Kubernetes)

How much CPU and memory a container is guaranteed (request) and the most it may use (limit). Missing values let one pod starve the others. 3 Kubernetes mistakes that crash pods

S

S3 lifecycle rule

A bucket rule that moves old objects to cheaper storage or deletes them after a set number of days. 3 quick ways to cut your AWS bill

S3 versioning

A bucket setting that keeps every previous version of an object, so you can restore a file that was overwritten or deleted. Recover a damaged Terraform state

SNS (Simple Notification Service)

The AWS service that delivers a message to email, SMS, Slack (through a webhook) or other services when something happens. AWS alerts before your customers notice

State lock (Terraform)

A marker Terraform writes while a plan or apply runs, so a second run cannot change the same state at the same time. How to unlock Terraform state

Subnet

A slice of a VPC’s IP range in one availability zone. AWS reserves 5 addresses in every subnet. VPC CIDR and subnet calculator

T

terraform force-unlock

The command that removes a stuck Terraform state lock by its lock ID. Only use it when no other apply is running. How to unlock Terraform state

Terraform state

The file that records which real resources your Terraform code created. Lose it and Terraform no longer knows your infrastructure exists. 3 Terraform mistakes that cost hours

V

VPC

Your private network inside AWS. Its IP range is hard to change later, so plan it with room to grow. How to plan VPC CIDR ranges

Y

YAML

The indentation-based format used by Kubernetes manifests and GitHub Actions workflows. A single tab or wrong indent can break a deploy. 3 YAML mistakes that break deploys

Guides by topic

• AWS cost
• Terraform
• CI/CD
• AWS security
• Kubernetes
• Monitoring