Glossary

149 terms from AWS for Developers, in plain words, each with the chapter that teaches it.

Search the glossary

#

$default route / $default stage: The `$default` route catches every request no other route matches, and the `$default` stage serves the API at its base URL and updates itself when you change the API. Quick create makes both for you.
--query / --output: Options that work on every CLI command. `--output` picks json, table or text, and `--query` picks out parts of the answer using JMESPath.

A

Access keys: A long-lived key ID and secret made in IAM for the CLI or SDK. They never expire on their own, so a leaked one works for anyone until you delete it.
Account alias: A friendly name such as `kettle-and-crane` that replaces the 12-digit account ID in your IAM sign-in URL.
Account ID: The 12-digit number that identifies your AWS account, such as 111122223333. It appears in sign-in URLs and ARNs, and Kettle & Crane adds it to bucket names to make them unique.
Alarm: A CloudWatch feature that watches one metric and changes state (OK, ALARM, INSUFFICIENT_DATA) when it crosses a threshold. It can publish to an SNS topic, such as emailing Alex when `kc-notifier` has errors.
Always Free: Monthly usage allowances for about 30 services, such as 1 million Lambda requests, that never expire on either plan.
API (application programming interface): A set of web requests, such as "create a bucket" or "run this function", that a program or person can send to a service. Every AWS service is reached through its API.
API Gateway: The AWS service that gives your code a public HTTPS URL. It receives HTTP requests from the internet, hands each to a Lambda function and returns the answer.
API ID: The identifier AWS picks for an API, which forms the first part of its invoke URL (such as `a1b2c3d4e5`).
ARN (Amazon Resource Name): The full, unique name of one thing in AWS, written as colon-separated parts: partition, service, region, account and resource. Policies use ARNs in `Resource` to say exactly what a rule covers.
Assume a role: To take on a role's identity and receive short-lived credentials. A trust policy decides who is allowed to do it.
Attribute: One named value inside a DynamoDB item, such as `cafe` or `total`. Items in the same table can have different attributes.
Aurora: AWS's own database engine that speaks PostgreSQL or MySQL. Aurora Serverless grows and shrinks with load.
Automated backups: Daily RDS backups kept for the number of days you set (up to 35), letting you restore the database to any point in that time.
Availability Zone: One or more separate data centers inside a region, with their own power. Services like S3 and DynamoDB copy your data across AZs so one building failing doesn't lose it.
AWS (Amazon Web Services): The largest cloud provider, offering more than 200 services such as S3, Lambda and DynamoDB that you rent and pay for by use.
aws login: A CLI command that reuses your console sign-in to give the terminal short-lived credentials. They refresh every 15 minutes for up to 12 hours, after which you log in again. It's a safer alternative to long-lived access keys.
AWS managed policy: A ready-made policy written and maintained by AWS, such as `AdministratorAccess` (everything) or `AWSLambdaBasicExecutionRole` (write logs only). You attach it by name.
AWS Pricing Calculator: A free web tool where you pick services and expected use to estimate a monthly bill before you build.

B

batchItemFailures: The list a queue-reading Lambda returns naming the message IDs that failed. Lambda deletes the rest of the batch and retries only those.
Block Public Access: An S3 setting that stops a bucket's objects from being made public. It is on for new buckets and should normally be left on, so objects stay private unless a policy allows access.
boto3: The AWS SDK for Python. You make a client or resource for a service and call its operations as methods.
Bucket: A named S3 container for objects, created in one region. Its name must be unique across every AWS account, such as `kc-shop-images-111122223333`.
Budget: A spending threshold that emails you when actual or forecast cost crosses a line you set. It only warns and doesn't stop anything.

C

CLI (command line interface): The `aws` command you type in a terminal to call AWS. Every command has the shape `aws <service> <operation> --option value`.
Client (boto3): A boto3 object for one AWS service whose methods match the CLI operations and return plain dicts. For DynamoDB it requires typed values like `{"S": "KC-1001"}`.
ClientError: The exception boto3 raises when AWS refuses a request. The error code is in `e.response["Error"]["Code"]`.
Cloud: Using someone else's computers over the internet, rented by the minute instead of bought.
CloudFormation, CDK and SAM: AWS's own infrastructure-as-code tools, which build stacks of resources from files so changes are repeatable. They are a natural step beyond a hand-written script like `deploy.sh`.
CloudTrail: The service that records API calls in your account (who, when, from where, what). Its Event history shows the last 90 days of management events for free.
CloudWatch: AWS's monitoring service. CloudWatch Logs collects everything your functions print, and it also holds metrics and alarms.
Cognito, CloudFront, Route 53, SES, Step Functions: Five AWS services worth exploring after the basics: Cognito (customer sign-in), CloudFront (fast file delivery worldwide), Route 53 (DNS), SES (email to customers) and Step Functions (multi-step workflows).
Cold start: The extra fraction of a second when Lambda prepares a fresh environment for the first call after a quiet spell. Later calls reuse it and are faster, which is why clients are made outside the handler.
Conditional write: A DynamoDB write that happens only if a condition is true, such as `attribute_not_exists(order_id)`. If it fails, nothing is written and boto3 raises a ClientError, so an existing order isn't overwritten.
Console: The AWS website where you click instead of typing commands.
Context (Lambda): The second argument of a Lambda handler: an object with details about this invocation, such as how much time is left. Simple handlers ignore it.
CORS (cross-origin resource sharing): The browser rule that lets a web page on one site call an API on another only if the API allows it. You allow `shop.kettleandcrane.com` in the API's CORS configuration.
Cost allocation tag: A tag key you activate in billing so Cost Explorer can group the bill by it, such as by `project`.
Cost Explorer: The console tool that charts your costs grouped by service, region or tag.
Credentials chain: The fixed order in which the CLI and SDKs look for credentials: environment variables, then the profile, then a role when running inside AWS. It's why Lambda code needs no change to get credentials.
curl: A command-line tool that sends an HTTP request and prints the reply. With `-X`, `-H` and `-d` you set the method, a header and the body.

D

Data transfer out: Data sent from AWS to the internet, which is charged per GB.
DB instance: A running database server in RDS, billed by the hour whether used or not. Its instance class, such as `db.t4g.micro`, sets its size.
Dead-letter queue: An ordinary queue that collects messages that failed too many times, so `kc-notify-dlq` holds the orders the notifier can't handle until the bug is fixed.
Decimal: Python's exact decimal number type. DynamoDB returns numbers as `Decimal` and refuses floats, which suits prices like `Decimal("55.00")`.
Decorator: A line like `@mock_aws` placed above a function that wraps it with extra behavior.
Decoupling: Letting parts of an app work at their own pace by passing messages between them, so a slow email service doesn't make customers wait and one failure doesn't break the rest.
Dimension: In CloudWatch, a namespace such as `AWS/Lambda` groups metrics by service, and a dimension such as `FunctionName` says which resource a number is for.
DynamoDB: AWS's serverless NoSQL database. You store items in tables, find them by key and pay per request.

E

Encryption at rest, in transit: Data scrambled on disk (S3 and DynamoDB do this by default) and data sent over HTTPS.
Endpoint (RDS): The host name of an RDS instance, ending in `.us-west-2.rds.amazonaws.com`, that your code connects to (PostgreSQL listens on port 5432).
Engine: The database software RDS runs for you, such as PostgreSQL.
Environment variable: A named setting your terminal or Lambda passes to a program. Code reads it with `os.environ`, which keeps names like tables and passwords out of the source.
Event: The JSON document, turned into a Python dict, that a trigger sends to a Lambda function, such as `{"name": "Sam"}`.
Event source mapping: Lambda's link that reads a queue for you and invokes your function with batches of messages in `event["Records"]`.
EventBridge: A related AWS service that routes events by rules and schedules.
Execution role: The role a Lambda function runs as. It holds the permissions the function needs, at least writing its logs.

F

Fan-out: One published SNS message being delivered as a copy to every subscriber.
file:// and fileb://: CLI prefixes that read a value from a file. `file://` reads text such as a policy, and `fileb://` reads raw bytes such as a zip.
Free plan and paid plan: The free plan gives new accounts credits and can't be charged; it ends after six months or when the credits run out. The paid plan unlocks every service and charges for use beyond your credits.

G

GB-seconds: Lambda's compute unit: memory in GB multiplied by run time in seconds. A 128 MB function running 2 seconds uses 0.25 GB-seconds.
Global secondary index: A second copy of a DynamoDB table's data, keyed on another attribute, that you can query. It's an alternative to scanning.

H

Handler: The function in your code that Lambda calls for each event, written `lambda_handler(event, context)`. The `--handler` option names it as file name, a dot, and function name.
HTTP: The language of the web. A request has a method (GET to read, POST to send data), a path, headers and sometimes a body; the reply carries a status code.
HTTP API: API Gateway's simpler, cheaper kind of API, which gives a Lambda function a public URL. A REST API has more features but costs more.
HTTP status codes: The number in an HTTP reply saying how the request went: 200 OK, 201 created, 400 bad request, 404 not found, 500 server error.

I

IAM (Identity and Access Management): The AWS service that decides who can do what in your account, using users, groups, roles and policies. It has no charge.
IAM Access Analyzer: An IAM console tool that lists resources shared outside your account, such as a public bucket.
IAM user and group: A user is one person (or program) with their own sign-in; a group is a set of users that share permissions. You use an IAM user for everyday work instead of root.
Infrastructure as code: Building cloud resources from files kept in Git so changes are repeatable and can be planned first, as Terraform does. It is often paired with OIDC, which lets GitHub Actions sign in to AWS with short-lived credentials instead of stored keys.
Inline policy: A policy stored inside one role or user rather than attached by name. It's deleted with the role and can't be attached elsewhere by accident.
Integration: What an API Gateway route sends requests to, here a Lambda function.
Invocation: One run of a Lambda function, started by a trigger or by `aws lambda invoke`.
Invoke URL: The address people call to reach an API Gateway API, such as `https://a1b2c3d4e5.execute-api.us-west-2.amazonaws.com`.
Item: One record in a DynamoDB table, such as one order. It's much like a Python dict.

J

JMESPath: A small language for searching JSON, used by the CLI's `--query`. A name picks a field, `[]` takes it from every list item and `[0]` takes the first.
JSON: A text format of names and values in braces that looks like a Python dict. AWS policies, events and API replies are written in it.

K

KMS (AWS Key Management Service): The service that keeps encryption keys, and can hold your own when a rule requires it.

L

Lambda: AWS's serverless compute service. You upload a function (your code plus settings) and AWS runs it when something triggers it, charging only for requests and run time.
Least privilege: Giving each user and role only the permissions its job needs, so a bug in `kc-orders-api` can reach only the one table and topic it uses.
Lifecycle rule: An S3 bucket rule that moves or deletes objects as they age, such as moving `reports/` to Glacier after 90 days.
Log group: A function's collection of logs in CloudWatch, named `/aws/lambda/` plus the function name. Each running copy of the function writes to its own log stream inside it.
Logging module: Python's standard module that adds a level (debug, info, warning, error) to each log line. In Lambda you call `logger.setLevel("INFO")` to see info lines.
Logs Insights: A CloudWatch console feature that runs queries over log groups and finds the fields in JSON log lines by itself.
Long polling: Asking SQS to wait up to 20 seconds for a message on an empty queue instead of answering "nothing" at once, which saves requests.

M

Message: A small piece of text, such as `{"order_id": "KC-1001"}`, passed between parts of an app through a queue or topic.
Metric: A number measured over time. Lambda sends `Invocations`, `Errors`, `Duration` and `Throttles` for every function with no code.
MFA (multi-factor authentication): Signing in with a second proof, such as a code from an authenticator app, passkey or hardware key, as well as the password.
moto: A Python library that fakes AWS inside your program. Under `@mock_aws`, boto3 calls go to moto's in-memory AWS, so tests create nothing real and cost nothing.

N

NAT gateway: A networking resource billed hourly plus per GB (over US$30 a month); like idle public IPv4 addresses, a classic source of surprise bills.
NoSQL: A kind of database that doesn't store rows in fixed columns and isn't queried with SQL, as with DynamoDB.

O

Object: An object is a file stored in S3. Its key is its full name, such as `photos/mug-blue.jpg`, and the part of the key before a slash is a prefix that the console shows like a folder.
On-demand: DynamoDB capacity billed per read and write, with nothing to size in advance.

P

Paginator: A boto3 helper that fetches every page of a long list, since many list calls return at most 1,000 items at once.
Parameter Store: The part of AWS Systems Manager that keeps named values. A SecureString parameter is encrypted, so it's a good place for secrets such as a carrier's API key.
Partition key: The attribute whose value places a DynamoDB item and finds it quickly, such as `order_id`. An optional sort key orders items that share a partition key, so `cafe` plus `order_date` groups a café's orders by date.
Payload format 2.0: The layout of the event API Gateway sends to a function, with keys such as `rawPath`, `queryStringParameters`, `pathParameters`, `headers` and a string `body`.
pip: Python's installer for libraries, such as `pip install boto3`.
Policy: A JSON document with Effect, Action and Resource that allows or denies actions. Everything is denied unless allowed, and an explicit Deny always wins.
Presigned URL: A normal web link with your permission built in: a signature and an expiry time. Anyone with it can download that one private object until it expires, as Priya might do with one invoice.
Principal: Who makes a request: a user, a role or a service. In a trust policy, `Principal` names who the rule is about.
Profile: A named section in `~/.aws/config` holding CLI settings and credentials. You get `default` unless you pass `--profile` or set `AWS_PROFILE`.
psycopg: The usual PostgreSQL library for Python, installed with `pip install "psycopg[binary]"`.

Q

Query, scan: The two DynamoDB reads. `query` reads the items sharing one partition key and is fast. `scan` reads every item in the table and is slow and costly on big tables.
Queue policy: A queue's permission list, such as one that lets the SNS service send messages to it.
Queue URL: The address programs use to name an SQS queue, such as `https://sqs.us-west-2.amazonaws.com/111122223333/kc-notify-queue`.
Quick create: One `create-api --target` command that makes an HTTP API, a Lambda integration, a `$default` route and a stage at once.

R

RDS (Relational Database Service): AWS's managed SQL database service. You pick an engine such as PostgreSQL and AWS installs, patches and backs it up, but you pay every hour it runs.
Receipt handle: The token from a particular receive that you use to delete an SQS message once handled.
Redrive policy: A main queue's setting that names a DLQ and a `maxReceiveCount`. After that many receives without a delete, SQS moves the message to the DLQ.
Region: A geographic group of AWS data centers with its own copy of most services, identified by a code such as `us-west-2` (Oregon). Most resources live in one region.
Request ID: A unique ID for one Lambda invocation, shown on the `START` line that Lambda adds to the logs, alongside the `END` and `REPORT` lines with timing and memory numbers.
Reserved word: A name DynamoDB expressions reserve, such as `status`. You write it through a `#name` placeholder in `ExpressionAttributeNames`, while `:name` placeholders stand for values.
Resource (boto3): A friendlier boto3 layer, such as `boto3.resource("dynamodb").Table(...)`, that takes plain Python values instead of typed ones.
Resource-based policy: A policy attached to a resource saying who may use it. A function's lists which services may invoke it, so you add API Gateway with `aws lambda add-permission`.
Retention: How long a log group keeps its logs before deleting them. Without it logs are kept forever and you keep paying.
Role: An identity with policies but no password. A principal allowed to assume it gets short-lived credentials, which is how a Lambda function gets permissions.
Root user: The account's first identity, created with your sign-up email and password. It can do anything and can't be limited, so protect it with MFA and use it rarely.
Route: A method and path in an API, such as `GET /hello` or `POST /orders`.
Runtime: The language and version Lambda runs your function's code with, such as `python3.14`. You choose it when you create the function.

S

S3 (Simple Storage Service): AWS's file storage service. It keeps objects in buckets and copies them across Availability Zones.
s3 commands (mb, cp, ls, sync, rm, rb): CLI commands that work like file commands. `mb` makes a bucket, `cp` copies a file, `ls` lists, `sync` copies only new or changed files, `rm` deletes (add `--recursive` for a prefix) and `rb --force` empties and removes a bucket.
SDK (software development kit): A library for calling AWS from your own code. Python's is boto3.
Secret: Any value that grants access, such as a password, a carrier's API key or a database login. Never put one in code or Git.
Secrets Manager: AWS's service for storing secrets that can also rotate a database password on a schedule. RDS keeps the master password there.
Security group: A firewall around a resource such as a database. It blocks everything coming in until you add an inbound rule, such as allowing port 5432 from your app's security group.
Serverless: Running code or services without managing any servers: AWS runs them and you provide only code and settings.
Shell function: A named group of shell commands, called like a command, with `$1`, `$2` and `$3` holding the values passed in. `deploy.sh` uses one to create both Lambda functions.
Snapshot: A database backup you take yourself and keep until you delete it.
SNS (Simple Notification Service): The service where you publish a message to a topic and SNS delivers a copy to every subscription (email, queue or function).
SQL: The language used to talk to relational databases such as PostgreSQL. RDS runs these for you.
SQS (Simple Queue Service): The service that keeps messages in a queue until a program takes them out and deletes them.
Stage: A published version of an API with its own base URL. The `$default` stage serves it and updates itself when you change the API.
Standard queue, FIFO queue: A standard SQS queue is very fast but may deliver a message twice or out of order. A FIFO (first in, first out) queue keeps order and delivers once, more slowly, and its name ends in `.fifo`.
Storage class: An S3 setting that trades price against how fast files are read. S3 Standard suits often-read files, while Standard-IA and Glacier cost less to keep but more to read.
Structured logs: Log lines written as one JSON object each, so every value has a name and Logs Insights can search by field.
STS (Security Token Service): The service that hands out credentials. `aws sts get-caller-identity` reports whose credentials you're using.

T

Tag: A key and value attached to a resource, such as `project=shop`, used to see what a project costs.
Throttling: Refusing requests that arrive faster than a set rate. API Gateway caps requests per second, which protects your function and your bill.
Timeout: The longest one Lambda invocation may run before Lambda stops it: 3 seconds by default, up to 900.
Topic, subscription: A topic is an SNS channel you publish to. A subscription is its link to one receiver such as an email address, queue or function.
Trust policy: The part of a role that says who may assume it, such as "the Lambda service". Without it Lambda can't use the role at all.

U

uuid: Python's module for random unique IDs. The order API takes the first 8 characters of `uuid.uuid4().hex` in capitals to make IDs like `KC-5BFB2523`.

V

Versioning: An S3 bucket setting that keeps every old copy of an object when you overwrite or delete it. It protects against mistakes but costs storage.
Virtual environment: A private copy of Python in a project folder where installed libraries don't affect anything else. You activate it in each new terminal.
Visibility timeout: How long a received SQS message stays hidden from other receivers (30 seconds by default). If it isn't deleted in that time it reappears and is retried.
VPC (virtual private cloud): Your own private network inside AWS, where RDS databases live. Only code inside the VPC that a security group allows can reach a private database.

W

Wildcard: A `*` in a policy that matches anything, so `s3:*` is every S3 action and a `Resource` of `*` is every resource.