Glossary

167 terms from Virtualization and Cloud Basics, in plain words, each with the chapter that teaches it.

Search the glossary

A

access key: A permanent login for the API made of two parts: a key ID (starting AKIA) and a secret. The secret signs each request and is never sent. Priya's keys keep working until someone deletes them, which is why a leaked key is dangerous.
account: The container for everything a customer creates in AWS, with one bill. It is identified by a 12-digit number such as 123456789012.
Action: The part of a policy statement that names which API actions it covers, written `service:Action`, such as `s3:GetObject`. A `*` matches many, so `s3:*` means every S3 action.
AMI (Amazon Machine Image): The image an EC2 instance boots from: a golden image with an OS already installed. Image IDs such as ami-785db401 differ from region to region.
API (application programming interface): A set of requests one program can send to another. Every AWS action, from starting a server to listing files, is an API request. The console, the `aws` command and boto3 are all front ends to the same API.
API gateway: A managed front door that turns incoming web (HTTPS) requests into events that can start a serverless function, such as a form posted on the Kettle & Crane website.
apply: The Infrastructure as Code step that actually makes the changes shown in a plan. `python3 iac.py apply` creates and updates the buckets listed in stack.json.
ARN (Amazon Resource Name): The full name of anything in AWS, made of parts split by colons: arn, aws, the service, the region, the account and the resource, as in `arn:aws:iam::123456789012:user/priya`. Policies use ARNs to say which resources they cover.
auto scaling group: An AWS feature that keeps a number of identical instances running between a minimum and a maximum. It builds them from a launch template and replaces any that fail, the way the shop-web group did after an instance was killed.
autoscaling: Adding and removing servers automatically as the load changes, so nobody has to watch graphs at midnight before a holiday sale.
availability: The share of time a service works, given as a percentage and often counted in nines. 99.9% allows 8.76 hours of downtime a year (8,760 × 0.001).
availability zone (AZ): One or more data centers inside a region, with their own power, cooling and network, miles from the other zones. Zones fail separately, so servers spread over us-west-2a and us-west-2b survive the loss of one.
AWS CLI: AWS's official command-line tool, the `aws` command. Every command has the shape `aws SERVICE ACTION options`, such as `aws s3 mb`.

B

backing file: The image, usually a golden image, that a linked clone reads unchanged data from. test-a.qcow2's backing file is orders.qcow2, which must not change while clones depend on it.
block storage: Cloud storage that acts as a virtual disk. An instance puts a file system on it and reads it in small blocks. It is fast and attaches to one instance; AWS calls it EBS.
boto3: AWS's library for Python. Its client objects send the same API requests as the CLI, and each answer comes back as a Python dictionary.
broad network access: One of NIST's five cloud traits: everything is reached over the network, from any device.
bucket: A named container that holds objects (whole files) in object storage such as AWS S3. A bucket's name must be unique across all of AWS because it becomes part of a web address, so companies add a prefix such as `kc-` (as in `kc-product-photos`).

C

capital expense (CapEx): Money spent up front on something that lasts years, such as buying six servers for $18,000. Owning tends to suit steady loads.
CDN (content delivery network): A network of edge locations that keep copies of files, such as product photos, close to users so they load faster.
cgroup (control group): A kernel feature that limits how much memory, CPU time and disk speed a group of processes may use, and how many processes it may have. cgroups are folders under /sys/fs/cgroup, and you set limits by writing to their files.
CIDR block (Classless Inter-Domain Routing): An address range written as an address and a size, such as 10.0.0.0/16 for a whole VPC or 10.0.1.0/24 (256 addresses) for a subnet. A /32 means exactly one address.
client: A boto3 object for one AWS service, with one method per API action: ListBuckets becomes `list_buckets()`. shopstack.py makes one client each for EC2, S3, IAM and Auto Scaling.
cloud computing: Renting computing (servers, storage, networks and ready-made software) over the network from a provider, and paying only for what you use.
cloud provider: The company that owns the data centers and rents out cloud computing, such as AWS, Microsoft Azure or Google Cloud.
cold start: The slower first run of a serverless function after a quiet spell, while the platform starts a new copy. Keeping set-up code, such as making the boto3 client, outside the handler lets a warm copy reuse it.
community cloud: A cloud shared by several organizations with the same needs and rules, such as a group of hospitals.
consolidation: Moving several physical servers into VMs on one host, as Kettle & Crane does with its order, file and label servers.
container: An ordinary process that the kernel fences in, so it sees only its own files, processes and network and can use only limited resources. Every container shares the host's kernel, so it starts in a fraction of a second, but a Linux host runs only Linux containers.
container image: A packed root file system plus settings, such as which program to start, from which containers are made. It is built in layers and follows the OCI format.
container runtime: A program, such as Docker, Podman or containerd, that pulls an image and makes the namespaces, cgroup and network for a container with one command.

D

declarative: An Infrastructure as Code style in which the file describes the end state ("a bucket called X exists, with versioning on") and the tool works out the steps. Run it twice and the second run does nothing.
declare: The first Infrastructure as Code step: writing the desired state in a file, as stack.json does for three buckets.
delete marker: In a versioned bucket, a delete doesn't remove anything; it adds a placeholder that hides the object. Deleting the marker by its version ID brings the espresso note back.
deployment model: Who owns a cloud and who may use it: public, private, community or hybrid cloud, or multicloud.
desired capacity: How many instances an auto scaling group should run right now, always between its minimum and maximum. Alex raises it to 4 before a sale.
disk image: A file on the host that acts as a guest's disk, in a format such as raw, qcow2, VMDK, VHDX or VDI.
disk size: The space a disk image really takes on the host, as shown by qemu-img info. A new 1 GiB thin disk uses only 196 KiB.
drift: A difference between the Infrastructure as Code file and the real cloud, usually caused by a change made by hand. The next plan shows it, as when someone suspended versioning on kc-order-backups.

E

EBS (Elastic Block Store): AWS's block storage. Each disk is a volume that attaches to one instance in the same zone.
EBS snapshot: A copy of an EBS volume stored in S3, outside the zone. Later snapshots keep only changed blocks. A new volume can be made from it in any zone of the region.
EC2 (Elastic Compute Cloud): AWS's IaaS service for VMs, which it calls instances. The `aws ec2` commands also build VPCs, subnets, security groups and volumes.
edge location: A small provider site, in many more cities than there are regions, that holds copies of files near users as part of a CDN.
Effect: The part of a policy statement that says whether it allows or denies: "Allow" or "Deny".
emulation: Running a guest's machine code by acting out each instruction in software. It works on any CPU but is 10 to 50 times slower than hardware help.
ephemeral: Short-lived: when you delete a container its changes vanish, so lasting data must go in a folder kept outside it.
ETag: A checksum of an object's content stored with its metadata. For small uploads it is the content's MD5 hash.
event: A description of something that happened, such as a photo uploaded to a bucket, that starts a serverless function. It is passed to the handler as a dictionary; an S3 event holds a list of Records.
event notification: A bucket setting that sends an event to a function on every upload, so each new product photo gets checked.

F

FaaS (Functions as a Service): A service model in which your function runs only when an event happens and is billed per run, such as AWS Lambda. It is PaaS cut down to single functions.
failover: When one copy of a service fails and a healthy copy takes over its work.
file storage: Cloud storage that acts as a shared network folder (NFS or SMB) that many instances mount at once, such as AWS EFS.
full clone: A complete copy of a golden image, independent of the original.
function: In serverless computing, a small piece of code with one entry point, the handler, that runs when an event arrives, such as photo_added.py.

G

golden image: A disk image with the OS installed and set up the company's way, which new VMs copy instead of being installed from scratch. Cloud AMIs work the same way.
guest: A VM running on a host. Each guest has its own operating system, which believes it owns a whole computer.

H

handler: The entry point of a serverless function. Lambda calls `handler(event, context)` with the event that woke it up.
hardware-assisted virtualization: The CPU runs a guest's machine code directly at almost full speed, kept safe by features such as Intel VT-x or AMD-V.
health check: A regular "are you working?" test that a load balancer or auto scaling group runs against each instance. Instances that fail it get no traffic or are replaced.
high availability (HA): Running copies of a service, for example in two or more zones, so that no single failure stops it.
horizontal scaling: Adding more instances of the same size, behind a load balancer. There's almost no ceiling, but the app must be able to run as many copies.
host: The real machine that runs guests through a hypervisor. Alex sizes one with 8 cores and 32 GB of RAM.
hybrid cloud: Your own data center or private cloud joined to a public cloud, such as the order database in the back room with the shop's web servers in AWS.
hypervisor: The software that runs VMs and shares out the host's CPU, memory, disk and network among them. Whoever controls it controls every guest.

I

IaaS (Infrastructure as a Service): A service model that rents you VMs, disks and networks. You still manage the OS, runtime, app and data, as Alex does for the order system on EC2.
IAM (Identity and Access Management): The AWS service that checks whether the identity behind each request may do that action on that resource.
IAM group: A set of IAM users who share its permissions. Priya goes into a support group so the next support hire just joins it.
IAM role: An identity with no login of its own. A user, service or instance assumes it and gets temporary credentials, such as the photo-reader role that can only read photos.
IAM user: A person or program with a permanent login: a console password or access keys. priya and alex are IAM users.
idempotent: Giving the same result however many times you run it. A second `python3 iac.py` shows 0 changes, so it is safe to rerun.
imperative: A style in which the code lists steps ("create a bucket, turn on versioning"), so order matters and a second run may fail. shopstack.py is imperative.
Infrastructure as Code (IaC): Describing infrastructure in files kept in version control and letting a tool build from them, instead of typing commands that nobody can see later.
init: The first program the kernel runs after it starts; init starts everything else. The tiny VM's init is a short shell script.
inline policy: A policy that belongs to one identity only, like Alex's admin policy or the read-photos policy put inside the kc-shop role.
instance: A cloud VM. In AWS it boots from an AMI and has an instance type.
instance profile: The container that attaches a role to an instance, so programs on it get fresh temporary credentials automatically with no keys stored on the server.
instance type: An instance's size. t3.micro has 2 vCPUs and 1 GB of RAM; t3.large has 2 vCPUs and 8 GB.
internet gateway: A VPC's door to the internet. A subnet whose route table sends 0.0.0.0/0 to it is public, and it translates one-to-one between an instance's public and private addresses.
isolation: Keeping guests apart, so that one can't see or touch another's memory, files or processes. The label VM's bad update can't break the order system.

J

JSON: The text format most APIs use: names in quotes, a colon, then the value, all inside braces. AWS answers and IAM policies are written in it.

K

kernel: The core of an operating system, which controls the hardware, memory and processes. Each VM boots its own kernel, while every container shares the host's kernel.
key: An object's full name in a bucket, such as mugs/mug-blue.jpg. Keys are case-sensitive, and the slash is just part of the name.
KVM (Kernel-based Virtual Machine): The hypervisor built into the Linux kernel. Once it's loaded, Linux itself is a type 1 hypervisor, and AWS's Nitro is built on it.

L

launch template: A saved, versioned recipe for new instances (image, instance type, and optionally security group and instance profile) that an auto scaling group uses.
layer: One part of a container image, such as the base OS, the app or its settings. Containers from the same base share its layer on disk.
least privilege: Giving each identity only the access its job needs, like Priya's read-only access to the photo bucket.
lifecycle rule: A bucket rule that deletes old object versions after a time, say 90 days, or moves them to a cheaper storage class.
linked clone: A new, almost empty disk image that records only its own changes and reads everything else from a backing file. test-a.qcow2 is only 388 KB.
live migration: Moving a VM to another host while it keeps running.
load balancer: One address that passes each request to a healthy instance behind it. Horizontal scaling needs one.

M

managed policy: A named policy, such as read-photos, that you can attach to many users, groups and roles.
measured service: One of NIST's five cloud traits: use is metered and billed, often per second or per hour.
metadata: Facts about an object, such as its size, content type and ETag. `aws s3api head-object` returns only these.
microservices: An app split into small services, each doing one job with its own code. They talk over APIs, are often packed as containers, and scale separately.
monolith: One big program deployed and scaled as a whole, like Kettle & Crane's order system with catalog, cart, payments, stock and labels together.
moto: A free program that copies the AWS API on your own VM. It answers from memory, so nothing really runs, nothing is billed, and everything vanishes when it stops.
multicloud: Using two or more public providers, such as AWS for the shop and Google Cloud for reports.

N

namespace: A kernel feature that gives a process its own private copy of one kind of resource: process numbers (pid), mounts (mnt), host name (uts), network (net) or user IDs (user).
NAT gateway: Placed in a public subnet, it lets servers in a private subnet go out to the internet, for example for updates, without anyone coming in.
network ACL (access control list): A stateless filter for a whole subnet with both allow and deny rules, so replies must be allowed too. Most teams leave ACLs open and use security groups.
noisy neighbor: A guest that suddenly uses all the CPU or disk and slows the others on the same host.

O

object: A whole file kept in a bucket, along with its metadata. It is sent and fetched whole, so changing part of it means rewriting the whole object.
object storage: Cloud storage that keeps whole files as objects in buckets, reached over HTTPS. It holds any amount at the lowest price per gigabyte; AWS calls it S3, and Azure calls it Blob Storage.
OCI (Open Container Initiative): The open standard format for container images.
on-demand self-service: One of NIST's five cloud traits: you create resources yourself at any hour, as when Alex makes a test server at 11 p.m.
on-premises: The old way: your own servers in your own building, like Kettle & Crane's back room.
OpenTofu: An open-source copy of Terraform. It builds infrastructure from declarative files with plan and apply.
operating expense (OpEx): Spending that follows use, like a monthly cloud bill. It suits loads that jump up and down, such as the holiday rush.
orchestration: Running many containers on many hosts, restarting them and adding more as needed, for example with Kubernetes.
out-of-memory killer: The part of the kernel that kills a process when memory runs out or a cgroup's limit is passed. It stops it with KILL, so the exit code is 137.
overcommit ratio: Total vCPUs divided by real cores. Alex's plan is 10 / 8 = 1.25 to 1, and 3:1 to 4:1 is common for quiet servers.
overcommitment: Promising guests more than the host really has, such as more vCPUs than cores or more thin-disk space than the disk holds. It is fine for CPU but never for RAM.

P

PaaS (Platform as a Service): A service model that gives you a place to run your code. The provider patches the OS and runtime, and you manage the app and data.
permission policy: A policy attached to a role (or a user) that says what it may do once assumed, such as read-photos on the photo-reader role.
plan: The Infrastructure as Code step in which the tool compares the file with what exists and shows what it will create, change or delete, before anything is applied.
policy: A JSON document of statements, each giving an Effect, an Action and a Resource, that says what an identity may do. Everything starts denied, an explicit Deny wins, and otherwise a matching Allow permits.
prefix: The start of an object key up to a slash, such as mugs/, which tools show as a folder even though S3 has no real folders.
private cloud: Cloud software (self-service, pooling, metering) run for one organization only, as banks and hospitals do for control.
private subnet: A subnet with no route from the internet, where the shop's database goes. It can still reach out through a NAT gateway.
profile: A named set of CLI credentials saved in ~/.aws/credentials, or a role to assume. `--profile priya` sends a command as Priya.
public cloud: A cloud owned by a provider and open to any paying customer, such as AWS, Azure or Google Cloud.
public subnet: A subnet whose route table sends 0.0.0.0/0 to an internet gateway, so customers on the internet can reach the shop's web servers there.

Q

QEMU: A free program that makes a whole virtual PC (firmware, disk controller, network card and serial port). With KVM it uses the CPU's help; without it, it emulates.

R

rapid elasticity: One of NIST's five cloud traits: resources grow and shrink quickly, like four extra shop servers for the holidays.
region: A separate geographic area of a provider's data centers, such as us-west-2 (Oregon). Resources live in one region, and the same command in another region sees none of them.
registry: A store for container images, such as Docker Hub.
Resource: The part of a policy statement that names which things it covers, by ARN. Reading objects needs arn:aws:s3:::NAME/*, while listing needs the bucket's own ARN.
resource pooling: One of NIST's five cloud traits: many customers share the provider's hardware but are kept apart.
REST: An API style in which the URL names the thing (such as the bucket /kc-product-photos) and the HTTP method says what to do with it.
root user: The identity that comes with an AWS account and can do anything, even close the account. Use it only for rare tasks, protect it with multi-factor sign-in, and never make keys for it.
route table: A subnet's list of routes. Every VPC starts with a main table that has one local route for the VPC's own addresses. A subnet is public when its table adds 0.0.0.0/0 to an internet gateway.

S

S3 (Simple Storage Service): AWS's object storage. The `aws s3` commands mb (make bucket), cp, ls, rm and rb (remove bucket) work like file commands on s3:// paths.
SaaS (Software as a Service): A service model that gives you a finished app in the browser, such as Microsoft 365. You still manage your data, users and settings.
scaling policy: A rule that tells an auto scaling group when to change its desired capacity by itself, such as target tracking at 50% CPU.
security group: A stateful firewall around each instance that holds allow rules only. A new group allows all traffic out and nothing in, and the shop-web group lets in HTTPS from anyone and SSH only from the office.
serverless: Computing in which the servers are entirely the provider's: you upload code, it runs on demand, and you pay per run, by the millisecond.
service model: How much of the stack the provider manages for you: IaaS, PaaS, SaaS or FaaS.
shared responsibility model: The split of who keeps each layer safe: the provider secures the cloud itself, and you secure what you put in it. Your data, users and settings are always yours.
signature: Proof added to each API request, in its Authorization header, made from your secret key, the request and the time. It names your key ID but never contains the secret, and it is valid for only a few minutes.
snapshot: A saved state of a VM's disk (and sometimes memory) that you can return to, like before-v2 in orders.qcow2. A qcow2 snapshot grows as the guest writes and sits in the same file as the VM, so it is never a backup.
stateful: Remembering connections, so a reply to an allowed request is allowed automatically. Security groups are stateful.
stateless: Judging each packet on its own, so replies need their own rules. Network ACLs are stateless.
stop: Switching an instance off but keeping its disk. You stop paying for CPU hours, but the disk is still billed.
storage class: A price tier for objects. Cheaper classes suit old versions or backups that are rarely read.

T

tag: A name and value attached to any cloud resource. The Name tag is what the console shows, and shopstack.py tags everything kc-shop so it can find what it built.
target tracking: A scaling policy that keeps one measurement near a target, such as the group's average CPU at 50%, by scaling out and in.
TCG (Tiny Code Generator): QEMU's name for its emulation mode, used when the CPU's hardware help isn't available, as in the Multipass lab VM.
temporary credentials: Keys from a role that expire, typically after an hour, so a leak is short-lived. Servers get them through an instance profile.
terminate: Deleting an instance for good, disk and all.
Terraform: The best-known declarative Infrastructure as Code tool. It compares files with the cloud, shows a plan and applies the difference.
thick provisioning: Reserving a virtual disk's whole size on the host at once.
thin provisioning: A virtual disk file that grows only as the guest writes data. A 1 GiB qcow2 disk starts at 196 KiB, and if guests fill thin disks the host's disk can run out.
trigger: The service that sends the event that starts a function: a bucket upload, an API gateway request, a queue message or a timer.
trust policy: A role's policy that says who may assume it, such as the EC2 service and the user alex.
type 1 hypervisor: A hypervisor that runs straight on the hardware with no normal OS underneath, such as VMware ESXi, Hyper-V and KVM. It is faster and gives attackers less to aim at, so servers and clouds use it.
type 2 hypervisor: A hypervisor that runs as an app on a normal OS, such as VirtualBox on a laptop.

V

vCPU: A virtual CPU: a share of the real cores' time, run as a thread on the host. That's why one host can run more vCPUs than it has cores.
versioning: A bucket setting that keeps every version of each object instead of replacing it. Each version has an ID, and once on, versioning can only be suspended, not turned off.
vertical scaling: Moving to a bigger instance, such as from t3.micro to t3.large. It is simple, but the instance restarts and the biggest size is a ceiling.
virtual environment: A private folder of Python packages, such as ~/cloudlab, kept apart from Ubuntu's own. You activate it with source before using moto and the CLI.
virtual machine (VM): A computer that runs as a program inside another computer, with its own OS. It is really a description plus disk image files.
virtual size: The disk size the guest sees, such as 1 GiB, whatever space the file really uses.
virtual switch: Software inside a host that joins guests' virtual network cards, like the veth cables and bridges in the networking books.
virtualization: Making one physical machine act as many, each kept apart, so jobs can share the hardware. Networks, storage and desktops can be virtualized too.
VM sprawl: VMs that are so easy to make that nobody deletes them, so old ones run on unpatched. Keep a list of every VM with an owner.
volume: One EBS disk. It attaches only to an instance in the same zone, and shows available until it is attached.
VPC (virtual private cloud): Your own private network carved out of a provider's shared one, with a CIDR block, subnets, route tables and gateways. Other customers can't see it.