Tauseef FayyazA to Z
Glossary
Every concept in this sheet, plus the smaller terms it uses. Select a concept to open its card.
A
- Accounts and the root user
- An AWS account is a container for resources and the hard boundary for billing, quotas and security.
- ARNs
- An ARN uniquely names a resource:
arn:partition:service:region:account-id:resource. - Availability zones
- Each region has several availability zones: one or more data centres with independent power, cooling and networking, linked by low-latency private fibre.
- AWS CLI, profiles and queries
- The AWS CLI calls every service API from a shell.
- AWS Organizations and SCPs
- Organizations groups accounts under a management account, arranged in organisational units, with consolidated billing.
E
- Edge locations and global services
- Edge locations are hundreds of smaller sites in cities worldwide that run CloudFront, Route 53 and Global Accelerator close to users.
I
- IAM Identity Center
- Identity Center is the central sign-in for people across all accounts in an organisation.
- IAM users, groups and roles
- A principal is who makes a request.
- Identity-based vs resource-based policies
- Identity-based policies attach to a user, group or role and say what it may do.
K
- KMS, Secrets Manager and Parameter Store
- KMS manages encryption keys used by S3, EBS, RDS and others, with every use logged.
L
- Least privilege and Access Analyzer
- Least privilege means granting only the actions and resources a principal needs.
P
- Permissions boundaries
- A permissions boundary is a managed policy attached to a user or role that caps the permissions its identity policies can grant.
- Policy conditions
- A
Conditionblock adds rules to a statement using keys such asaws:SourceIp,aws:PrincipalOrgID,aws:SecureTransport,aws:RequestedRegionor resource tags. - Policy documents
- A policy is JSON with statements.
- Policy evaluation logic
- Every request starts denied.
R
- Regions
- A region is a separate geographic cluster of data centres, such as
eu-west-2(London).
S
- Shared responsibility model
- AWS secures the cloud: hardware, facilities, the hypervisor and managed service internals.
- STS and assuming roles
- The Security Token Service issues temporary credentials when a principal assumes a role.