DEV Community

Cover image for AWS. GCP. Azure. Pocket vocabulary.
Vital F
Vital F

Posted on

AWS. GCP. Azure. Pocket vocabulary.

This is a quick lookup sheet for abbreviations and cloud terms. Each entry aims to be: what it is, in plain English, plus when it matters.

Cloud names (obvious, but included for completeness)

  • AWS: Amazon Web Services.
  • GCP: Google Cloud Platform.
  • Azure: Microsoft Azure.

Identity, access, and governance

  • IAM (Identity and Access Management): The permission system: who/what can do what to which resource. Many cloud incidents boil down to IAM being too broad or attached at the wrong scope.

  • RBAC (Role-Based Access Control): A permission model where you assign roles (sets of permissions) to identities. It's the normal way teams grant access without hand-writing one-off permissions.

  • MFA (Multi-Factor Authentication): Logging in with a second factor (app code, hardware key) in addition to a password. It's one of the highest-ROI protections you can add to any account.

  • SSO (Single Sign-On): Log in once with your company identity and access multiple tools/services. It simplifies onboarding/offboarding and makes auditing access much easier.

  • Tenant (Azure): Your organization's top-level identity boundary in Microsoft Entra ID (directory). It's "where your users live," and where many org-wide controls begin.

  • Microsoft Entra ID (formerly Azure AD): Azure's identity directory service (users, groups, app registrations). It's the backbone for Azure authentication and lots of governance workflows.

  • AWS Organizations: AWS governance feature to group multiple AWS accounts and apply org-level controls. It's how larger AWS setups stop being "a pile of accounts" and start being manageable.

  • OU (Organizational Unit) - AWS Organizations: A logical grouping of AWS accounts inside an Organization. You typically group accounts by environment or business unit so you can apply the same guardrails to all of them.

  • SCP (Service Control Policy) - AWS Organizations: A policy that limits what an account is allowed to do, even if IAM would otherwise allow it. Think "safety rails" that prevent entire categories of mistakes.

  • Cloud Organization (GCP): The top-level GCP resource that represents your company. It enables org-wide policy and a clean hierarchy above projects.

  • Folder (GCP): A grouping layer between Organization and Projects. It's how you apply policy/IAM to many projects at once (for example: "everything under Prod").

  • Management Group (Azure): A governance grouping above subscriptions. It's commonly used to apply policy/RBAC across many subscriptions consistently.

  • Policy (generic): Rules/guardrails you apply to restrict or validate configurations (for example: "no public storage," "only approved regions"). Good policies prevent accidents instead of just detecting them later.

Billing / ownership "containers"

  • Account (AWS Account): A strong isolation boundary in AWS; often the unit for billing, IAM boundaries, and blast-radius control.

  • Project (GCP Project): The main unit where resources live and APIs are enabled. Projects often map cleanly to "one app" or "one environment."

  • Subscription (Azure Subscription): The main Azure billing and RBAC boundary. It's commonly used as an environment boundary (dev vs prod) when you want hard separation.

  • Resource Group (Azure): A group of Azure resources managed together (lifecycle, RBAC, and organization). A common pattern is "one resource group per app per environment," even within one subscription.

  • Quotas / limits: Per-service capacity limits (number of instances, IPs, API requests, etc.). Hitting a quota often looks like a mysterious outage if you're not watching for it.

Geography and availability

  • Region: A geographic area where cloud resources run (for example: "us-east-1"). Regions affect latency, data residency/compliance, and which services/features are available.

  • Location (Azure): Azure's term for a region. Many Azure resources have a "location" property.

  • AZ (Availability Zone) - AWS: A separate fault domain inside a region (independent power/cooling/building). High-availability designs often spread across 2-3 AZs.

  • Zone (GCP): Similar concept to AWS AZ: a fault domain inside a region. Many compute resources are zonal, so spreading across zones improves availability.

  • HA (High Availability): Designing systems to keep working through failures (instance failure, zone failure, etc.).

Networking (private networks and segments)

  • VPC (Virtual Private Cloud) - AWS: Your private network boundary (routing, subnets, connectivity) in AWS.

  • VPC Network - GCP: GCP's VPC. Key difference: it is global within a project; subnets are regional.

  • VNet (Virtual Network) - Azure: Azure's private network boundary (similar role to AWS VPC).

  • Subnet / Subnetwork: A smaller IP range "inside" your VPC/VNet/VPC Network used for segmentation.

    • Notes: AWS subnets are AZ-scoped; GCP subnetworks are region-scoped.
  • CIDR (Classless Inter-Domain Routing): The notation for an IP range (example: 10.0.0.0/16). Your CIDR choices determine how many IPs you have and whether networks can be connected cleanly later.

  • Routing / route table: Rules that decide where traffic goes (internet, NAT, peered network, etc.).

  • NAT (Network Address Translation): A way for private IPs to reach the internet without being directly reachable from the internet. Commonly used for "private subnets that still need outbound access."

  • Peering: Connecting two private networks so they can route traffic to each other. It's how you get private service-to-service communication across network boundaries.

  • VPN (Virtual Private Network): Encrypted tunnel over the internet between networks (office ↔ cloud, cloud ↔ cloud).

  • AWS Direct Connect: Dedicated private connectivity from your datacenter/office to AWS. It gives more predictable performance than a VPN and can be cheaper at scale.

  • Azure ExpressRoute: Dedicated private connectivity to Azure (similar role to Direct Connect).

Security controls at the network layer

  • Security Group (AWS): Stateful firewall rules attached to network interfaces/resources. It's one of the most common "allow/deny" controls for AWS workloads.

  • Firewall rules (GCP): Network-level firewall rules with targets (tags/service accounts) rather than a single "security group object." This different attachment model changes how you group and reason about access.

  • NSG (Network Security Group) - Azure: A set of allow/deny rules attachable to subnets and/or NICs. It's a common access control layer for Azure networks.

  • NIC (Network Interface Card) / network interface: The virtual network adapter attached to a VM or similar resource.

  • ENI (Elastic Network Interface) - AWS: AWS's name for a virtual network interface.

Storage (mentioned in examples)

  • S3 (Amazon Simple Storage Service): AWS's object storage service.

  • Bucket (S3 bucket): A named container in object storage that holds objects (files) and metadata. The "public bucket" mistakes people talk about are usually bucket policies/ACLs set too open.

Data and analytics (common "cloud data" vocabulary)

  • Amazon Redshift (often said as "Redshift"): AWS managed data warehouse for analytics SQL (reporting/BI). Common equivalents are BigQuery (GCP) and Azure Synapse / Fabric Warehouse (Azure).

  • Data warehouse: A database optimized for analytics queries (lots of reads, big scans, aggregations) rather than app transactions.

  • OLTP (Online Transaction Processing): App-style databases optimized for many small reads/writes (orders, users, payments).

  • OLAP (Online Analytical Processing): Analytics-style queries optimized for reporting and aggregation ("show revenue by region for the last 12 months").

  • Data lake: A storage-based approach where raw/curated data lives in object storage (like S3) and multiple tools query/process it.

  • ELT / ETL: Two ways to move/transform data. ETL transforms before loading into the warehouse; ELT loads first, then transforms inside/near the warehouse.

Kubernetes (only if you use Kubernetes)

  • Kubernetes (K8s): An orchestration system for running containers at scale (scheduling, scaling, rollout, service discovery).

  • EKS (Elastic Kubernetes Service) - AWS: Managed Kubernetes on AWS.

  • GKE (Google Kubernetes Engine) - GCP: Managed Kubernetes on GCP.

  • AKS (Azure Kubernetes Service) - Azure: Managed Kubernetes on Azure.

  • Cluster: The Kubernetes control plane + worker nodes that run your workloads. It's a major operational boundary (upgrades, policies, networking modes, cost allocation).

  • Namespace: A logical partition inside a cluster. It helps organize teams/apps and apply quotas/RBAC, but it's not "hard isolation."

  • Pod: The smallest schedulable unit in Kubernetes (one or more containers sharing networking/storage context).

  • Deployment: Kubernetes controller for stateless replicated pods with rolling updates.

  • StatefulSet: Controller for workloads that need stable identity and stable storage patterns.

  • DaemonSet: Controller that runs one pod per node (often for agents like logging/monitoring).

  • Ingress: Kubernetes API/resource pattern for HTTP routing into services (usually implemented by an ingress controller).

  • CNI (Container Network Interface): The plugin system that provides pod networking. CNI differences affect IP consumption, networking limits, and migration surprises.

Observability and operations (mentioned or commonly paired)

  • Audit logs: Records of "who did what" actions in the cloud control plane.

    • AWS example: CloudTrail (see below).
  • CloudTrail (AWS): AWS service that records API calls and account activity. It's foundational for investigations and compliance.

  • CI/CD (Continuous Integration / Continuous Delivery): Automated build/test/deploy pipelines. It's how most teams ship changes safely and repeatedly.

Billing, pricing, and "usage" vocabulary

  • Metered billing / pay-as-you-go: You pay based on measured usage (time running, requests, GB stored, GB transferred).

  • Usage: The measurable thing that gets billed (hours, requests, GB-months, vCPU-seconds, etc.).

  • Billing period: The time window for an invoice (often monthly).

  • Invoice: The official bill for a billing period.

  • Line item: One charge on an invoice (for a specific service, region, SKU, or usage type).

  • SKU: A specific priced unit/variant of a service (often how providers break down billing).

  • Rate card / price sheet: A list of prices per SKU/usage type (often region-specific).

  • Free tier: "Free within limits" pricing (limited time, limited usage, or specific services). It's easy to exceed quietly if you don't set budgets/alerts.

  • Credits: Promotional or contract credits that offset charges on the invoice.

  • Budget: A spending target with alerts when you're trending over it.

  • Cost allocation: The practice of mapping spend to teams/apps/environments (usually via tags/labels and account structures).

  • Tagging (AWS tags) / Labels (GCP labels) / Tags (Azure tags): Key/value metadata used for organization, automation, and cost reporting.

  • Chargeback / showback: Internal accounting patterns. Showback reports cost per team; chargeback actually bills teams internally.

  • Commitment / reserved capacity: You commit to a certain spend or capacity in exchange for a discount.

    • AWS examples: Reserved Instances (RIs), Savings Plans.
    • GCP examples: Committed Use Discounts (CUDs).
    • Azure examples: Reserved Instances / Reserved Capacity, Savings Plan (Azure).
  • On-demand: Default pricing with no long-term commitment (usually the highest unit price, but most flexible).

  • Spot (AWS) / Preemptible (GCP) / Spot (Azure): Deeply discounted compute that can be interrupted. Great for batch jobs; risky for always-on services unless designed for interruption.

  • Amortization: Spreading the cost of a commitment (like a 1-year reservation) across the time it benefits, so reports reflect "true" monthly cost.

  • Blended vs unblended rates (AWS Cost concept): Different ways to compute unit cost when discounts/commitments are involved; the "right" view depends on whether you're allocating shared discounts across accounts.

  • FinOps: The discipline/practice of managing cloud cost with shared ownership between engineering, finance, and product.

  • vCPU: "Virtual CPU" - a billing/performance unit for compute. It's not always a perfect match to a physical core, but it's commonly used in pricing.

  • GB-month / GiB-month: Storage pricing unit meaning "this many gigabytes stored for a month" (often prorated by day/hour).

  • IOPS: Input/Output Operations Per Second (common in disk pricing/performance).

  • Data transfer: Network traffic that is often billed separately from compute/storage.

    • Ingress: data coming into a cloud/provider (often free, but not always).
    • Egress: data leaving a cloud/provider (commonly billed, sometimes expensive).
  • Cross-zone / inter-AZ traffic: Traffic between zones inside a region; often billed in some clouds/services.

  • Inter-region transfer: Traffic between regions; commonly billed and relevant to DR/multi-region designs.

  • API request / API call: A billed operation for some services (for example: "requests to object storage," "reads/writes," "list operations").

  • Quotas / limits: Provider-enforced caps on usage (also relevant for cost control and safety).

  • AWS CUR (Cost and Usage Report): AWS's detailed billing export used for deeper analysis and FinOps tooling.

Quick "overlay" concept (important for the article's mental model)

  • "Policy overlay": A way to think about security rules (SG/Firewall/NSG, org policies, etc.) as layers that can apply across many resources rather than a neat nested folder. This mental model helps during migrations because you stop hunting for a perfect 1:1 "container equivalent."

Top comments (0)