Glossary

An isolated data-centre location inside an AWS Region. Spreading resources across multiple AZs keeps an app up if one facility fails.

AWS: Regions and AZs

A compact way to write an IP range (e.g. 10.0.0.0/16). The number after the slash is how many bits are fixed; the rest are free for hosts.

A managed VPN endpoint that lets remote workers’ laptops join your VPC securely, as if they were on the corporate network.

The extra latency the first time a serverless function runs after being idle, the runtime must be provisioned and your code loaded before it handles the request.

A dedicated private fibre link between your data centre and AWS, more consistent than a VPN over the public internet.

A virtual network card in a VPC. EC2 instances and Lambda-in-VPC get one (or more) ENIs, security groups and private IPs attach here.

A horizontally scaled VPC component that lets resources in public subnets talk to the internet (and vice versa).

A managed AWS service that lets instances in private subnets make outbound internet calls without accepting unsolicited inbound connections.

Infrastructure you run yourself (office, colo, or owned data centre), as opposed to cloud-managed resources in AWS.

Private connectivity to a service (yours or a partner’s) over the AWS network, without exposing it on the public internet. Often used for SaaS into your VPC.

Software delivered as a hosted product you subscribe to (e.g. Slack, Datadog), rather than software you install and operate yourself.

A load-balancer grouping of backends (instances, IPs, or Lambda). The ALB/NLB health-checks these targets and only sends traffic to healthy ones.

A regional hub that connects many VPCs and on-premises networks. Prefer this over a mesh of peering links when you have more than a few networks.

A private network connection between two VPCs so resources can talk using private IPs as if they were on one network. Not transitive across a third VPC.