Cloud Glossary

A cloud model where computing resources are operated by a third-party provider (Azure, AWS, GCP) and shared among multiple customers over the internet. The customer does not manage the physical infrastructure.

A cloud environment dedicated exclusively to a single organization. It can live on the company's own premises (on-premises) or be hosted by a provider, but resources are never shared with other customers.

A combination of public and private cloud (or on-premises infrastructure) with connectivity between them. It allows workloads to move around based on cost, security, or performance needs.

IT infrastructure hosted physically at the organization's own facilities. The internal team is responsible for the hardware, software, maintenance, and security.

A cloud service model where the provider manages the underlying hardware (servers, storage, network) and the customer controls the operating system, middleware, and applications. Maximum flexibility, maximum customer responsibility.

A model where the provider manages hardware, OS, and middleware. The customer only deploys and manages their applications and data. Ideal for developers who want to focus on code without managing infrastructure.

A model where the provider manages everything: infrastructure, platform, and application. The customer simply uses the software through a browser or client app. This gives the user the lowest level of control.

The ability to automatically scale resources up or down in real time based on demand, and shrink them back when no longer needed to optimize cost.

The ability of a system to increase its processing capacity by adding more resources. It can be vertical (more power to the same server) or horizontal (more servers).

Increasing a system's capacity by adding more instances or nodes (more identical servers). This is the preferred strategy in cloud architectures for its higher availability and fault tolerance.

Increasing an existing server's capacity by adding more CPU, RAM, or storage. It has a physical ceiling and generally requires downtime.

A system's ability to stay operational for as much time as possible, minimizing unplanned downtime. Measured as a percentage (e.g. 99.99% uptime).

A system's ability to keep operating correctly when one or more of its components fail. It implies active redundancy, where the system keeps running without interruption.

The set of policies and procedures used to restore critical systems after a catastrophic event. Defined by two key metrics: RPO (how much data you can afford to lose) and RTO (how long you can afford to be down).

A contract between the cloud provider and the customer that specifies the guaranteed availability level for a service, and the compensation (service credits) if it is not met.

Investment in long-term physical assets, such as servers, buildings, or equipment. It depreciates over time. Associated with the on-premises model, where the company buys and owns its infrastructure.

The ongoing spend a business incurs to keep day-to-day operations running. In the cloud, this corresponds to paying for resource consumption — no upfront investment, you pay based on actual usage.

A pricing model where you only pay for the resources you consume, for as long as you use them. No long-term contracts or upfront costs. It lets you optimize spend by turning off resources when they are not needed.

A geographic area where a cloud provider has one or more data centers. Resources are deployed to specific regions to meet latency, data sovereignty, and availability requirements.

A physically separate data center within a region, with independent power, cooling, and networking. Deploying resources across multiple AZs protects against the failure of a single data center.

Two regions from the same provider located in the same broad geography but physically separated (typically 300+ km apart). Provider updates roll out to one region first, then the other.

An architecture where multiple customers (tenants) share the same physical infrastructure with logical isolation between their data and configurations. The foundation of the public cloud model.

A technology that lets you run multiple operating systems or virtual environments on the same physical hardware via a hypervisor. It is the underlying technology of the cloud.

A framework that defines which parts of security are managed by the cloud provider and which are the customer's responsibility. It varies by service model: in IaaS the customer manages more, in SaaS the provider manages almost everything.

The time it takes a data packet to travel from source to destination. In the cloud, it is minimized by deploying resources in regions close to end users.

A network of globally distributed servers that cache copies of static content (images, video, JS, CSS) in locations close to users to reduce latency.

Duplicating a system's critical components so the system keeps working if one fails. It can be active (both run at once) or passive (one is on standby).

A security model that trusts nothing by default, not even what is inside the corporate network. It is based on three principles: verify every request explicitly, use least privilege access, and assume a breach already exists.

A strategy that protects data with several layers of security: physical, identity and access, perimeter, network, compute, application, and data. If one layer fails, the next ones keep protecting and slow the attacker down.

Encryption transforms data so that only someone with the key can read it, and it is reversible. It can be symmetric (one shared key) or asymmetric (a public and private key pair). Hashing produces a fixed-length value and is one-way: the original text cannot be recovered.

Authentication (AuthN) proves that a person or service is who they claim to be, for example with a password, MFA, or a passkey. Authorization (AuthZ) happens afterward and defines what that authenticated identity can do or access.

A trust relationship between identity providers that lets users authenticate with their own organization and access another organization's resources without creating new accounts. The trust doesn't have to be bidirectional.

A SIEM (security information and event management) collects and analyzes security data from across the organization to detect threats and investigate incidents. A SOAR (security orchestration, automation, and response) automates the response, for example by disabling accounts or opening tickets.

OLTP (online transaction processing) records many small read and write operations with transactional integrity, such as sales or payments. OLAP (online analytical processing) queries and aggregates large volumes of historical data for reports and trends.

Transaction guarantees: atomicity (all or nothing), consistency (data moves from one valid state to another), isolation (concurrent transactions don't interfere), and durability (committed changes aren't lost even if the system fails).

A technique that splits data into related tables so each piece of data is stored in only one place. It reduces redundancy and avoids insert, update, and delete anomalies. First normal form (1NF) requires atomic values in each column.

Categories of SQL statements. DDL (Data Definition Language) defines structure: CREATE, ALTER, DROP. DML (Data Manipulation Language) works with data: SELECT, INSERT, UPDATE, DELETE. DCL (Data Control Language) manages permissions: GRANT, DENY, REVOKE.

The primary key uniquely identifies each row in a table and doesn't allow nulls or duplicates. The foreign key is a column that references another table's primary key, which creates the relationship and enables referential integrity.

An analytical model design with a fact table in the center, storing measurable values (amounts, quantities), and dimension tables around it, with descriptive attributes (product, customer, date), joined by one-to-many relationships.

A relational database optimized for analytical queries over structured, modeled historical data, usually in a star schema. It applies the schema when writing data (schema-on-write).

A repository that stores large volumes of data in its original format, whether structured, semi-structured, or unstructured. The schema is applied when reading the data (schema-on-read).

An architecture that combines the flexible, low-cost storage of a data lake with data warehouse capabilities, such as tables, SQL queries, and ACID transactions, usually by using the Delta Lake format.

In ETL (extract, transform, load), data is transformed in an intermediate engine before it is loaded into the destination. In ELT (extract, load, transform), it is loaded raw first and transformed in the destination by using its compute.

Ways to store data in files. Text: CSV (delimited), JSON, and XML (semi-structured). Binary: Parquet and ORC (columnar, ideal for analytics) and Avro (row-based, with the schema in a JSON header).

A table format that adds a transaction log on top of Parquet files. It enables ACID transactions, updates, deletes, schema enforcement, and queries over previous versions (time travel).

Batch processing groups data from a period and processes it together on a schedule, with higher latency. Streaming processes each event (or small windows of events) as it arrives, with low latency.

A logical container in Azure that groups related resources (VMs, databases, networks) to simplify their management, deployment, and joint deletion. Every Azure resource must belong to exactly one resource group.

The billing and access-control unit in Azure. It contains resource groups and resources. An organization can have multiple subscriptions to separate environments (dev, prod) or departments.

A dedicated instance of Microsoft Entra ID (formerly Azure Active Directory) that represents an organization. It holds the users, groups, and applications. An organization has a single tenant but can have multiple subscriptions.

Microsoft's cloud-based identity and access service. It manages users, groups, and applications, and provides authentication (including SSO and MFA) for Azure resources and SaaS applications.

Azure's authorization system for managing who has access to which resources and what they can do with them. Roles (Owner, Contributor, Reader) are assigned to users, groups, or service identities.

A private network in Azure that lets Azure resources communicate with each other, with the internet, and with on-premises networks. It provides isolation, segmentation, and traffic control.

A basic Azure firewall that filters network traffic to and from Azure resources within a VNet. It contains inbound and outbound rules that allow or deny traffic based on IP, port, and protocol.

A service that distributes incoming network traffic across multiple backend instances (VMs). It operates at layer 4 (TCP/UDP), enabling high availability and scalability for applications.

A PaaS platform for hosting web apps, REST APIs, and mobile backends. It supports multiple languages (.NET, Java, Python, Node.js) and automatically handles the OS, patching, and scaling.

A serverless compute service that runs code in response to events (HTTP, queues, timers, storage changes) without managing infrastructure. You pay only for execution.

Azure's unstructured object storage service (documents, images, videos, backups). Organized as storage accounts > containers > blobs. Offers Hot, Cool, and Archive access tiers.

Azure's globally distributed NoSQL database. It offers single-digit-millisecond latency, automatic scaling, and multiple APIs (NoSQL, MongoDB, Apache Cassandra, Apache Gremlin, Table, and PostgreSQL).

A fully managed PaaS relational database built on SQL Server. Microsoft manages the hardware, OS, patching, and automatic backups. The customer only manages the schema and data.

A service for securely storing and managing secrets (passwords, connection strings), encryption keys, and certificates. It centralizes secrets management and removes the need to hard-code them in application code.

A centralized monitoring platform in Azure that collects metrics and logs from resources, generates alerts, and provides dashboards. Includes Log Analytics, Application Insights, and Azure Metrics.

The management layer that processes every create, update, and delete request for Azure resources. It enables infrastructure as code through ARM templates (JSON) or Bicep.

A service for defining, assigning, and managing rules that Azure resources must comply with. It can audit current state or block the creation of non-compliant resources.

Containers that organize multiple Azure subscriptions into a hierarchy so policies and access control can be applied consistently. The topmost level of Azure's management hierarchy.

A service that creates encrypted connections between Azure networks (VNets) and on-premises networks, or between VNets. It uses IPsec/IKE protocols to build site-to-site or point-to-site VPNs.

A private, dedicated connection between an on-premises network and Azure through a connectivity provider. It bypasses the public internet, offering higher bandwidth, lower latency, and greater reliability than VPN.

A DNS-based load balancer that distributes user traffic across endpoints in different Azure regions or external locations. It supports several routing methods: performance, geographic, priority, and weighted.

A global application delivery platform that combines HTTP/HTTPS load balancing, CDN, WAF, and application acceleration. Operates at layer 7 (HTTP) at global scale.

A unified security platform that provides continuous security assessment, threat detection, and configuration recommendations for Azure, on-premises, and multi-cloud resources.

Azure's tool for analyzing, monitoring, and optimizing cloud spend. It lets you create budgets, set cost alerts, and visualize spend by subscription, resource group, or tag.

Azure's managed Kubernetes service. Microsoft manages the control plane (master nodes), while the customer manages the worker nodes. It simplifies deploying, scaling, and operating containers.

A cloud-based backup service for VMs, databases, files, and on-premises workloads. Backups are stored in Recovery Services Vaults.

A disaster recovery service that replicates VMs and physical workloads to a secondary Azure region. If the primary site fails, you can fail over to the secondary site with minimal downtime.

A set of documentation, best practices, and tools from Microsoft that guides an organization's cloud strategy, planning, readiness, adoption, and governance. It defines phases: Team, Strategy, Plan, Ready, Adopt, Govern, Manage.

A preconfigured environment of subscriptions and resources with identity, governance, networking, and security already in place as a foundation for deploying workloads. It follows the Azure Landing Zones reference model within the CAF, split into platform zones and application landing zones.

A network architecture pattern where a central VNet (hub) hosts shared services (firewall, VPN Gateway, identity services) and peripheral VNets (spokes) contain the actual workloads, connected to the hub via peering.

A user-defined role that combines a specific set of permissions (Actions, NotActions, DataActions) when the built-in Azure roles do not fit the required least-privilege principle.

A Microsoft Entra ID identity that Azure manages automatically so a resource (VM, App Service, Function) can authenticate to other services without storing credentials in code. There are two types: system-assigned (tied to the resource) and user-assigned (independent and reusable).

A Microsoft Entra ID policy engine that evaluates signals (location, device, session risk, application) to decide whether to allow, block, or require additional controls (MFA) when accessing a resource.

A tool that synchronizes identities between on-premises Active Directory and Microsoft Entra ID, enabling hybrid identity scenarios. It supports Password Hash Sync (PHS), Pass-through Authentication (PTA), and federation (ADFS).

A grouping of several related Azure Policy definitions that are assigned together to a scope (management group, subscription, resource group), simplifying management of policies that share a common goal (e.g., ISO 27001 compliance).

A container where Azure Monitor stores log and metric data collected from resources, agents, and applications. It can be queried with Kusto Query Language (KQL) and underlies Application Insights, Sentinel, and Container Insights.

Replication levels for an Azure storage account: LRS (3 copies in a single datacenter), ZRS (3 copies across availability zones in the region), GRS (LRS plus an asynchronous copy in a paired region), and GZRS (ZRS plus a copy in a paired region).

Five configurable levels in Azure Cosmos DB that trade off consistency against performance: Strong, Bounded Staleness, Session (the default), Consistent Prefix, and Eventual, ordered from most to least consistent and from lowest to highest availability/throughput.

Two pricing models for Azure SQL Database: DTU (Database Transaction Unit) bundles CPU, memory, and I/O into a simplified unit with fixed tiers; vCore lets you scale compute and storage independently and apply Reserved Capacity or Azure Hybrid Benefit discounts.

A logical grouping of VMs within a single datacenter that spreads them across fault domains (separate racks/power) and update domains (so Azure does not restart them all at once). It protects against local hardware failures, not against the loss of an entire datacenter.

An Azure SQL Database/Managed Instance feature that manages replication and automatic or manual failover of a set of databases to a secondary region, exposing listener endpoints that stay the same after a failover.

A service that acts as a gateway to publish, secure, transform, and monitor APIs, regardless of where they are hosted (App Service, AKS, on-premises). It offers rate-limiting policies, caching, payload transformation, and a developer portal.

A fully managed enterprise messaging service with queues (point-to-point) and topics (pub/sub with filtered subscriptions). It supports transactions, sessions, ordered delivery, and dead-lettering.

A fully managed event-routing service based on the publisher/subscriber pattern. It reacts to discrete events (a blob being created, a resource changing state) and routes them to handlers such as Functions, Logic Apps, or Service Bus.

A high-throughput, big-data event streaming platform capable of ingesting millions of events per second, such as IoT telemetry or application logs. Events are organized into partitions and retained for a configurable period so multiple consumers can read them.

A networking service that unifies connectivity from remote sites (VPN, ExpressRoute, SD-WAN) and VNets into a Microsoft-managed hub, simplifying hub-and-spoke topologies at large scale without needing to manually configure peering between multiple hubs.

A fully managed, highly available network firewall as a service that inspects and filters traffic between VNets, subnets, and the internet using network, application (FQDN), and NAT rules. It is typically deployed in the hub VNet.

A service that protects Azure resources against distributed denial-of-service attacks. The Basic tier is included free for all resources; the Network Protection tier adds adaptive mitigation tuned to the application's traffic, alerts, and access to DDoS response experts.

Microsoft's unified hub of tools for discovering, assessing, and migrating on-premises or other-cloud servers, databases, web apps, and VMs into Azure. It includes dependency assessment, target sizing, and cost estimation.

Azure IaaS service for creating Windows or Linux virtual machines on demand. The customer chooses the size (vCPU and memory), image, disks and networking, and manages the operating system, applications and data.

Microsoft's cloud-native SIEM and SOAR. It collects and correlates security events from Azure, Microsoft 365, on-premises environments, other clouds and third-party solutions, detects threats with analytics and AI, and automates the response with playbooks. It was formerly called Azure Sentinel.

Microsoft's solution for external identities. It includes B2B collaboration (inviting partners as guest users in your tenant) and customer identity and access management (CIAM) in an external tenant, with self-service sign-up, social sign-in (Google, Facebook, Apple) and customizable user flows. It succeeds Azure AD B2C, which has not been sold to new customers since May 2025.

Azure resource that deploys and manages a set of resources defined in a Bicep or ARM template as a single unit. It keeps track of the resources it manages, can prevent them from being modified or deleted outside the stack (deny settings), and deletes or detaches them when they are no longer part of it. It is the recommended replacement for Azure Blueprints, retired in July 2026.

Unified data governance, protection and compliance platform. It discovers and catalogs data across Azure, on-premises environments, other clouds and SaaS applications (Data Map), classifies it automatically (for example personal or financial data), shows its lineage and includes compliance tools such as Compliance Manager. It was formerly called Azure Purview.

A method that requires two or more factors from different categories: something you know (password, PIN), something you have (phone, security key), and something you are (biometrics). Two passwords aren't MFA because they belong to the same category.

Passwordless cryptographic credentials stored on a security key, on the device, or in Microsoft Authenticator. They are bound to the legitimate site, so they don't work on a fake site: they are phishing-resistant.

A free set of preconfigured security settings in Microsoft Entra ID: it requires all users to register for MFA, requires MFA for administrators, blocks legacy authentication, and protects privileged actions.

A Microsoft Entra service that provides just-in-time, time-bound privileged access to Entra and Azure roles. An "eligible" user must activate the role when needed, and activation can require MFA, approval, and justification.

A service that detects, investigates, and remediates identity risks, such as leaked credentials, sign-ins from anonymous IPs, or impossible travel. It calculates user risk and sign-in risk, which are used as conditions in Conditional Access.

A set of capabilities to ensure the right people have the right access for the right time: entitlement management (access packages), access reviews (periodic reviews), lifecycle workflows (joiner, mover, leaver), and PIM.

Identities assigned to software (applications, services, scripts, or containers) to authenticate and access resources. In Microsoft Entra they are applications, service principals, and managed identities.

A unified pre- and post-breach defense suite that coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications. It correlates signals from Defender for Endpoint, Office 365, Identity, Cloud Apps, and other products into unified incidents.

Protection for email and collaboration tools (Teams, SharePoint, OneDrive) against phishing, malware, and business email compromise. It includes Safe Links (checks URLs at click time) and Safe Attachments (analyzes attachments in an isolated environment).

A cloud solution that uses sensors on on-premises AD DS domain controllers to detect identity attacks, such as pass-the-hash, pass-the-ticket, or reconnaissance, and compromised identities.

A cloud access security broker (CASB) that discovers the cloud apps in use (shadow IT), assesses their risk, protects data in SaaS apps, and detects threats in them. With Conditional Access App Control it can control sessions in real time, for example by blocking downloads.

Continuous assessment of cloud resource configuration to detect misconfigurations and risks, with recommendations to improve the security posture. In Defender for Cloud it shows up as recommendations and the secure score.

A managed service that provides secure RDP and SSH connectivity to virtual machines from the Azure portal (or the native client) over TLS. VMs don't need a public IP or to expose ports 3389 or 22 to the internet.

Centralized protection for web applications against common exploits, such as SQL injection and cross-site scripting (XSS), with rules based on the OWASP Core Rule Set. It is deployed with Azure Application Gateway or Azure Front Door.

Microsoft Purview labels that classify and protect content with encryption, watermarks, headers, or footers. The protection travels with the file and can also apply to containers such as SharePoint sites or Teams teams.

Microsoft Purview policies that detect sensitive information and apply actions, such as blocking sharing, showing policy tips, or generating alerts. They protect Exchange, SharePoint, OneDrive, Teams, devices (Endpoint DLP), and more.

Microsoft Purview settings that retain, delete, or retain and then delete content. A retention policy applies the same rule to a whole location; a retention label applies to individual items and can declare them a record.

A tool that helps manage regulatory compliance with assessments based on regulation templates (GDPR, ISO 27001, NIST), improvement actions with step-by-step guidance, and a compliance score that measures progress.

Microsoft's site that publishes independent audit reports (SOC 1, SOC 2), certifications (ISO 27001), documents by industry and region, and resources on how Microsoft cloud services protect data.

A solution to identify, preserve (with holds), review, and export electronically stored information for investigations and legal cases across Exchange, Teams, SharePoint, OneDrive, and more. It offers a unified experience in the Purview portal.

A Microsoft Purview solution that detects, investigates, and helps act on risky activities by internal users, such as data theft by departing employees, data leaks, or security violations, using policy templates.

An Azure SQL family PaaS service with near-total compatibility with the SQL Server engine, including instance features such as SQL Agent, cross-database queries, Database Mail, or CLR. It is deployed inside a virtual network with a private IP.

The Azure PaaS service for the community edition of PostgreSQL, deployed as Flexible Server, with automatic backups, zone-redundant high availability, and control over maintenance windows.

The Azure PaaS service for the community edition of MySQL, deployed as Flexible Server, with managed backups, patching, and high availability. It is the natural choice for LAMP applications.

Azure Blob Storage with the hierarchical namespace enabled. It organizes data into real directories, allows atomic folder operations, and supports POSIX-compliant access control lists (ACLs).

Tiers that balance storage and access cost: Hot (frequent access), Cool (30-day minimum), Cold (90-day minimum, immediate reads), and Archive (180-day minimum, offline). Deleting or moving a blob before the minimum incurs an early deletion fee.

Fully managed cloud file shares, accessible over SMB and NFS, that several computers can mount at the same time as a network drive.

A NoSQL key-value store inside an Azure Storage account. Each entity is identified by PartitionKey and RowKey and can have different properties, with no fixed schema. It doesn't support joins or foreign keys.

Cosmos DB access models: NoSQL (native API, JSON documents with SQL-like queries), MongoDB, Apache Cassandra (column families, CQL), Apache Gremlin (graphs), Table (key-value), and PostgreSQL (distributed relational).

A normalized measure of the CPU, memory, and I/O cost of each operation in Azure Cosmos DB. Reading a 1 KB document by its id and partition key costs about 1 RU. Throughput is provisioned in RU/s, with autoscale, or in serverless mode.

An end-to-end analytics platform offered as SaaS. It integrates Data Factory, Data Engineering, Data Warehouse, Data Science, Real-Time Intelligence, Databases, and Power BI on top of the same storage, OneLake.

Each Microsoft Fabric tenant's single logical data lake, built on ADLS Gen2. Every Fabric workload stores and reads its data there without moving or duplicating it.

A data analytics and AI platform based on Apache Spark, optimized for Azure. It provides collaborative notebooks, managed clusters, lakehouses with Delta Lake, and centralized governance with Unity Catalog.

A fully managed (PaaS) stream processing engine that uses a SQL-based language with temporal functions. It reads from Event Hubs or IoT Hub and sends results to Blob Storage, Azure SQL Database, Cosmos DB, or Power BI. It also runs on IoT Edge.

A read-only query language optimized for exploring large volumes of logs, telemetry, and time series, with operators chained by pipes (|), such as where, summarize, and render.

Microsoft's tool to connect to data, model it, and create interactive reports and dashboards. Power BI Desktop is used to author; the Power BI service (part of Microsoft Fabric) is used to publish, share, create dashboards, and schedule refreshes.

A Power BI item, formerly called a dataset, that contains the tables, relationships, DAX measures, hierarchies, and row-level security roles that reports use.

A private, isolated virtual network in AWS where you launch resources such as EC2, RDS, or Lambda. It gives you full control over the network environment: IP ranges, subnets, route tables, and gateways.

AWS's virtual machine service. It provides scalable compute capacity in the cloud. The customer selects the instance type, OS, and network configuration. IaaS model.

AWS's object storage service. It stores objects in buckets with 99.999999999% durability (11 nines). It supports multiple storage classes based on access frequency: Standard, Intelligent-Tiering, Glacier.

The AWS service for managing identities (users, groups, roles) and their access permissions to AWS resources. It follows the least-privilege principle. Permissions are defined in JSON policies.

AWS's managed relational database service. It supports MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Amazon Aurora. AWS manages backups, patching, failover, and storage scaling.

AWS's serverless compute service that runs code in response to events without managing servers. It scales automatically from 0 to thousands of concurrent executions. You pay only for execution time.

AWS's global CDN that distributes content (web, streaming, APIs) from more than 400 points of presence (PoPs) worldwide. It reduces latency by serving content from the node closest to the user.

AWS's scalable, highly available DNS service. It registers domains, resolves DNS, and routes traffic using policies: Simple, Weighted, Latency-based, Failover, Geolocation, Geoproximity.

AWS's monitoring and observability service that collects metrics, logs, and events from AWS resources. It lets you build dashboards, alarms, and automate actions based on metrics.

AWS's pub/sub messaging service. It sends notifications to multiple subscribers (email, SMS, HTTP, SQS, Lambda) through topics. Fan-out model.

An AWS message queuing service that decouples components in distributed systems. Messages are stored in the queue until a consumer processes them. It supports standard queues (at-least-once) and FIFO queues (exactly-once).

AWS's fully managed NoSQL database. It delivers single-digit-millisecond latency at any scale, with automatic throughput and storage scaling. It supports key-value and document data models.

A service that automatically distributes incoming traffic across multiple targets (EC2, containers, IPs). Types: Application Load Balancer (HTTP/HTTPS, layer 7), Network Load Balancer (TCP/UDP, layer 4), and Gateway Load Balancer.

A service that automatically adjusts resource capacity (EC2, ECS, DynamoDB) based on defined policies. It maintains availability and optimizes cost by scaling up under demand and scaling down when idle.

An instance-level virtual firewall on EC2 that controls inbound and outbound traffic. It works as an allow-only rule list — there are no explicit deny rules. Stateful: if you allow inbound traffic, the response is automatically allowed out.

An optional subnet-level firewall in AWS. It evaluates rules in numeric order and can allow or deny traffic. Stateless: inbound and outbound rules are independent, so you must define both explicitly.

A network segment within a VPC tied to a specific availability zone. Public subnets have a route to an Internet Gateway; private subnets have no direct internet access.

A VPC component that enables communication between resources in a VPC and the internet. For a subnet to be public, its route table must include a route to an Internet Gateway.

A managed service that lets instances in private subnets reach the internet (for downloading patches, for example) without being reachable from the internet. It resides in a public subnet and translates the private IPs.

AWS's infrastructure-as-code (IaC) service. It defines AWS resources in YAML or JSON templates, and CloudFormation creates, updates, and deletes them in an orchestrated way. Resources are grouped into stacks.

A service that logs every AWS API call made within an account. It provides an activity history for auditing, regulatory compliance, and security incident investigation.

A service that continuously evaluates and audits the configuration of AWS resources against defined rules. It records a history of configuration changes and can automatically remediate non-compliance.

A managed service for creating and controlling the encryption keys used to protect data in AWS. It integrates with S3, EBS, RDS, Lambda, and more for encryption at rest.

A service for securely storing, rotating, and retrieving credentials (passwords, API keys, connection strings). It supports automatic secret rotation for RDS, Redshift, and other services.

A web application firewall that protects against common attacks such as SQL injection, XSS, and malicious bots. It integrates with CloudFront, ALB, and API Gateway through customizable rules.

AWS's DDoS protection service. Shield Standard (free) automatically protects all AWS resources. Shield Advanced offers extended protection, 24/7 support, and cost coverage for attacks.

An AWS tool that analyzes your environment and provides recommendations across 5 categories: cost optimization, performance, security, fault tolerance, and service limits.

A service for centrally managing multiple AWS accounts. It lets you apply Service Control Policies (SCPs) to restrict permissions in member accounts, consolidate billing, and organize accounts into Organizational Units (OUs).

AWS's best-practices framework for designing secure, resilient, efficient, and cost-effective cloud architectures. It is structured around 6 pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

A dedicated, private network connection between on-premises facilities and AWS. It does not use the public internet, providing higher bandwidth, lower latency, and more consistent performance.

AWS's container orchestration service. It manages the lifecycle of Docker containers on EC2 or Fargate clusters. An alternative to Kubernetes with lower operational complexity.

A serverless compute engine for containers that works with ECS and EKS. It removes the need to provision and manage servers (EC2 nodes). The customer only defines the CPU and memory resources needed.

A low-cost AWS object storage class designed for long-term archiving of rarely accessed data. Retrieval times vary: minutes (Instant), hours (Flexible), or 12 hours (Deep Archive).

A fully managed service for creating, publishing, maintaining, and securing REST, HTTP, and WebSocket APIs. It integrates natively with Lambda to build serverless APIs without managing servers.

A framework of strategies for migrating workloads to AWS: Retire (decommission), Retain (keep on-premises), Relocate (move without changes, e.g. VMware Cloud on AWS), Rehost (lift-and-shift), Repurchase (switch to SaaS), Replatform (targeted optimizations), and Refactor/Re-architect (cloud-native redesign).

An AWS Organizations policy that defines the maximum permission boundary available to member accounts within an OU or the whole organization. It does not grant permissions by itself — it only restricts; the user/role still needs an allow IAM policy to actually take action.

A CloudFormation extension that automatically deploys the same stack across multiple accounts and regions in an organization from a single operation. With the SERVICE_MANAGED permission model, AWS Organizations manages the required roles without manual per-account setup.

A service that automates setting up a multi-account landing zone on top of AWS Organizations: OU structure, baseline accounts (Log Archive, Audit), preventive and detective guardrails, and a self-service catalog of products for new accounts.

A managed network hub that transitively interconnects multiple VPCs and on-premises connections (VPN, Direct Connect) through a single central point, avoiding the complex mesh of point-to-point peering.

A service that lets you share AWS resources (Transit Gateway, subnets, Route 53 Resolver rules, licenses) across accounts in an organization without duplicating the resource or setting up manual trust relationships.

A technology that exposes a specific service through a private interface endpoint inside a VPC, without needing peering, without exposing traffic to the internet, and without granting access to the entire network of the service provider.

A centralized single sign-on (SSO) service for accessing multiple AWS accounts and business applications. It integrates with an external identity provider (SAML/SCIM) and manages permission sets applied consistently across the whole organization.

A service that issues temporary security credentials so users or services can assume IAM roles (AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity). Credentials expire automatically, reducing the risk of prolonged exposure.

A machine-learning-based threat detection service that continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify anomalous behavior: communication with C2 servers, cryptocurrency mining, or port scanning.

An automated vulnerability assessment service that scans EC2 instances, container images, and Lambda functions for known CVEs and network reachability issues.

A machine-learning-based security service that discovers, classifies, and protects sensitive data (PII, credentials, financial data) stored in Amazon S3.

A service that aggregates, normalizes, and prioritizes findings from GuardDuty, Inspector, Macie, Config, and third-party tools into a single dashboard. It evaluates compliance against standards like CIS Benchmark and AWS Foundational Security Best Practices.

A forensic analysis service that builds a behavior graph from GuardDuty, CloudTrail, and VPC Flow Logs data, making it easier to investigate the root cause of a security finding and visualize relationships between resources, IPs, and users.

A service that migrates databases to AWS with minimal downtime, supporting homogeneous migrations (same engine) and heterogeneous ones (different engine, combined with the Schema Conversion Tool). It supports full-load and CDC (change data capture) to keep source and target in sync during the migration.

A service that automates lift-and-shift (Rehost) migration of physical, virtual, or other-cloud servers to EC2, continuously replicating the source servers and allowing test cutovers and final cutovers with minimal downtime.

A physical data transfer device AWS ships to a customer to move large volumes of data (up to petabytes) to or from S3 when network transfer would be too slow or expensive. Snowball Edge adds local compute capability. Since November 7, 2025 it no longer accepts new customers; Snowcone and Snowmobile are already retired.

A disaster recovery strategy where only critical components (typically a replicated database) stay active in the DR region, while the rest of the infrastructure (EC2, application services) is switched off and only started/scaled during an actual failover.

A disaster recovery strategy where a scaled-down but fully functional version of the entire environment is always running in the DR region. When a disaster hits, you only need to scale up capacity, not start components from scratch.

A disaster recovery strategy where two or more regions receive production traffic simultaneously. If one region fails, Route 53 instantly diverts traffic to the remaining regions, achieving near-zero RTO and RPO.

A service that provides dedicated, single-tenant hardware security modules (HSMs), validated to FIPS 140-2 Level 3, for generating and managing encryption keys with full customer control over the hardware.

AWS's managed Kubernetes service. AWS manages the control plane (API server and etcd) with high availability across multiple Availability Zones; worker nodes can be EC2 instances or run serverless with AWS Fargate.

AWS service for connecting networks and users to a VPC over encrypted connections across the internet. It has two variants: AWS Site-to-Site VPN, which connects an on-premises network to a VPC through IPsec tunnels to a Virtual Private Gateway or a Transit Gateway, and AWS Client VPN, for remote access by individual users.

AWS infrastructure-as-code framework for defining resources in programming languages such as TypeScript, Python, Java, C# or Go. The code is synthesized into AWS CloudFormation templates, which are what actually deploy the resources.

The base organizational unit in Google Cloud that groups resources, billing, and permissions. Every GCP resource belongs to a project. Equivalent to an Azure subscription or an AWS account.

Google Cloud's serverless, highly scalable data warehouse. It lets you analyze petabytes of data with SQL without managing infrastructure. Pricing model based on data scanned or reserved slots.

Google Cloud's virtual machine service (IaaS). It provides highly configurable VMs with options for CPU, memory, and storage. Offers Spot VMs (formerly preemptible): low cost, but they can be interrupted.

Google Cloud's object storage service. It stores objects in buckets with 11 nines of durability. Storage classes: Standard, Nearline, Coldline, and Archive, based on access frequency.

Google Cloud's serverless platform for running containers in response to HTTP requests or events. There's no infrastructure to manage; it automatically scales to zero when there's no traffic.

Google Cloud's managed Kubernetes service. Google created Kubernetes, and GKE offers it as a managed service with automatic upgrades, Autopilot mode, and low-cost Spot nodes.

Google Cloud's asynchronous messaging service for decoupling systems at scale. Producers publish messages to topics and consumers receive them via subscriptions. Guarantees at-least-once delivery.

Google Cloud's identity and access management system. It lets you assign roles (primitive: Owner/Editor/Viewer, predefined, or custom) to members (users, groups, service accounts) over GCP resources.

Google Cloud's unified ML platform for building, training, deploying, and managing machine learning models. Includes AutoML, Workbench (notebooks), and access to Google's foundation models (Gemini). Since April 2026 it is part of Gemini Enterprise Agent Platform.

GCP's fully managed relational database service. Supports MySQL, PostgreSQL, and SQL Server. Manages backups, patching, and automatic failover.

Google Cloud serverless service for running functions in response to events (HTTP requests, Pub/Sub messages or Cloud Storage changes) without managing servers and paying only for execution time. Since 2024 it is called Cloud Run functions; it was formerly Cloud Functions.

Compute Engine virtual machines that use Google's spare capacity at up to a 91% discount. Google can interrupt them with 30 seconds' notice when it needs the capacity back. They replace the older preemptible VMs, which lasted at most 24 hours.

Google Cloud discounts in exchange for committing to a level of resources (vCPU, memory) or a minimum spend for 1 or 3 years. They reach up to 55%, and up to 70% on memory-optimized machines. They differ from Sustained Use Discounts, which apply automatically without a commitment.

Google Cloud's fully managed relational database that scales horizontally worldwide with strong consistency and ACID transactions across regions. In a multi-region configuration it offers a 99.999% SLA.

Google Cloud's wide-column NoSQL database for massive volumes with millisecond latency. It is designed for millions of reads and writes per second with row-key access, not for SQL queries with joins.

A serverless, fully managed NoSQL document database with real-time sync and SDKs for web and mobile apps. It scales automatically and supports transactions. It is the evolution of Cloud Datastore.

Google Cloud's business intelligence platform for exploring data, building dashboards and reports, and defining reusable business metrics with LookML. Looker Studio (formerly Data Studio) is the free version for simple dashboards.

Google Cloud's serverless service for processing streaming and batch data with Apache Beam. It transforms, filters, and enriches data at scale without managing clusters.

A BigQuery capability for creating, training, and using machine learning models with standard SQL (CREATE MODEL, ML.PREDICT), right where the data lives and without moving data or coding in Python.

Google Cloud's API management platform for publishing, securing, monitoring, and monetizing APIs. It includes access control (API keys, OAuth), rate limiting, usage analytics, and a developer portal.

A family of solutions that brings Google Cloud infrastructure and services (GKE, among others) to your own data centers, edge sites, or disconnected environments. It has connected (managed from Google Cloud) and air-gapped (fully isolated) variants. Together with GKE Multi-Cloud, it absorbed what used to be Anthos (later GKE Enterprise).

Google Cloud's network security service that protects internet-facing applications against DDoS attacks and acts as a WAF, with rules for the OWASP Top 10 (SQL injection, XSS), geo-blocking, and rate limiting. It integrates with Cloud Load Balancing.

Google Cloud's central security and risk management service. It inventories resources, detects insecure configurations, vulnerabilities, and threats, and prioritizes findings for remediation.

A Google Cloud control that creates security perimeters around managed services (BigQuery, Cloud Storage, etc.) to prevent data exfiltration, even when the identity accessing them has valid IAM permissions.

Google Cloud's SIEM and SOAR platform (formerly Chronicle) that ingests and analyzes huge volumes of security logs, detects threats with Google and Mandiant threat intelligence, and automates incident response.

A set of Google Cloud services for monitoring applications and infrastructure: Cloud Monitoring (metrics, dashboards, alerts, and SLOs), Cloud Logging (logs), Cloud Trace (distributed latency), and Cloud Profiler (code performance). It was formerly called Cloud Operations Suite and, before that, Stackdriver.

The structure that organizes Google Cloud resources: the organization node at the root, folders for grouping, projects, and each service’s resources inside them. IAM and organization policies are inherited from top to bottom.

A service that enforces constraints on how resources can be configured in the organization, a folder, or a project; for example, gcp.resourceLocations to limit regions or compute.vmExternalIpAccess to block external IPs. It supports a dry-run mode.

Google’s identity service for managing users, groups, and security policies (such as 2-Step Verification) with the company domain, without needing Google Workspace. Identities can be synced from Active Directory with Google Cloud Directory Sync.

A capability that lets an organization’s people access Google Cloud with the credentials of an external identity provider (such as Microsoft Entra ID or Okta), without syncing or duplicating their accounts in Cloud Identity.

A mechanism that lets external workloads (CI/CD pipelines such as GitHub Actions, applications on AWS or Azure, or on-premises systems) exchange their OIDC or SAML token for short-lived Google Cloud credentials, without service account keys.

An identity that applications, VMs, and other workloads use to call Google Cloud APIs instead of a person’s credentials. It can be user-managed or a Google-managed service agent, and it is granted IAM roles like any principal.

Google Cloud’s three role types. Basic roles (Owner, Editor, Viewer) are very broad; predefined roles are maintained by Google with each service’s permissions; custom roles are defined by you with the exact permissions and are created at the organization or a project, not folders.

An IAM policy that blocks specific permissions for certain principals even if a role grants them. It is evaluated before allow policies and is inherited through the resource hierarchy.

A mechanism by which a principal gets short-lived credentials for a service account, without keys, to act with its permissions. It requires the Service Account Token Creator role on the account; in gcloud you use --impersonate-service-account.

Amounts set on a billing account (or some projects or services) with thresholds that send alerts on actual or forecasted spend. They do not stop resources: to act automatically, notifications are sent to Pub/Sub.

The automatic delivery of a billing account’s cost data (standard or detailed) and pricing data to a BigQuery dataset, where it can be queried with SQL or connected to BI tools.

Limits on the amount of resources or requests a project can use, such as vCPUs per region or API calls per minute. They are viewed in the console or with Cloud Quotas, and you can request an increase.

Google Cloud’s virtual private network. It is a global resource with regional subnets that can be expanded without disrupting VMs. It can be auto mode (one subnet per region) or custom mode, the recommended choice for production.

A model where a host project holds the network and service projects deploy resources into its subnets. It lets a central team manage networking while application teams manage their own projects.

A private connection between two VPCs (in the same project or different projects and organizations) so their resources communicate over internal IPs. Each VPC keeps its own administration.

Stateful rules that allow or deny ingress or egress traffic by source, destination, protocol, and port. They apply to all VMs or to those with a network tag or service account. Cloud NGFW adds hierarchical and network firewall policies, which can use IAM-governed secure Tags.

A regional network address translation service that lets VMs and GKE nodes with only internal IPs start connections to the internet without accepting unsolicited inbound connections. It is configured on a Cloud Router.

A setting enabled per subnet that lets VMs with only internal IPs reach Google APIs and services, such as Cloud Storage or BigQuery, without external IPs or internet egress.

A service that connects an on-premises network or another cloud to a VPC through encrypted IPsec tunnels over the internet. HA VPN, with two tunnels to the remote device, offers a 99.99% SLA.

A private, high-bandwidth physical connection between an on-premises network and Google Cloud that avoids the public internet. Dedicated Interconnect connects directly at a colocation facility; Partner Interconnect does so through a supported provider.

Google Cloud’s family of managed load balancers. Application Load Balancers handle HTTP(S) (with URL-based routing and a global option with an anycast IP); Network Load Balancers work at layer 4, as proxy or passthrough, in external and internal versions.

Google Cloud’s network tiers for internet traffic. Premium (the default) keeps traffic on Google’s global network as long as possible; Standard sends it over the public internet near the region, with lower egress cost.

Google Cloud’s managed DNS service. Public zones publish records on the internet; private zones only resolve from authorized VPC networks.

A set of identical VMs created from an instance template. It provides autoscaling, autohealing with health checks, and rolling updates, and it can be zonal or regional (spread across zones).

Durable block storage for Compute Engine VMs. Persistent Disk can be zonal or regional (with synchronous replication between two zones); Hyperdisk lets you provision IOPS and throughput independently of capacity. Local SSD, by contrast, is ephemeral.

A Compute Engine feature that ties VMs’ Linux accounts to Google identities and controls SSH access through IAM roles (Compute OS Login and Compute OS Admin Login) instead of SSH keys in metadata.

A service that controls access to applications and VMs based on identity and context, without a VPN. Its TCP forwarding lets you SSH or RDP into VMs without external IPs, allowing only the 35.235.240.0/20 range in the firewall.

A Google Kubernetes Engine mode in which Google manages the nodes and their configuration. You mainly pay for the resources your Pods request instead of for whole nodes.

A Google Cloud service for storing and managing container images and packages (Maven, npm, Python, and more) in regional or multi-regional repositories. It replaces Container Registry.

Standard (frequent access, no minimum), Nearline (about once a month, 30-day minimum), Coldline (about once a quarter, 90-day minimum), and Archive (less than once a year, 365-day minimum). Colder classes cost less to store and more to access.

Rules on a Cloud Storage bucket that apply automatic actions, such as SetStorageClass or Delete, when objects meet conditions such as age or the number of newer versions.

A URL that gives anyone holding it temporary access to a specific Cloud Storage object, with no Google account required, and that expires after the time you set.

Cloud KMS keys controlled by the customer that a Google Cloud service uses to encrypt its data instead of Google-managed keys. The product’s service agent needs the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.

Logs that record who did what, where, and when in Google Cloud. Admin Activity and System Event logs are always on and kept for 400 days in the _Required bucket; Data Access logs are off by default for most services.

The Cloud Logging component that decides where each log entry goes. Sinks send logs matching a filter to log buckets, BigQuery, Cloud Storage, Pub/Sub, or other projects, and exclusion filters discard the ones you do not want to store.

Google Cloud’s unified agent installed on VMs to collect logs (system logs and apps such as Apache or MySQL) and metrics such as memory, sending them to Cloud Logging and Cloud Monitoring.

A fully PostgreSQL-compatible Google Cloud database service built for demanding workloads, with high transactional performance and a columnar engine that speeds up analytical queries on the same data.

Google Cloud’s managed in-memory caching service, compatible with Redis, Valkey, and Memcached, with sub-millisecond latency.

Google Cloud’s managed NFS file storage service, which several VMs or GKE clusters can mount at once to read and write the same files.

A service that routes events from Google Cloud (such as an object being created in Cloud Storage or an operation recorded in audit logs) and other sources to destinations such as Cloud Run or GKE.

A service that keeps an inventory of an organization’s resources and IAM policies, with search, export to BigQuery or Cloud Storage, and a change history for recent weeks.

An AI assistant built into the Google Cloud console that helps you design, operate, and optimize: it answers natural-language questions about your resources, analyzes logs and metrics to investigate issues, and suggests improvements.

The command-line tool for managing Google Cloud resources. It includes gcloud and other tools such as bq and kubectl, and lets you save named configurations (account, project, region, and zone). It comes preinstalled in Cloud Shell.

A Kubernetes add-on that lets you create and manage Google Cloud resources (such as buckets, Cloud SQL instances, or networks) through Kubernetes manifests, ideal for GitOps workflows.

A set of Google Cloud recommenders that analyze actual usage to suggest improvements: stopping or deleting idle VMs, rightsizing oversized VMs, or trimming IAM roles with unused permissions.

A plugin that lets Terraform interact with a specific API (AWS, Azure, GCP, Kubernetes, etc.). Each provider exposes resources and data sources. It's declared in the terraform.required_providers block.

A file (terraform.tfstate) that Terraform uses to map the real-world configuration in code to actual resources in the cloud. It's Terraform's source of truth about which resources it manages and their current status.

A command that generates and displays an execution plan without applying any changes. It compares the desired configuration with the current state and shows which resources will be created, modified, or destroyed.

A command that applies the changes from the execution plan, creating, modifying, or destroying resources in the provider. It asks for interactive confirmation unless -auto-approve is used.

A reusable set of Terraform resources grouped in a directory. The root module is the main working directory. Child modules are called from the root and can come from local sources, the Terraform Registry, or Git repositories.

A configuration block that describes an infrastructure object (VM, bucket, database) that Terraform creates and manages. Syntax: resource "type" "local_name" { arguments }.

An input parameter that lets you parameterize Terraform configurations. Declared with variable {} and assigned via a .tfvars file, environment variables (TF_VAR_), -var flags, or interactively.

A configuration that defines where Terraform state is stored. Remote backends (S3, Azure Blob Storage, HCP Terraform) enable team collaboration and state locking to avoid conflicts.

Separate state instances within the same configuration. Lets you manage multiple environments (dev, staging, prod) with the same codebase. Each workspace has its own tfstate file.

A value exported after a terraform apply. Lets you expose resource attributes (IPs, URLs, IDs) for use in other modules or to display to the user. Declared with output {} in outputs.tf.

A configuration block that queries information about existing infrastructure (created inside or outside of Terraform) without managing or modifying it. Syntax: data "type" "local_name" { filter arguments }.

Meta-arguments that let you create multiple instances of the same resource or module from a single definition. count iterates over an integer (0..n-1); for_each iterates over a set or map, letting you reference each instance by a stable key instead of a numeric index.

HashiCorp's policy-as-code framework integrated with HCP Terraform (formerly Terraform Cloud/Enterprise), letting you define mandatory policies (e.g. "every S3 bucket must have versioning enabled") that are automatically evaluated before a plan is applied.

A file automatically generated by terraform init that pins the exact versions and checksums of the providers used, ensuring all team members and CI pipelines use exactly the same versions.

A HashiCorp-managed platform that provides a remote backend with locking, remote plan/apply execution, a private module registry, and Sentinel policies, making team collaboration easier without managing your own infrastructure for state.

A marker introduced in Terraform 1.10 that indicates a value (variable, output, or resource result) must never be persisted to state or plan, useful for temporary credentials or other sensitive data that shouldn't be stored on disk.

The difference between the infrastructure described in Terraform code (and reflected in the state) and the actual state of resources at the provider, usually caused by manual changes made outside of Terraform.

A command that brings an existing resource at the provider (created manually or by another tool) into Terraform state, associating it with a resource block already written in the code, without recreating it.

A mechanism to force the destruction and recreation of a specific resource on the next apply, useful when a resource is in an inconsistent state that a normal configuration change won't fix.

Branch of artificial intelligence where systems automatically learn from data to improve their performance on specific tasks without being explicitly programmed for every case.

Subset of machine learning based on deep neural networks with multiple hidden layers. Especially effective for images, audio, and text. Requires large volumes of data and computing power.

Computational model inspired by the human brain, made up of layers of interconnected nodes (artificial neurons). It learns by adjusting the weight of the connections during training.

Type of machine learning where the model is trained on labeled data (examples with known correct answers). The model learns to predict the correct label for new inputs. Includes classification and regression.

Type of machine learning where the model finds patterns in unlabeled data. The algorithm discovers hidden structure in the data. Main technique: clustering.

Supervised learning task that predicts which discrete category an input belongs to. Binary (yes/no, spam/not spam) or multiclass (dog/cat/bird). The output is a class label.

Supervised learning task that predicts a continuous numeric value. The output is a number, not a category. Used for quantitative predictions.

Unsupervised learning technique that groups similar data into clusters without prior labels. The algorithm determines how many groups exist and which elements belong to each one based on similarity.

Branch of AI that lets machines understand, interpret, and generate human language. Includes sentiment analysis, entity extraction, machine translation, text summarization, and chatbots.

Branch of AI that lets machines interpret and understand visual information (images and video). Includes image classification, object detection, facial recognition, and OCR.

Technology that extracts text from images or scanned documents, converting it into editable, searchable digital text. Part of Computer Vision services.

AI model trained on enormous amounts of text that can generate, summarize, translate, and reason over natural language. The foundation of conversational assistants and generative AI tools.

Framework of principles for developing and using AI ethically and reliably. Microsoft defines 6 principles: Fairness, Reliability and safety, Privacy and security, Inclusiveness, Transparency, and Accountability.

ML technique that identifies unusual or atypical patterns in data that deviate significantly from expected behavior. Can be supervised (with anomaly examples) or unsupervised.

Collection of pretrained Azure APIs and services that let you add AI capabilities (vision, speech, language, decision-making) to applications without needing ML expertise. They are consumed via REST API or SDK and are part of Microsoft Foundry. They were formerly called Azure AI Services and, before that, Cognitive Services.

Unified Microsoft platform (formerly Azure AI Studio and Azure AI Foundry) for exploring, comparing, customizing, and deploying generative AI models and agents, including the model catalog, Foundry Agent Service, and evaluation tools, all within a single environment.

Azure service that provides access to OpenAI's models (the GPT-5 family, embeddings, gpt-image and audio models) with Azure's security, compliance, and private networking. Billed by tokens consumed or by provisioned throughput for predictable workloads.

Microsoft Foundry (classic portal) and Azure Machine Learning tool for designing, testing, and evaluating flows that combine prompts, model calls, and Python code in a visual graph. It is no longer recommended for new development and retires on April 20, 2027; its replacement is Microsoft Agent Framework.

Service that detects and filters harmful content (hate, violence, sexual content, self-harm) in both text and images, whether generated by users or by AI models, returning configurable severity levels.

Service that lets you train custom image classification and object detection models by uploading your own labeled images, without needing machine learning expertise. Microsoft announced its retirement, with support until September 25, 2028.

Service specialized in detecting and analyzing human faces: location, attributes (approximate age, emotion), and face comparison/verification. 1:N facial identification is subject to limited-access restrictions under Microsoft's responsible AI policies.

NLP capability that automatically identifies and classifies entities within a text: people, places, organizations, dates, monetary amounts, etc.

Service that converts spoken audio into text (Speech to Text) and text into natural-sounding voice (Text to Speech), supporting real-time and batch transcription, plus speech translation and speaker recognition.

Azure AI Language feature that builds a question-and-answer knowledge base from documents, FAQs, or text, letting you create a bot that answers accurately from curated content instead of generating answers freely.

Service (formerly Form Recognizer) that extracts text, key-value pairs, tables, and structure from documents such as invoices, receipts, forms, and IDs, using prebuilt or custom models.

Repository within Azure AI Foundry that lists and compares foundation models from OpenAI, Meta, Mistral, Cohere, and other providers, with benchmark metrics, cost, and capabilities, before deploying them as an endpoint.

High-dimensional numeric representations that capture the semantic meaning of text, images, or other data. Elements with similar meaning end up close to each other in vector space, enabling similarity search.

Database optimized for storing embeddings and performing similarity (nearest neighbor) searches efficiently at scale. On AWS, services like OpenSearch Service, Aurora (with pgvector), Neptune, and RDS for PostgreSQL can act as a vector store.

Technique that combines retrieving relevant information from an external source (vector database, documents) with generation from a language model, enabling answers grounded in up-to-date or private data without retraining the model.

Fully managed service that provides API access to foundation models from multiple providers (Anthropic, Meta, Amazon Nova and Titan, Mistral, Cohere, Stability AI) without managing infrastructure. Includes Knowledge Bases (RAG), Agents, Guardrails, and fine-tuning and model evaluation capabilities.

Bedrock feature that implements RAG in a managed way: it ingests documents, converts them into embeddings, indexes them in a vector database, and automatically connects them to a foundation model to enrich its responses with your own context.

Bedrock feature that lets a foundation model orchestrate multi-step tasks: interpret the user's intent, invoke external APIs or functions, query Knowledge Bases, and chain actions together to complete a complex task autonomously.

Configurable controls in Bedrock to filter harmful content, block disallowed topics, redact sensitive information (PII), and reduce hallucinations, applied to both user inputs and model outputs.

Process of continuing to train a pretrained foundation model on your own labeled dataset to specialize it for a specific task or domain, adjusting the model's weights (unlike RAG or in-context learning, which don't modify the model).

Training technique where a model is fine-tuned using human feedback on the quality of its responses, training a reward model that guides the main model toward outputs more aligned with human preferences.

Prompt engineering technique where the model is instructed to make its reasoning explicit step by step before giving the final answer, improving performance on logical or mathematical reasoning tasks.

Prompt engineering technique where several examples of the desired input-output are included in the prompt before the actual request, helping the model understand the expected format or style without fine-tuning. Zero-shot includes no examples; one-shot includes exactly one.

Attack where a malicious user includes hidden instructions in their input to manipulate the model into ignoring its original instructions, revealing confidential information, or performing unauthorized actions.

Large-scale AI model, pretrained on huge volumes of diverse data, that can be adapted to multiple downstream tasks (text, image, code) through prompting, fine-tuning, or RAG, without needing to be trained from scratch for each use case.

Neural network architecture based on the "attention" mechanism, which processes entire sequences in parallel and weighs the relevance of each word relative to the others. It's the foundation of virtually all modern LLMs.

Settings that control how a model generates output: temperature adjusts randomness/creativity (low values = more deterministic, high values = more creative); top-p (nucleus sampling) limits selection to the tokens whose cumulative probability reaches a threshold; top-k limits selection to the k most probable tokens.

Tool that detects potential bias in training data and in ML model predictions, and generates explanations for predictions (feature importance) to improve model transparency.

Structured documentation of an ML model that records its purpose, training data, performance metrics, known limitations, and ethical considerations, supporting governance and traceability throughout the model's lifecycle.

AWS framework that classifies generative AI workloads into 5 categories (from consuming a third-party SaaS app to training your own model from scratch) to identify the security and governance responsibilities specific to each level.

Family of natively multimodal foundation models from Google DeepMind, capable of processing and generating text, image, audio, and video within a single model. Available in variants of different size/cost (e.g. Flash for low latency, Pro for complex tasks).

Family of open models from Google, lightweight and with publicly available weights, derived from the same research as Gemini. They allow local or self-hosted execution and fine-tuning by the developer.

Family of Google Cloud foundation models specialized in generating and editing images from text descriptions, available via Vertex AI.

Google Cloud video generation model that creates video clips from text descriptions or images, available via Vertex AI for audiovisual content creation use cases.

The maximum number of tokens (text, and in multimodal models also image/audio/video) a model can consider simultaneously as input in a single request, including the prompt, conversation history, and any attached documents.

The practice of connecting a generative model's responses to verifiable data sources (the company's own data, third-party data, or the real world via web search) to reduce hallucinations and increase the factual accuracy of responses.

Google's framework for securing AI systems across their entire lifecycle, covering infrastructure security, training data, the model, and the applications that consume it, with controls and best practices at every layer.

A centralized catalog in Vertex AI (now Gemini Enterprise Agent Platform) where developers discover, compare, and deploy foundation models from Google (Gemini, Gemma) and third-party/open source, with pricing, capability, and benchmark information.

Google Cloud's platform (the evolution of Vertex AI since April 2026) for building custom AI agents that combine foundation models with extensions, functions, data stores, and prebuilt RAG (Agent Search), enabling automation of complex business tasks.

A hardware accelerator chip designed specifically by Google for machine learning training and inference workloads, optimized for massive matrix operations, as an alternative or complement to GPUs.

A Google Cloud supercomputing architecture that integrates optimized hardware (TPUs, GPUs), open software, and flexible consumption frameworks to train and serve AI models at scale in a cost- and energy-efficient way.

An advanced prompting technique that combines Reasoning and Acting: the model alternates between thinking step by step and executing concrete actions (such as calling a tool or API), observing the result before continuing to reason.

An AI model capable of processing and/or generating multiple types of data (text, image, audio, video) within a single architecture, instead of requiring a separate model per modality.

A type of generative model that learns to create data (typically images) starting from random noise and progressively refining it through successive steps until it produces an output consistent with the input prompt.

A Google Cloud service that extracts, classifies, and structures information from documents (invoices, contracts, forms) by combining OCR with natural language understanding, without needing to train your own model.

A Google Cloud product within Customer Engagement Suite for building conversational agents (chatbots/voicebots) for customer service, combined with Agent Assist (real-time assistance for human agents) and Conversational Insights (conversation analytics).

Google's set of principles and practices for ethical AI development: fairness, privacy, safety, transparency, and accountability, applied through tools such as Security Command Center, IAM, and data governance policies throughout the model lifecycle.

A managed Google Cloud service for indexing embeddings and performing large-scale, low-latency similarity (nearest neighbor) searches, a core component of RAG architectures within Vertex AI.

A no-code interface within Vertex AI (now part of Gemini Enterprise Agent Platform) for experimenting with foundation models: testing prompts, tuning inference parameters (temperature, top-k, top-p), and comparing responses before integrating a model into an application.

The ability of a language model to identify when a request requires invoking an external tool or API, generating the structured call (function name and parameters) instead of just free text. The actual execution of the function happens outside the model.

A response generated by a model that sounds coherent and confident but is factually incorrect or made up, resulting from the model predicting plausible text instead of consulting a source of truth.

The extension of MLOps practices to foundation models and generative AI applications: prompt versioning, continuous evaluation of response quality, inference cost monitoring, and detection of model behavior degradation in production.