ARN (Amazon Resource Name)
An ARN is a globally unique identifier that names a cloud resource within AWS, encoding the partition, service, region, account, and resource path. ARNs are used throughout policies and APIs to reference exactly which resource a permission or action applies to. Equivalent concepts exist on other clouds, such as Azure resource IDs and GCP resource names.
AZ (Availability Zone)
An AZ is an isolated location within a cloud region, with independent power, cooling, and networking, used to build fault tolerance inside a single region. Distributing replicas across two or more AZs survives the loss of one data centre with minimal added latency.
CIDR (Classless Inter-Domain Routing)
CIDR is the notation for IP address ranges written as an address followed by a prefix length, such as 10.0.0.0/16, used to size VPCs and subnets. A smaller prefix number means a larger address block. Non-overlapping CIDR ranges are essential when peering networks or planning hybrid connectivity.
CNCF (Cloud Native Computing Foundation)
The CNCF is the vendor-neutral Linux Foundation body that hosts and governs cloud-native open-source projects, most notably Kubernetes, Prometheus, Envoy, and etcd. Its graduation levels (sandbox, incubating, graduated) signal a project's maturity and adoption.
CSP (Cloud Service Provider)
A CSP is a company that delivers computing resources - compute, storage, networking, and managed services - over the internet on a pay-as-you-go basis. The largest are Amazon Web Services, Microsoft Azure, and Google Cloud, with many regional and specialised providers alongside them.
CRD (Custom Resource Definition)
A CRD extends the Kubernetes API with new resource types beyond the built-in ones, letting operators manage application-specific objects declaratively. Together with a controller it implements the operator pattern, encoding operational knowledge as software that reconciles custom resources.
DNS (Domain Name System)
DNS is the hierarchical naming system that resolves human-readable names to IP addresses and other records, and in the cloud it doubles as a traffic-management tool. Latency-based, geolocation, weighted, and health-checked DNS routing underpin global load balancing and region failover.
FinOps (Cloud Financial Operations)
FinOps is the operational practice of bringing financial accountability to variable cloud spend, uniting engineering, finance, and product around cost visibility, optimisation, and continuous improvement. It tags resources for showback/chargeback and treats cost as an engineering metric rather than an after-the-fact invoice.
GitOps
GitOps is an operational model in which a Git repository is the single source of truth for declarative infrastructure and application state, and an automated agent continuously reconciles the live system to match the repository. Pull requests become the change interface, giving review, audit, and easy rollback by reverting a commit.
HA (High Availability)
HA denotes a system engineered to remain operational despite component failures, through redundancy and automatic failover, expressed as an uptime percentage. Each additional "nine" (99.9% to 99.99%) cuts allowable downtime roughly tenfold and usually multiplies cost and complexity.
HPA (Horizontal Pod Autoscaler)
The HPA is the Kubernetes controller that automatically scales the number of Pod replicas in a workload based on observed CPU, memory, or custom metrics. It targets horizontal scaling; the Vertical Pod Autoscaler instead adjusts per-Pod resource requests, and the Cluster Autoscaler adds or removes nodes.
IaC (Infrastructure as Code)
IaC is the practice of provisioning and managing infrastructure with version-controlled definition files instead of manual operations, making environments reproducible and reviewable. Declarative tools (Terraform, CloudFormation) converge to a desired state; configuration-management tools (Ansible) can be declarative or procedural.
IAM (Identity and Access Management)
IAM is the framework of identities (users, roles, service accounts) and policies that controls who can perform which actions on which resources. Cloud IAM is the primary security control plane, and the principle of least privilege - granting only the permissions needed - is its central discipline.
IaaS / PaaS / SaaS
These are the three classic cloud service models, distinguished by how much the provider manages. IaaS delivers raw compute, storage, and networking; PaaS delivers a managed application platform on top; SaaS delivers a complete application consumed over the web. Moving up the stack trades control for reduced operational burden.
K8s (Kubernetes)
K8s is the common abbreviation for Kubernetes (the eight letters between K and s), the standard container-orchestration platform. It is pronounced "kates" and underlies most cloud-native deployments, available as a managed control plane on every major cloud.
MTTR (Mean Time To Recovery)
MTTR is the average time taken to restore service after a failure, a core reliability metric that, together with mean time between failures, characterises operational maturity. Reducing MTTR - through fast detection, good runbooks, and automated rollback - usually improves availability more cheaply than preventing every failure.
mTLS (Mutual TLS)
mTLS is Transport Layer Security in which both client and server present and verify certificates, so each side authenticates the other. In service meshes it secures service-to-service traffic by default, providing encryption and strong workload identity without changing application code.
NAT (Network Address Translation)
NAT rewrites IP address information in packet headers so that instances with private addresses can share public addresses for outbound connectivity. A NAT gateway lets resources in a private subnet reach the internet for updates and API calls while remaining unreachable from it.
OCI (Open Container Initiative)
The OCI is the Linux Foundation project that standardises container formats through the image, runtime, and distribution specifications. Because of OCI, an image built by one tool runs on any compliant runtime, decoupling build tooling from execution and registries.
RPO (Recovery Point Objective)
RPO is the maximum acceptable amount of data loss measured in time - for example, "at most five minutes of data" - which dictates how frequently data must be replicated or backed up. A near-zero RPO requires synchronous replication, which is more expensive and adds latency than asynchronous approaches.
RTO (Recovery Time Objective)
RTO is the maximum acceptable duration to restore service after a disruption, driving the choice of disaster-recovery pattern. A tight RTO favours warm-standby or active-active architectures, while a relaxed RTO permits cheaper backup-and-restore.
SLA / SLO / SLI
These three terms describe reliability targets at decreasing levels of formality. An SLI is a measured indicator (such as the proportion of successful requests); an SLO is the internal target for that indicator; and an SLA is the external contract with consequences if the target is missed. SLOs are typically set tighter than the SLA to leave margin.
SLO (Service Level Objective)
An SLO is a target value or range for a service-level indicator over a window, such as "99.9% of requests succeed over 30 days". The remaining allowance is the error budget, which teams spend on releases and risk. SLOs translate reliability into a measurable, negotiable engineering goal.
TCO (Total Cost of Ownership)
TCO is the full lifetime cost of a system, including not only compute and storage but data transfer, support, licensing, operations, and the engineering time to run it. Cloud TCO analysis often reveals that egress and operational labour, not instance hours, dominate the bill.
TLS (Transport Layer Security)
TLS is the cryptographic protocol that secures data in transit, providing encryption, integrity, and server (optionally client) authentication; HTTPS is HTTP over TLS. In cloud architectures TLS is terminated at load balancers, CDNs, or service-mesh proxies, and certificates are managed automatically by the platform.
VM (Virtual Machine)
A VM is an emulated computer with its own guest OS running on a hypervisor that multiplexes physical hardware. VMs are the compute primitive of IaaS, offering strong isolation and broad OS support at higher overhead and slower startup than containers.
VPC (Virtual Private Cloud)
A VPC is a logically isolated, software-defined network in a public cloud where you define IP ranges, subnets, route tables, and gateways. It is the foundation for network segmentation, controlling which workloads are public, which are private, and how they connect to other networks.
WAF (Web Application Firewall)
A WAF inspects and filters HTTP traffic to a web application, blocking common attacks such as SQL injection and cross-site scripting and enforcing rate limits and geo rules. Cloud WAFs are typically attached to a load balancer or CDN at the network edge, in front of the origin.