Glossary
One plain sentence per word, and where MiniTickets uses it. Words are added as chapters are written; Parts 0 to 6 are covered so far.
A to E
Section titled “A to E”| Term | In plain words | Read more |
|---|---|---|
| ACM (AWS Certificate Manager) | Issues and renews free TLS certificates for HTTPS. | DNS and certificates |
| Alarm (CloudWatch) | Watches one metric against a threshold and is OK, ALARM or INSUFFICIENT_DATA. | Alarms |
| ALB (Application Load Balancer) | The one way in: reads each HTTP request and sends it to a target group. | Load balancer |
| argon2id | A slow, memory-hungry password hash, so stolen hashes are expensive to guess. | Sessions |
| At-least-once delivery | A message may arrive more than once, never zero times. | DynamoDB |
| Availability zone | One or more separate data centres inside a region. | Account and region |
| AWS account | The container for resources, permissions and the bill. | Account and region |
| awsvpc | ECS network mode where each task gets its own network card and IP. | ECS on Fargate |
| Bootstrap | Creating, once, what CD needs before its first run. | Bootstrap |
| Budget (AWS Budgets) | Emails a warning when spending passes a limit; it never stops anything. | Cost switches |
| Cache stampede | Many requests miss an expired cache entry at once and all hit the database. | Caching |
| Cache-aside | Look in the cache first; on a miss, read the database and store a copy. | Caching |
| CD (continuous deployment) | Ships the commit CI approved: publish images, then deploy them. | CD |
| CI (continuous integration) | Checks every push: types, lint, tests, images. | CI |
| CIDR | A way to write an address range, like 10.0.0.0/16. | VPC and subnets |
| Circuit breaker (ECS) | Rolls a service back when the new tasks never get healthy. | ECS on Fargate |
| CloudFront | AWS’s CDN: HTTPS and caching at edge locations near the user. | CloudFront |
| CNAME | A DNS record that says “this name is an alias for that name”. | DNS and certificates |
| Conditional write | A DynamoDB write that succeeds only if a condition holds, such as “no item yet”. | DynamoDB |
| Correlation id | One id per request, on every log line, to follow it everywhere. | JSON logs |
| Cost switch | A committed setting that turns a billed layer on or off. | Cost switches |
| CSP (Content-Security-Policy) | A header that tells the browser which scripts and sources may load. | Security headers |
| CSRF | A trick where another site makes your browser send a request with your cookie. | Security headers |
| Dashboard (CloudWatch) | One page of graphs and log lines for the whole system. | The dashboard |
| Dead-letter queue (DLQ) | Where a message goes after it failed too many times. | SQS and the DLQ |
| Debounce | Wait until the user stops typing before doing the work. | Search and pagination |
| Deploy guard | Refuses infrastructure code older than what is live, or already superseded. | Rollback and the guard |
| DKIM | A signature on each email, checked against a public key in DNS. | Email with SES |
| DynamoDB | AWS’s key-value database, billed per request. | DynamoDB |
| ECR (Elastic Container Registry) | Private storage for container images. | ECR and images |
| ECS (Elastic Container Service) | AWS’s service for running containers. | ECS on Fargate |
| ElastiCache | AWS’s managed Redis-compatible cache; ours runs Valkey. | ElastiCache Valkey |
| Event source mapping | Lambda’s poller that reads a queue and calls the function with batches. | The Lambda worker |
| Execution role (task execution role) | The IAM role ECS uses to start a task: pull the image, read secrets, write logs. | IAM roles |
| Expand and contract | Add new schema first, remove old parts later, so old code keeps working. | Migrations |
F to R
Section titled “F to R”| Term | In plain words | Read more |
|---|---|---|
| Fan-out | One published message copied to every subscriber. | SNS fan-out |
| Fargate | Runs ECS tasks without servers for us to manage. | ECS on Fargate |
| Fargate Spot | Spare Fargate capacity, about 70% cheaper, that AWS may take back with 2 minutes’ warning. | ECS on Fargate |
| Health check | A regular request to a target; failing targets get no traffic. | Load balancer |
| HSTS | A header that makes the browser use only HTTPS for a while. | Security headers |
| HttpOnly cookie | A cookie that page scripts cannot read. | Sessions |
| IAM role | An identity with permissions that a trusted service can assume for a while. | IAM roles |
| Idempotency key | A random id per intent, so a repeated request has no extra effect. | Idempotency |
| Idempotent consumer | A consumer that gives the same result when a message arrives twice. | DynamoDB |
| Immutable tag | An image tag that can never point at other bytes. | Images and scans |
| Inbound rule | A security group rule: this port, from this source, may connect in. | Security groups |
| Internet gateway | Connects a VPC to the internet for resources with a public IP. | Route tables |
| Keyset pagination | The next page starts after the last row seen, not at an OFFSET. | Search and pagination |
| Lambda | Runs a function only when there is work, billed per call and duration. | The Lambda worker |
| Lifecycle policy (ECR) | Rules that delete old images, keeping rollback targets. | Images and scans |
| Listener / listener rule | A port on the ALB, and its ordered rules for where each request goes. | Load balancer |
| Log group | One named place in CloudWatch Logs, with a retention. | JSON logs |
| Logs Insights | A query language over CloudWatch log lines. | JSON logs |
| Migration | A SQL file that changes the database’s tables. | Migrations |
| MVCC | Postgres keeps old row versions so readers never wait for writers. | Row locks |
| NAT gateway | Lets private resources start connections out; MiniTickets has none. | Route tables |
| Nonce | A random value used once; here, it marks which scripts may run. | Security headers |
| OIDC (OpenID Connect) | Signed short-lived tokens that let a GitHub job assume an AWS role. | OIDC |
| Outbox | A row written in the same transaction as the booking, sent to SNS afterwards. | The outbox |
| Partial batch failure | The handler lists only the failed messages, so only they retry. | The Lambda worker |
| Permission policy | The part of a role that says which actions on which resources are allowed. | IAM roles |
| Prefix list | A named set of address ranges, like all of CloudFront’s. | CloudFront |
| Presigned URL | A link signed with someone’s permissions, valid for a short time. | S3 and presigned URLs |
| RBAC | Role-based access control: routes check a role, not a person. | Roles in the app |
| RDS | AWS’s managed relational databases; ours runs Postgres 17. | RDS Postgres |
| Redrive | Moving messages from a DLQ back to their source queue. | SQS and the DLQ |
| Region | A geographic area of AWS with its own copy of each service. | Account and region |
| Resource policy | A policy attached to a resource, saying who may use it. | SNS fan-out |
| Rollback (app) | Running an older image with today’s infrastructure. | Rollback and the guard |
| Route table | Rules saying where packets for each address range go. | Route tables |
| Row lock | SELECT … FOR UPDATE: no one else may change this row until we commit. | Row locks |
| Runbook | A written checklist for one known situation: signal, check, fix, verify. | Runbooks |
S to Z
Section titled “S to Z”| Term | In plain words | Read more |
|---|---|---|
| S3 | AWS’s object storage for files, private by default. | S3 and presigned URLs |
| SameSite cookie | A cookie the browser does not send on most cross-site requests. | Sessions |
| Secret (Secrets Manager) | A stored, encrypted password or URL; every read is logged. | Secrets |
| Security group | A stateful firewall on a network card that lists what is allowed. | Security groups |
| Service (ECS) | Keeps a number of tasks running and replaces failed ones. | ECS on Fargate |
| Service Connect | Private names (api, web) so ECS services can call each other. | ECS on Fargate |
| SES (Simple Email Service) | Sends email from identities we have proven we own. | Email with SES |
| SES sandbox | A new account’s limits: verified recipients only, 200 a day. | Email with SES |
| Session | Server-side record of who is logged in; the browser holds only its id. | Sessions |
| Smoke test | A quick request after a deploy to prove the app answers. | Two-phase deploy |
| SNS (Simple Notification Service) | Delivers each published message to every subscriber. | SNS fan-out |
| SQS (Simple Queue Service) | Keeps messages until a consumer deletes them. | SQS and the DLQ |
| Stack (Pulumi) | One environment of the infrastructure, like dev. | Account and region |
| Stateful | A reply to an allowed request is allowed back automatically. | Security groups |
| Subnet | A slice of the VPC’s addresses in one availability zone. | VPC and subnets |
| Target group | The list of targets a load balancer may send to, plus a health check. | Load balancer |
| Task / task definition | One running container copy / its versioned recipe. | ECS on Fargate |
| Task role | The IAM role the app’s own code runs with. | IAM roles |
| TLS termination | Where HTTPS is decrypted; for us, at the ALB. | Load balancer |
| Token bucket | A rate limit: a burst of tokens that refills at a steady rate. | Rate limits |
| Transaction | Statements that commit together or not at all. | Row locks |
| Trivy | A scanner that lists known vulnerabilities in an image. | Images and scans |
| Trust policy | The part of a role that says who may assume it. | IAM roles |
| TTL (DynamoDB) | Deletes an item some time after the time in one of its attributes. | DynamoDB |
| Two-phase deploy | Infrastructure and migration first, the new app version second. | Two-phase deploy |
| Valkey | An open-source fork of Redis that speaks the same protocol. | ElastiCache Valkey |
| Visibility timeout | How long a received message stays hidden from other consumers. | SQS and the DLQ |
| VPC | A private network in AWS that belongs to our account. | VPC and subnets |
| workflow_run | A GitHub trigger: start this workflow when another one completes. | CI |
Read this book online: https://book.theversehub.in/