Cloud words, explained simply.

BaaS

A service that provides ready-made backend features, such as user login, database, file storage and push notifications, so app developers do not have to build or run servers.

Backend for Frontend

A pattern where each type of client, such as web or mobile, gets its own small backend that shapes data for that experience and calls the underlying services.

Backpressure

A way for an overloaded part of a system to signal producers to slow down, or to buffer or drop work in a controlled way, instead of collapsing under too much input.

Backpropagation

The method that works out how much each connection in a neural network contributed to an error and adjusts it, passing the correction backwards from the output to the input.

Backup

A separate, protected copy of data kept so it can be restored after deletion, corruption, attack or failure, ideally stored apart from the original.

Bare Metal

Renting a physical server with no virtualization layer, so one customer gets all of its hardware directly.

Bastion Host

A hardened server or managed service that is the only way to reach private machines for administration, typically over SSH or RDP, with logging and tight controls.

Batch Computing

Processing many tasks automatically in groups, such as nightly reports, video conversion or simulations, using temporary pools of computing that start and stop as needed.

Bayesian Networks

A diagram of variables linked by cause-and-effect arrows, with probabilities on each link, used to reason about uncertain situations such as diagnosing a fault.

Bias (in AI)

When an AI system gives results that favor or disadvantage certain groups, often because its training data reflects past prejudice or because of how it was designed and measured.

Big Data

Data in such volume, speed or variety, such as clickstreams, sensor feeds and logs, that it cannot be handled with ordinary single-computer tools and needs distributed systems.

Billing Account

The account that holds your payment method and receives invoices, and to which one or more subscriptions, projects or accounts are linked.

Blast Radius

The extent of damage if something goes wrong, such as a compromised account, a bad deployment or a failed component.

Block Storage

Storage that exposes data as fixed-size blocks, behaving like a hard drive attached to a server. It suits databases, boot volumes and fast, frequently changing data.

Blockchain

A shared record of transactions kept by many computers, where entries are linked and very hard to change afterwards. It is the technology behind cryptocurrencies and some supply-chain systems.

Blue/Green Deployment

A release method that runs two identical environments: users stay on the current one (blue) while the new version (green) is tested, then traffic is switched over.

Brute-force Attack

An attack that tries huge numbers of passwords or keys, often with stolen lists, until it finds one that works.

Bucket

A top-level container in object storage that holds files (objects). Each bucket has a globally unique name, its own access rules and settings.

Budget Alert

A notification set at a spending or usage threshold, for example 80% of a monthly budget, sent by email or to a chat, so you can act before overspending.

Bulkhead

A pattern that splits resources, such as thread pools, queues or clusters, into separate compartments so a problem in one cannot use up everything and sink the rest.

Burstable Instance

A low-cost instance that earns credits while idle and spends them to run at full speed for short periods, ideal for light workloads with occasional peaks.

BYOK / CMK

BYOK lets you supply your own encryption keys to the provider. A customer-managed key (CMK) is a key you control and can rotate or disable, instead of the provider's default key.

CaaS

A service that lets you run and manage containers without handling the underlying servers or orchestration software yourself.

Cache-aside

A caching pattern where the application looks in the cache first; if the data is missing it loads it from the database and stores a copy in the cache for next time.

Canary Deployment

A release approach where the new version is given to a small share of traffic first, watched closely, and expanded only if it behaves well.

CapEx vs OpEx

Capital expenditure (CapEx) is a large upfront purchase of assets like servers. Operating expenditure (OpEx) is ongoing spending on services, which is how most cloud usage is billed.

CDN

A worldwide network of edge servers that keeps copies of your content close to users, so pages, images and video load faster and your origin server works less.

Cell-based Architecture

A design that runs the whole application as multiple self-contained copies, called cells, each serving a slice of customers, so a failure affects only one cell.

CERT-In

India's national agency for cybersecurity incidents. Its 2022 directions require reporting certain incidents within six hours, keeping logs for 180 days in India and keeping system clocks in sync.

Chain of Thought

A prompting technique, now built into some models, where the AI writes out its intermediate reasoning steps before the final answer, which often improves accuracy on hard problems.

Chargeback / Showback

Showback reports each team's cloud costs for information only. Chargeback goes further and actually bills those costs to the team's own budget.

Chatbot

A program that talks with users by text or voice, from simple rule-based menus to AI assistants that understand and generate natural language.

CI/CD

Practices that automatically build and test code whenever it changes (integration), then release it to production through automated steps (delivery or deployment).

Circuit Breaker

A pattern where calls to a failing dependency are paused after repeated errors, then tried again later, so the failure does not drag down the caller too.

CIS Benchmarks

Free, community-built checklists from the Center for Internet Security that describe secure settings for cloud accounts, operating systems and software.

Closed Source

Software or AI models whose internal code, and often training data and weights, are kept private by their owner and used only through an app or API.

Cloud Adoption Framework

Structured guidance from a cloud provider on planning and managing a move to the cloud, covering strategy, people, governance, security and operations.

Cloud Bursting

A setup where an application normally runs in your own data center and temporarily spills extra load into a public cloud when demand exceeds local capacity.

Cloud Computing

Using servers, storage, databases, networking and software over the internet from a provider, instead of buying and running your own hardware, and paying for what you use.

Cloud Marketplace

An online store run by the cloud provider where you can buy and deploy third-party software, with charges added to your cloud bill.

Cloud Migration

The process of moving applications, data and workloads from on-premises or another environment into the cloud, using one of several approaches such as rehost, replatform or refactor.

Cloud Provider

A company that owns and runs cloud infrastructure and sells it as services, such as AWS, Microsoft Azure and Google Cloud, or smaller specialist and local providers.

Cloud Repatriation

Moving applications or data from the public cloud back to on-premises or a private data center, usually for cost, performance or control reasons.

Cloud Shell

A free, browser-based terminal with the provider's command-line tools already installed and signed in, so you can manage cloud resources without setting up anything locally.

Cloud-first

A strategy where new systems are built in the cloud unless there is a strong reason not to, instead of defaulting to own hardware.

Cloud-native

Applications designed from the start to use cloud strengths, typically with containers, microservices, automation and managed services, so they scale and recover easily.

Cluster

A set of computers, called nodes, joined so they act as one system, for example a Kubernetes cluster that runs and manages your containers.

Cluster Autoscaler

A component that automatically adds nodes when pods cannot be scheduled for lack of space and removes unneeded nodes when load falls.

CNAPP

An integrated security platform combining posture management (CSPM), workload protection (CWPP) and code scanning, to see risk across the whole application life cycle.

Cold Start

The extra wait when a serverless function or container has to start from scratch because no warm copy is ready to answer.

Cold Storage

Very low-cost storage for data you rarely access, such as backups and compliance records. Retrieval is slower or carries a fee in return for cheaper storage.

Colocation

Renting space, power and cooling in a third-party data center for your own servers, while you manage the hardware yourself.

Commitment Discounts

Lower prices offered in return for committing to a certain amount of usage, typically for one or three years, instead of paying on-demand rates.

Community Cloud

A cloud used by several organizations with similar requirements, such as government bodies or banks, and shared by them or run for them by a provider.

Compliance

Meeting the rules set by laws, regulators, industry standards or contracts, and being able to prove it with evidence.

Computer Vision

AI that identifies and understands what is in images and video, such as faces, objects, text, defects or unsafe behavior.

Confidential Computing

Hardware-based technology that keeps data encrypted and isolated even while it is being processed, so even the cloud provider and its administrators cannot see it.

Confidential Data

Information that would cause harm if disclosed, such as trade secrets, financial records, health data and customer details, usually handled under strict rules.

ConfigMap

A Kubernetes object that stores non-secret configuration, such as URLs and feature flags, separate from container images.

Consolidated Billing

Combining the usage of many accounts or projects into a single bill, which also lets volume discounts and commitments be shared across them.

Container

A lightweight, portable package that bundles an application with everything it needs to run, so it behaves the same on a laptop, a server or any cloud.

Container Image

A read-only package holding an application plus everything it needs, such as libraries and settings. Containers are started from images.

Container Orchestration

Using software to automatically start, stop, connect, scale and heal many containers across many machines. Kubernetes is the most common orchestrator.

Container Registry

A storage service where container images are kept, versioned and shared, so clusters and pipelines can pull them when needed.

containerd

A lightweight, widely used container runtime that pulls images and starts and stops containers on a node. It is the default runtime in most managed Kubernetes services.

Context Rot

The tendency of a language model's accuracy and focus to decline as more text is stuffed into its context window, even when the answer is in there.

Context Window

The maximum amount of text, measured in tokens, that a model can take in and keep in mind for one request, including your prompt, documents and its own reply.

Contrastive Learning

A training approach that teaches a model to place similar items close together and different items far apart, without needing many labels.

Control Plane

The part of a system that makes decisions and manages resources, such as creating servers, setting policies and scheduling work, separate from the part that does the actual work.

Cost Allocation

Assigning each part of the cloud bill to the team, project, product or customer that caused it, usually through tags, accounts or projects.

Cost Anomaly

A sudden or unexpected rise in cloud spend compared with normal patterns, often detected automatically and linked to the service or account that caused it.

Cost Explorer

A reporting tool that charts cloud costs over time and lets you filter by service, account, tag or region to find trends and savings.

CQRS

A design that uses separate models for changing data (commands) and for reading it (queries), so each side can be tuned and scaled on its own.

CRD

A way to add your own object types to Kubernetes, so tools and operators can manage new kinds of resources using the same Kubernetes API.

Credits

A balance given by the provider, through startup programs, promotions or training, that is applied against your bill before any card payment is charged.

CSPM

Tools that continuously scan your cloud setup for risky settings, such as public storage or open ports, and compare it with security best practices.

CWPP

Security tools that protect running workloads, such as virtual machines, containers and serverless functions, by detecting threats, vulnerabilities and malware on them.

DaaS

A service that delivers a full virtual desktop, Windows or Linux, from the cloud to any device, with the provider running the infrastructure.

DaemonSet

A Kubernetes object that runs a copy of a pod on each node, or selected nodes, for things like log collectors and monitoring agents.

Dashboard

A visual page that brings key metrics, charts and statuses together so people can see the health of systems at a glance.

Data Annotation

Marking up raw data, such as drawing boxes on images, tagging text or transcribing audio, so supervised models can learn from correct examples.

Data Augmentation

Creating extra training examples by altering existing ones, such as flipping or cropping images or rephrasing sentences, to make models more robust.

Data Lake

A central store that keeps large volumes of raw data in its original format, structured or not, until you decide how to analyze it.

Data Masking

Replacing or obscuring sensitive data, for example showing only the last four digits, so people and test systems can work with realistic data without seeing the real values.

Data Mining

Using statistics and machine learning to discover patterns, groups and unusual items in large datasets, such as which products are bought together.

Data Plane

The part of a system that carries the actual traffic or processes the data, such as forwarding network packets or serving user requests.

Data Tiering

Placing data on different storage levels by how often it is used, for example hot data on fast storage and old data on cheap archive.

Data Transfer Appliance

A rugged storage device the provider sends you to copy large amounts of data locally and return, to be uploaded to the cloud without relying on the internet.

Data Transfer Charges

Fees for data moving between regions, between zones, to the internet or between clouds. Incoming data is usually free, while outgoing data is charged per gigabyte.

Data Warehouse

A database designed for fast analysis of large amounts of structured, cleaned data, drawn from many sources, mainly for reports and dashboards.

DBaaS

A managed database where the provider handles installation, patching, backups, scaling and failover, and you simply use the database.

DDoS

An attack that floods a website or service with traffic from many sources so real users cannot get through.

Dead-letter Queue

A separate queue where messages are moved after they repeatedly fail to be processed, so they can be inspected and fixed instead of blocking everything or being lost.

Decision Boundary

The dividing line, or surface, a classifier learns that separates one category from another, for example spam from not spam.

Decision Tree

A model that makes a prediction by following a series of simple questions, like branches of a tree, until it reaches a result.

Dedicated Host

A physical server whose capacity is entirely reserved for your use, on which you run your own virtual machines, giving visibility of the hardware and help with license rules.

Dedicated Instance

A virtual machine that runs on hardware used only by your account, though the provider still chooses which physical server hosts it.

Deduplication

A technique that finds repeated blocks of data and keeps a single copy with references to it, saving space.

Deep Learning

A kind of machine learning that uses neural networks with many layers to learn complex patterns, especially in images, speech and text.

Defense in Depth

A strategy of using several independent layers of security, such as network, identity, application and data controls, so one failure does not expose everything.

Deployment (Kubernetes)

A Kubernetes object that declares how many copies of an application should run and handles updates and rollbacks by gradually replacing pods.

Diffusion Model

A type of generative AI that creates images, audio or video by starting from random noise and removing it step by step until a clear result appears, guided by a text prompt.

Digital Twin

A virtual model of a physical object, building, machine or process that is kept up to date with sensor data, so you can monitor, simulate and plan without touching the real one.

Dimensionality Reduction

Techniques that shrink data with many features into fewer, while keeping the most important information, for easier analysis and visualization.

Disaster Recovery

The plans and tools for restoring systems and data after a major failure, such as a region outage, cyberattack or accidental deletion.

Distributed Computing

A way of building systems where tasks and data are spread over multiple networked computers that coordinate to act as one.

Distributed Tracing

Tracing that follows a request as it passes through many separate services, joining each service's spans under one trace ID.

DLP

Tools that find sensitive data, such as card numbers or ID numbers, and block or flag attempts to share or leak it by email, upload or copy.

DNS

The internet phone book: it translates human-friendly names like example.com into the IP addresses computers use to find each other.

Docker

A widely used platform for building, packaging and running applications as containers, so they behave the same on a laptop, a test server or in the cloud.

Dockerfile

A plain text file with step-by-step instructions for building a container image, such as the base image, files to copy and the command to run.

DPDP Act (India)

India's law on processing digital personal data. It requires clear consent and a stated purpose, gives people rights over their data and sets penalties for breaches, with its rules being phased in.

Durability

How well a storage service protects data from being lost or corrupted over time, often stated as many nines, for example 99.999999999% (eleven nines).

Edge Computing

Running computing near users or devices, for example in a factory, shop or cell tower, instead of sending everything to a distant data center.

Edge Location

A site close to end users where a provider caches content and runs some services, so responses travel a shorter distance.

EDR / XDR

EDR watches individual devices and servers for attacks and lets you isolate them. XDR widens this to email, identity, network and cloud signals for a joined-up view.

Egress Fees

Charges for moving data out of a cloud provider to the internet or to another region or cloud. Moving data in is usually free.

Egress Optimization

Design choices that cut outbound data charges, such as keeping traffic in one region, caching with a CDN, compressing data and using private links.

Elasticity

The ability of a cloud system to expand resources quickly when demand grows and shrink them when it falls, automatically or on request.

Embedding

A list of numbers that represents the meaning of text, an image or other data, so similar items sit close together and can be found by comparing the numbers.

Encryption at Rest

Encrypting data where it is stored, on disks, databases and backups, so it is unreadable without the key if media is stolen or accessed wrongly.

Encryption in Transit

Protecting data as it moves across networks, using protocols such as TLS (HTTPS) and VPNs, so no one in between can read or change it.

Ensemble Methods

Techniques that combine the predictions of several models, for example by voting or averaging, so the group is more accurate than any single model.

Envelope Encryption

A method where data is encrypted with a data key, and that data key is itself encrypted with a master key held in a key service.

Ephemeral Storage

Storage attached to a running server that is wiped when the server is stopped, moved or removed, so it is only good for temporary data such as caches and scratch files.

Erasure Coding

A technique that splits data into fragments plus extra recovery pieces spread over many disks, so the original can be rebuilt even if several pieces are lost.

etcd

A reliable key-value database that holds all of the Kubernetes cluster's configuration and state. Managed Kubernetes services run it for you.

Ethical AI

Building and using AI in line with ethical principles such as fairness, privacy, transparency, safety and respect for human rights.

ETL

A process that extracts data from sources, transforms it into a consistent format, and loads it into a destination such as a data warehouse.

Event Sourcing

Instead of saving only the current state, every change is recorded as an event in order. The current state is rebuilt by replaying those events.

Event-driven Architecture

A design where components communicate by producing and reacting to events, such as an order being placed, instead of calling each other directly.

Expert System

An older type of AI that captures a human expert's knowledge as many if-then rules and uses them to give advice, such as medical or technical diagnosis.

Explainable AI

Methods that help people understand why an AI system produced a given result, for example by showing which inputs mattered most.

FaaS

A serverless model where you deploy small functions that run only in response to events, and pay just for the time they execute.

Failback

Moving workloads and data back to the original primary system once it is repaired and in sync, after a period of running on the backup.

Failover

The automatic or manual switch of traffic and workload from a failed component to a healthy standby, such as a replica database or another zone.

Fault Tolerance

The ability of a system to continue operating correctly even when parts of it fail, usually through redundancy and automatic failover.

Feature Store

A central place to define, store and serve the prepared data values (features) that models use, so training and live prediction use exactly the same data.

Federated Identity

Linking separate systems so a user's identity from one trusted provider, such as company directory or Google, is accepted by another without creating new accounts.

Federated Learning

A way of training a shared model across many devices or organizations, where the data stays where it is and only model updates are sent back and combined.

FedRAMP

A US government program that assesses and authorizes cloud services for use by federal agencies, using a common security standard.

File Storage

Storage organized as files and folders that many servers can open at the same time over a network, using standard protocols such as NFS and SMB.

Fine-tuning

Training an existing AI model a little further on your own examples so it follows your style, terms or task better than a general model.

FinOps

A practice that brings engineering, finance and business teams together to understand cloud spend, assign it to owners and keep optimizing it.

Fog Computing

An approach that spreads processing across devices, local gateways and the cloud, so data is handled at the most suitable layer between the edge and the data center.

Foundation Model

A large AI model trained on broad data that can be adapted to many tasks, such as writing, coding or image generation, without being built from scratch each time.

Free Tier

Limited free usage offered by cloud providers, either always free within limits or free for a first period, so people can learn and test.

GDPR

The European Union's data privacy law. It applies to any organization handling personal data of people in the EU and gives them rights over that data, with heavy fines for breaches.

Generative Adversarial Network

A pair of neural networks that compete: a generator makes fake examples and a discriminator tries to spot them, each improving the other until the fakes look real.

Generative AI

AI that creates new content, such as text, images, code, audio or video, based on patterns learned from large amounts of existing data.

Generative Pre-trained Transformer

A family of large language models, first popularized by OpenAI, that are pre-trained on huge text collections to predict the next token and then adapted for chat, writing and coding.

Golden Signals

A short checklist from Google's SRE practice of four key measures for any service: latency, traffic, errors and saturation.

GPU

A processor with thousands of small cores that can do many calculations at once. Originally for graphics, it is now the main hardware for training and running AI models.

GPU Instance

A virtual server fitted with one or more GPUs, used for AI training, video processing, graphics and scientific computing.

Graceful Degradation

Designing a system so that if some features or dependencies fail, it keeps offering reduced but useful service, instead of failing completely.

Grafana

A widely used open-source tool for building dashboards and alerts from many data sources, such as Prometheus, logs and cloud metrics.

GraphQL

An API query language where the client describes the exact fields it wants in a single request, and the server returns just that shape of data.

Green Cloud

Cloud computing run with renewable energy, efficient data centers and low-carbon regions, to reduce environmental impact.

Grid Computing

Linking many separate computers, often in different places, so they work together on a large problem such as scientific research.

Grounding

Anchoring an AI model's responses in trusted information, such as company documents, databases or search results, so answers are based on facts rather than guesses.

gRPC

A framework for service-to-service communication that uses compact binary messages (Protocol Buffers) over HTTP/2, with strongly typed contracts and support for streaming.

Guardrails (AI)

Controls placed around an AI model to block harmful, private or off-topic content and to keep inputs and outputs within company rules.

Guardrails (Security)

Automatic controls that prevent or flag risky actions, such as making storage public or using unapproved regions, while still letting teams work freely within safe limits.

Hallucination

When an AI model produces an answer that sounds convincing but is wrong or invented, such as a fake fact, source or number.

Heartbeat

A small signal that a system or service sends at regular intervals to show it is running. If the signals stop, an alert is raised.

Helm

A tool that bundles all the Kubernetes files of an application into a reusable package called a chart, which can be installed and upgraded with one command.

High Availability

Designing a system so it stays accessible with minimal downtime, typically by running redundant components across multiple zones.

High-Performance Computing

Using clusters of powerful computers connected by very fast networks to solve large calculations, such as weather forecasts, engineering simulations and genomics.

HIPAA

A US law that protects the privacy and security of health information; organizations handling such data, including cloud customers, must follow its safeguards.

Horizontal Pod Autoscaler

A Kubernetes feature that automatically increases or decreases the number of pod copies based on measured load, such as CPU use or request rate.

Horizontal Scaling (Scale Out)

Handling more load by adding more servers or instances that share the work, usually behind a load balancer.

Hot Storage

Storage for data that is read or changed often and needs quick access, such as live databases and active website content. It costs more per gigabyte.

HSM

A tamper-resistant physical device that generates and keeps cryptographic keys so they never leave it in readable form. Clouds offer HSMs as dedicated or managed services.

Human-centered AI

An approach to building AI that puts human needs, values and wellbeing first, with people kept in the loop and the technology designed to augment rather than replace them.

Human-Computer Interaction

The study and design of how people use and experience computers and digital products, aiming to make them useful, usable and pleasant.

Human-in-the-loop

A design where a person checks, corrects or approves an AI system's work at key points, instead of letting it run fully alone.

Hybrid Cloud

An approach that connects on-premises or private infrastructure with a public cloud so workloads and data can move between them.

Hyperparameter

A setting that controls how a model learns, such as the learning rate or the number of layers, chosen by people or by search tools before and during training rather than learned from data.

Hyperscaler

A cloud provider operating enormous data centers worldwide, able to scale almost without limit, usually meaning AWS, Microsoft Azure and Google Cloud.

Hyperthreading

A processor feature that lets one physical core run two threads at once, which cloud providers often count as two vCPUs.

Hypervisor

The software layer that creates, runs and separates virtual machines on a physical server, sharing out its CPU, memory and storage.

Hypervisor Offload

A design where special hardware cards take over virtualization, networking and storage work from the main CPU, as in AWS Nitro, so more of the server serves your workload and isolation is stronger.

IaaS

A cloud model where the provider supplies virtual servers, storage and networking, and you manage the operating system, runtime and applications yourself.

IaC

Defining and managing infrastructure such as servers, networks and databases through version-controlled code or templates instead of manual clicks.

IAM

The system that controls who (identities) can do what (permissions) on which resources, using users, groups, roles and policies.

IAM Policy

A document, usually JSON, that lists which actions are allowed or denied on which resources and under which conditions, attached to identities or resources.

IAM Role

A set of permissions that a user, service or another account can temporarily take on, without having permanent credentials of its own.

Idempotency

A property of an operation where doing it once or many times gives the same final result, so retries after a timeout cannot create duplicates such as a double payment.

Idle Resources

Cloud resources that are running and billed but doing little or no useful work, such as unattached disks, unused IPs or servers left on after a test.

Image Scanning

Automatically scanning container images for known vulnerabilities, outdated packages and exposed secrets before and after they are deployed.

Immutable Storage (WORM)

Storage where data cannot be changed or deleted for a set period once it is written, even by administrators.

Inference

The step where a trained AI model is given new input and produces an output, such as a prediction or generated text. It happens every time someone uses the model.

Ingress

A Kubernetes setup that routes outside web requests to the right services inside the cluster, based on hostnames and paths, often handling HTTPS too.

Init Container

A container that runs to completion before the main containers in a pod start, used for tasks such as waiting for a database or preparing files.

Instance

A virtual server in the cloud created from a template and a size, which you can start, stop and delete as needed.

Instance Type / Family

A named combination of CPU, memory, storage and network capacity, grouped into families such as general purpose, compute optimized, memory optimized or GPU.

Interpretability

How easily people can understand the inner workings of a model and why it behaves as it does, ranging from simple models that are readable to research on opening up large neural networks.

IOPS

A measure of how many read and write operations a storage device can handle each second. High IOPS matters for busy databases.

IoT

Everyday physical devices, such as sensors, meters, vehicles and appliances, connected to the internet so they can send data and receive commands.

IoT Hub / IoT Core

A managed cloud service that securely connects large numbers of IoT devices, handles their identities and messages, and passes the data on to other services.

ISO 27001

An international standard for building and running an information security management system, where independent auditors certify that an organization follows it.

Istio

A widely used open-source service mesh for Kubernetes that adds mutual TLS, traffic routing, retries and telemetry between services.

Jump Server

An intermediate server you first log in to, and then connect from it to other servers in a protected network.

Just-in-time Access

Granting elevated access only for a short, approved period, for a specific task, and removing it automatically afterwards.

k-Nearest Neighbors

A simple method that predicts something about a new item by looking at the k most similar known items and going with what most of them are.

Key Management Service

A managed service that creates, stores and controls the cryptographic keys used to encrypt your data, and records every use of them.

Knowledge Distillation

A technique where a small model is trained to copy the behavior of a larger, more capable one, giving much of the quality at lower cost and speed.

Knowledge Graph

A way of storing information as things (nodes) and the relationships between them, such as a person works at a company, so computers can answer connected questions.

Kubelet

The agent on each Kubernetes node that receives instructions from the control plane and makes sure the pod containers are running and healthy.

Kubernetes

An open-source system that automates deploying, scaling and operating containers across a cluster of machines.

Landing Zone

A pre-configured, secure and compliant multi-account or multi-project setup that gives new workloads a safe foundation with guardrails already in place.

Landing-zone Guardrails

Preventive and detective controls built into a landing zone, such as blocked regions, mandatory logging, required encryption and tagging, that apply automatically to new accounts.

Large Language Model

An AI model trained on very large amounts of text that can understand and generate human-like language, answer questions, summarize, translate and write code.

Latency

The time between sending a request and getting the first response, usually measured in milliseconds. Distance, network hops and storage type all affect it.

Latent Space

The compressed, internal representation where a model places data so that similar items sit close together. Generative models move through it to create new content.

Launch Template

A reusable definition of the image, size, network, disks and other settings used to start new virtual machines consistently.

Least Privilege

A security rule that gives every user, application or service only the minimum permissions needed to do its job, and nothing more.

Lifecycle Policy

Rules that automatically move data to cheaper classes or delete it after a set time, for example archive after 90 days and delete after 7 years.

Lift and Shift (Rehosting)

Moving an application to the cloud with few or no changes, typically copying servers into virtual machines.

LLMOps

Practices for building and running applications based on large language models, including prompt versions, testing, evaluation, cost tracking and safety monitoring.

Load Balancer

A service that spreads incoming requests across multiple servers or containers, checking their health and avoiding unhealthy ones.

Log Aggregation

Gathering logs from many servers, containers and services into one central, searchable system, instead of logging into each machine.

Log Retention

The period for which logs are stored before they are deleted or archived, set by balancing troubleshooting needs, legal rules and storage cost.

Logs

Time-stamped text records of events produced by applications and infrastructure, such as errors, requests and sign-ins.

Loss Function

A formula that measures the gap between a model's predictions and the correct answers. Training tries to make this number as small as possible.

Low-code / No-code

Platforms where you build applications and automations mostly by dragging blocks and filling forms, with little (low-code) or no (no-code) hand-written code.

Machine Learning

A branch of AI where software learns patterns from data to make predictions or decisions, rather than being programmed with explicit rules for every case.

Managed Identity

An identity that the cloud creates and rotates automatically for a service, so the app can access other resources without storing any password or key in code.

Managed Instance Group

A group of identical virtual machines created from one template and managed as a single unit, with auto scaling, auto healing and rolling updates.

Managed Kubernetes

A cloud service where the provider operates and updates the Kubernetes control plane for you, while you manage your workloads and, in some modes, the worker nodes.

Managed Service

A cloud service where the provider handles setup, patching, backups, scaling and availability, and you handle only your own use and data.

Management Group

A top-level structure that groups accounts, subscriptions or projects, so policies, access and budgets can be applied once and inherited by everything beneath.

Markov Chain

A model of a sequence of events where the chance of what happens next depends only on the current state, not on how it got there.

MCP

An open standard that lets AI applications connect to tools and data sources, such as files, databases and services, in one consistent way instead of custom integrations for each.

Measured Service

The cloud automatically measures how much you use, such as hours of compute, gigabytes stored and data transferred, and reports or bills it accordingly.

MeitY Empanelment

A process where India's Ministry of Electronics and IT approves cloud providers, after audit, for use by government departments and public bodies.

Memcached

A lightweight, open-source in-memory cache for key-value data. It is simpler than Redis, with no built-in persistence or rich data types.

Message Queue

A service that stores messages in order until a consumer picks them up, so the sender and receiver do not have to be online or working at the same speed.

Metadata Service

A special local web address that a virtual machine can call to learn about itself, such as its ID, region and temporary credentials, without any stored secrets.

Metrics

Numeric measurements collected at regular intervals, such as CPU use, request count or error rate, which can be graphed and alerted on.

MFA

A sign-in method that requires two or more proofs of identity, such as a password plus a code from a phone app or a hardware key.

Microservices

An application design in which a large system is split into small, independent services that each do one job and talk to each other through APIs.

MLOps

Practices and tools for building, deploying, monitoring and updating machine learning models reliably, covering data, training, release and ongoing quality checks.

Model

The result of training: a file of learned numbers and structure that takes input, such as text or an image, and produces predictions or content.

Model Drift

The gradual loss of a model's accuracy because real-world data or behavior changes over time compared with what it was trained on.

Model Registry

A central catalogue that stores trained models with their versions, metrics and approval status, so teams know which model is in production.

Modular Monolith

A single deployable application whose code is split into well-separated modules with strict boundaries, so parts can be changed independently and later split out if needed.

Monolith

An application built and deployed as one unit, where all features share the same code base and usually the same database.

Multi-access Edge Computing

Running cloud compute at telecom 5G sites, close to users and devices, so applications get very low delay and need less data sent over long distances.

Multi-cloud

Using services from two or more cloud providers, for example AWS and Azure, to avoid dependence on one, meet requirements or pick the best tool for each job.

Multi-region Architecture

Deploying an application and its data in two or more regions, so it can serve users nearby and keep running if an entire region has a problem.

Multi-tenancy

A design where many customers (tenants) share the same hardware and software while their data and settings stay separated and private.

Multimodal AI

AI models that can take in and produce more than one type of data, such as text, images, audio and video, in the same conversation.

Multipart Upload

A way to upload a big file as several parts, in parallel and with retries, and then join them into one object.

Namespace

A way to divide one Kubernetes cluster into separate sections for teams, projects or environments, each with its own names, limits and permissions.

Narrow AI

AI designed and trained for a specific task or small set of tasks, such as spam filtering, translation or image recognition. All AI in use today is narrow in this sense.

NAS

A storage system on the network that serves files to many computers over file sharing protocols, as a shared drive.

Neural Network

A computing model made of layers of connected units, loosely inspired by the brain, that learns patterns by adjusting the strength of the connections from many examples.

NFS

A file-sharing protocol, mainly used by Linux and Unix systems, that lets servers mount a remote folder as if it were local.

NIST CSF

A voluntary US framework that organizes cybersecurity work into functions, namely Govern, Identify, Protect, Detect, Respond and Recover, and is used worldwide.

NLP

AI that works with human language, for example detecting sentiment, extracting names, translating, summarizing and classifying text.

Node (Kubernetes)

A server, physical or virtual, that provides the CPU and memory on which a Kubernetes cluster runs pods.

Node Pool

A set of cluster nodes that share the same machine type and settings, allowing different kinds of servers, such as GPU or spot, within one cluster.

NoSQL

Databases that store data in flexible formats such as documents, key-value pairs, wide columns or graphs, rather than in fixed tables, and scale out easily.

Notebook

A document that mixes live code, charts and notes, commonly used by data scientists to explore data and build models step by step. Jupyter is the best-known example.

NPU

A processor built to run AI tasks efficiently with little power, found in phones, laptops and edge devices to run models locally.

OAuth 2.0

A standard that lets an app get limited access to your data in another service, for example to read your calendar, without ever seeing your password.

Object Lock

A bucket feature that blocks selected objects from being deleted or overwritten for a defined time or until a legal hold is removed.

Object Storage

Storage that keeps data as objects, each with its data, metadata and a unique ID, in flat containers. It scales almost without limit and suits files, media, backups and data lakes.

Observability

The ability to understand what is happening inside a system by collecting and analyzing its logs, metrics and traces.

OCI

An industry group, under the Linux Foundation, that defines open standards for container images and runtimes so containers work across different tools and vendors.

OCR

Technology that reads printed or handwritten text from images and scanned documents and turns it into editable, searchable data.

On-demand Self-service

The ability to create and manage computing resources, such as servers and storage, whenever you need them through a website or API, without raising a ticket or waiting for a person.

On-premises

Computing equipment that you own and run in your own office or data center, rather than renting it from a cloud provider.

Open Source

Software whose source code is published under a license that lets others use, study, modify and share it. In AI the term is debated, since models may share code but not data.

Open-weight Model

A model whose trained parameters are published so anyone can download, run and often fine-tune it on their own hardware, within the license terms. It differs from fully open source, which would also share data and code.

OpenID Connect

A layer on top of OAuth 2.0 that adds a standard way to prove who the user is, returning an ID token with basic profile details.

OpenTelemetry

An open standard and set of tools for collecting metrics, logs and traces from applications in a vendor-neutral way, then sending them to the monitoring tool of your choice.

Operator (Kubernetes)

A piece of software in the cluster that encodes an expert's know-how to install, upgrade, back up and repair a specific application automatically.

Optimization Algorithm

The procedure, such as gradient descent or Adam, that adjusts a model's parameters bit by bit to reduce its loss during training.

Orphaned Resources

Resources that remain after the thing they belonged to was deleted, such as detached disks, old snapshots, unused load balancers and public IPs.

Overfitting

When a model learns its training data too closely, including noise, so it does well on that data but poorly on new, unseen data.

PaaS

A cloud model where the provider manages servers, operating systems and runtime, and you deploy only your application code and data.

Parameters (Weights)

The internal values a model adjusts during training to capture what it has learned. Large language models have billions or even trillions of them.

Pay-as-you-go

A pricing model where you are billed only for the resources you actually use, typically by the hour, second or request, without upfront commitment.

PCI DSS

A security standard for any organization that stores, processes or sends payment card data, covering networks, encryption, access control and monitoring.

Penetration Testing

A planned security test where experts, with permission, try to break into your systems the way an attacker would, then report what they found.

Penetration-test Authorization

The permissions and rules under which you may security-test your own cloud resources. The major providers allow it for most services within published policies, but forbid attacking their own platform or other customers.

Percentiles (p95/p99)

A way to describe response times: p95 means 95% of requests were faster than this value and 5% were slower. p99 looks at the slowest 1%.

Persistent Storage

Storage that keeps your data safe even if the server using it is stopped, replaced or deleted, such as network disks, databases and object storage.

Persistent Volume

A piece of storage in a Kubernetes cluster, such as a cloud disk or file share, that keeps data even if the pod using it is deleted or moved.

Phishing

Emails, texts or sites that pretend to be trusted organizations to trick people into giving passwords, codes or money.

PII

Any data that can identify a person, such as name, phone number, email, address, Aadhaar or PAN number, or a device identifier linked to them.

Pod

A group of one or more containers that run together on the same node and share network and storage. Kubernetes starts, stops and replaces pods.

Point-in-time Recovery

The ability to restore a database or storage to its exact state at a chosen second within a retention window, such as just before a wrong delete.

Policy as Code

Writing security and compliance rules in a machine-readable form that is version controlled and automatically checked against infrastructure and deployments.

Pre-signed URL / SAS Token

A time-limited web address, signed with credentials, that lets someone upload or download a specific private file without having an account.

Pre-training

The initial, very expensive phase in which a model learns general patterns from huge amounts of data, before being adapted for particular uses by fine-tuning.

Predictive Analytics

Using historical data, statistics and machine learning to estimate future outcomes, such as sales, churn or equipment failure.

Pricing Calculator

A free online tool from each provider where you choose services and sizes to estimate monthly costs before deploying anything.

Private Cloud

Cloud-style infrastructure dedicated to a single organization, hosted in its own data center or by a provider, with more control but also more responsibility.

Privileged Access Management

Controls and tools for managing powerful accounts, such as administrators and root, with approvals, recorded sessions, vaulted passwords and short-term access.

Project (Google Cloud)

In Google Cloud, the basic container for resources, APIs, permissions and billing. Every resource belongs to exactly one project.

Prometheus

A popular open-source tool that collects and stores time-series metrics and supports a flexible query language and alerting. It is the usual choice for Kubernetes monitoring.

Prompt

The text, question, instructions or examples you give to an AI model to get a response, sometimes including documents or earlier conversation as context.

Prompt Engineering

The practice of designing and refining prompts, with clear roles, examples, steps and formats, to get reliable and useful output from an AI model.

Prompt Injection

An attack where malicious text, typed by a user or hidden in a web page or document, makes an AI follow the attacker's instructions instead of the intended ones.

Provisioned Concurrency

A setting that keeps a set number of serverless function instances initialized and ready, so requests are answered without cold-start delay, for an extra fee.

Pub/Sub

A messaging style where senders (publishers) post messages to a topic and any number of interested receivers (subscribers) get a copy, without the sender knowing who they are.

Public Cloud

Cloud services owned and run by a provider, such as AWS, Azure or Google Cloud, and offered over the internet to many customers.

Quantum Computing

A new kind of computing that uses qubits and quantum effects to solve certain problems, such as chemistry simulations and optimization, that are very hard for normal computers.

RAG

A technique where the system first looks up relevant information from your own documents or data and gives it to the AI model along with the question, so the answer is based on that material.

RAID

A way to combine several disks into one unit to improve speed, protect against disk failure, or both, using levels such as RAID 0, 1, 5 and 10.

Ransomware

Malicious software that encrypts a victim's files or systems and demands payment for the key, often also stealing data first.

Rapid Elasticity

The ability to add or remove capacity quickly, often automatically, so resources match demand and appear unlimited to the user.

RBAC

Giving permissions to roles, such as Reader or Administrator, and then assigning people or services to those roles, instead of setting rights one by one.

RBI Data Localization

A Reserve Bank of India rule that requires payment system data to be stored only in India. Processing abroad is allowed only if the data comes back and is deleted abroad within a set time.

Real-user Monitoring

Measuring the actual experience of real visitors, such as page load time, errors and device type, by collecting data from their browsers or apps.

Reasoning Model

A language model trained to spend extra effort working through a problem in steps, checking itself, before it gives a final answer, which helps on maths, coding and multi-step tasks.

Recommendation Engine

A system that predicts which products, videos or articles a person is likely to want, using their behavior and that of similar users.

Redis

A very fast open-source data store that keeps data in memory. It is used for caching, sessions, leaderboards, queues and real-time counters.

Refactoring