DevOps, From Zero

Reference · 133 terms

Glossary

Every short form used across the series. Inside a lesson, hover or tap any dotted term to see the same entry in place.

AWS

ACMAWS Certificate Manager
Issues and renews free TLS certificates for use with AWS load balancers and CloudFront.Lesson 4 →
ALBApplication Load Balancer
Sits in front of many servers and divides incoming web traffic between them. Also checks which servers are healthy.Lesson 12 →
alias recordRoute 53 alias record
A Route 53 record that points a name, including the bare domain, at an AWS resource such as an ALB or CloudFront. Free to query.Lesson 13 →
AMIAmazon Machine Image
The template a server is launched from: an operating system plus any preinstalled software.Lesson 7 →
ARNAmazon Resource Name
The unique ID of any AWS resource, e.g. arn:aws:iam::123456789012:user/admin. If it says :root, you are on the root user.Lesson 0 →
Auto ScalingEC2 Auto Scaling
Automatically adds servers when traffic is high and removes them when traffic is low, so you pay only for what you use.Lesson 12 →
Auto Scaling groupAuto Scaling group
Keeps a chosen number of identical servers running across zones, replaces failed ones and adds or removes servers with load.Lesson 12 →
Availability ZoneAvailability Zone
One of several physically separate data centres inside an AWS region (ap-south-1a, 1b, 1c). Spread servers across at least two to survive a failure.Lesson 6 →
AWSAmazon Web Services
Amazon's cloud platform. It rents you raw building blocks — computers, networks, storage, databases — that you assemble yourself.Lesson 0 →
CloudFrontAmazon CloudFront
AWS's CDN. Keeps copies of your static files in servers around the world so pages load fast near every user.Lesson 11 →
CloudTrailAWS CloudTrail
The audit log of your account: every API call, who made it, when and from where. You cannot investigate an incident without it.Lesson 18 →
CloudWatchAmazon CloudWatch
AWS's monitoring service: metrics, logs, alarms and dashboards for everything you run.Lesson 17 →
Cost ExplorerAWS Cost Explorer
The console tool for seeing spend by service, tag or day, and spotting the day a cost jumped.Lesson 19 →
EBSElastic Block Store
The network hard disk of an EC2 server. It survives stopping the instance, is billed per GB-month, and can grow but never shrink.Lesson 7 →
EC2Elastic Compute Cloud
A virtual computer you rent from AWS. You install whatever you want on it — for us, Linux + Node.js + your Next.js app.Lesson 7 →
ECRElastic Container Registry
AWS's private registry for Docker images. Servers and pipelines push and pull images from it using IAM roles.Lesson 9 →
ECSElastic Container Service
AWS's service for running Docker containers without managing the orchestration yourself. Often paired with Fargate.Lesson 19 →
edge locationCDN edge location
One of hundreds of small data centres where a CDN keeps cached copies of your files close to users.Lesson 11 →
EKSElastic Kubernetes Service
Managed Kubernetes on AWS, for teams running many services. Powerful, with real operational cost.Lesson 19 →
Elastic IPElastic IP address
A public IPv4 address that stays yours when a server stops and starts. Billed hourly, attached or not.Lesson 7 →
ElastiCacheAmazon ElastiCache
Managed Redis or Valkey: AWS runs and patches the cache nodes, and you connect from inside the VPC.Lesson 16 →
FargateAWS Fargate
Runs containers for you with no servers to patch or size; you pay per vCPU and memory used.Lesson 19 →
GravitonAWS Graviton (ARM) processors
AWS's own ARM CPUs, used by instance types with a g (t4g, m7g). About 20% cheaper for the same performance; images must be built for ARM.Lesson 19 →
GuardDutyAmazon GuardDuty
Threat detection that watches your account and network logs for suspicious behaviour, such as a key used from a known malicious address.Lesson 18 →
health checkHealth check
A request a load balancer or DNS service makes on a schedule. Servers that fail it stop receiving traffic.Lesson 12 →
Hosted ZoneRoute 53 Hosted Zone
The container in Route 53 that holds every DNS record for one domain.Lesson 3 →
IAMIdentity and Access Management
Who is allowed to do what in your AWS account — users, roles, permissions and policies.Lesson 5 →
IMDSv2Instance Metadata Service, version 2
The token-protected way for a server to fetch its own role credentials. Requiring it blocks a common credential-theft attack.Lesson 7 →
instance profileIAM instance profile
The wrapper that lets an EC2 server wear an IAM role. The console creates it silently; the CLI makes you create it.Lesson 7 →
instance refreshAuto Scaling instance refresh
Rolls every server in a group onto a new version a few at a time, waiting for health checks, so deploys cause no downtime.Lesson 12 →
Internet GatewayInternet Gateway
The VPC's front door to the public internet. It does nothing until a route table points at it. Free.Lesson 6 →
launch templateEC2 launch template
The versioned recipe for one server (image, size, role, Security Group, boot script) that an Auto Scaling group copies.Lesson 12 →
Logs InsightsCloudWatch Logs Insights
A query language for searching and summarising logs stored in CloudWatch, for example errors per tenant in the last hour.Lesson 17 →
MFAMulti-Factor Authentication
A second login step (a code from your phone) on top of the password. Turn it on for the root user on day one.Lesson 0 →
Multi-AZMulti-Availability-Zone deployment
A hidden standby copy of a database in a second zone with automatic failover. Protects against hardware failure, not against deleted data.Lesson 8 →
NAT GatewayNetwork Address Translation gateway
Lets servers in a private subnet call out to the internet without being reachable from it. Convenient, but roughly $40 a month even when idle.Lesson 6 →
Network ACLNetwork Access Control List
A stricter, stateless firewall at the subnet level. Unlike a Security Group you must write rules for both directions.Lesson 6 →
OACOrigin Access Control
The setting that lets one CloudFront distribution, and nobody else, read a private S3 bucket.Lesson 11 →
Parameter StoreSSM Parameter Store
A free place to keep configuration and encrypted secrets that servers read at boot with their IAM role.Lesson 12 →
presigned URLPresigned URL
A time-limited link, signed with your credentials, that lets a browser upload or download one specific S3 object directly.Lesson 11 →
private hosted zonePrivate hosted zone
A Route 53 zone whose names resolve only inside one VPC, for example db.internal.yourapp.com.Lesson 13 →
RDSRelational Database Service
Managed PostgreSQL / MySQL. AWS runs the database server for you and handles backups, patching and failover.Lesson 8 →
read replicaRead replica
A queryable, asynchronous copy of a database used to spread read traffic. Different from Multi-AZ, which cannot be queried.Lesson 8 →
Reserved InstanceReserved Instance
A one- or three-year commitment to a specific instance type, database or cache in exchange for a discount of roughly 30–60%.Lesson 19 →
root userAWS account root user
The identity created when you sign up for AWS. It can do anything, including delete the account — lock it away with MFA and never use it for daily work.Lesson 0 →
Route 53Amazon Route 53
AWS's DNS service. Connects your domain name to your AWS setup. Named after port 53, which DNS uses.Lesson 3 →
route tableRoute table
A list of rules saying where traffic for each destination goes. It is the single thing that makes a subnet public or private.Lesson 6 →
S3Simple Storage Service
File storage. Images, PDFs, uploads, backups — anything that is a file rather than a database row.Lesson 11 →
Savings PlanCompute Savings Plan
A one- or three-year commitment to a dollar amount of compute per hour in exchange for up to about 66% off on-demand prices.Lesson 19 →
Secrets ManagerAWS Secrets Manager
Stores secrets such as database passwords and can rotate them automatically. About $0.40 per secret per month.Lesson 18 →
Security GroupSecurity Group (virtual firewall)
A rule list attached to an EC2 server that decides which ports may receive traffic, and from whom. Blocks everything inbound by default.Lesson 2 →
Session ManagerSSM Session Manager
A shell on a server through your IAM login, with no open port, no key pair and every session logged.Lesson 18 →
snapshotSnapshot
A saved copy of a disk or database at one moment. Manual snapshots stay until you delete them; restoring one creates a new instance.Lesson 8 →
SNSSimple Notification Service
A broadcast channel. CloudWatch alarms publish to a topic, and email, SMS or Slack subscribers receive the message.Lesson 17 →
SSMAWS Systems Manager
A family of tools for managing servers without SSH: Session Manager, Run Command and Parameter Store.Lesson 18 →
subnetSubnet
A slice of a VPC's address range that lives in one Availability Zone. It is public if its route table sends 0.0.0.0/0 to an Internet Gateway, otherwise private.Lesson 6 →
target groupALB target group
The pool of servers a load balancer sends traffic to, together with the health check that decides which of them are allowed to receive it.Lesson 12 →
VPCVirtual Private Cloud
Your own private network inside AWS, so your servers are not exposed to the whole internet by default.Lesson 6 →
WAFWeb Application Firewall
Filters web requests before they reach your app, blocking common attacks such as SQL injection and abusive bots.Lesson 18 →

Networking

0.0.0.0All network interfaces
When a server binds here it accepts connections from any network the machine is on — reachable from outside if the firewall allows.Lesson 2 →
CDNContent Delivery Network
A network of servers around the world that cache your files close to users so they load fast.Lesson 11 →
CIDRClassless Inter-Domain Routing
The /16, /24, /32 notation for a range of IP addresses. Smaller number = bigger range. /32 is exactly one address.Lesson 2 →
CNAMECanonical Name record
A DNS record that says “this name is an alias for that name”, e.g. www.yourapp.com → yourapp.com.Lesson 3 →
CORSCross-Origin Resource Sharing
The browser rule that stops a page on one site calling another site unless that site agrees. Browser uploads straight to S3 need a CORS configuration on the bucket.Lesson 11 →
DKIMDomainKeys Identified Mail
A public key published in DNS so recipients can verify that an email really was signed by your domain.Lesson 13 →
DMARCDomain-based Message Authentication, Reporting and Conformance
A DNS record telling receivers what to do with mail that fails SPF or DKIM, and where to send reports. Start at p=none.Lesson 13 →
DNSDomain Name System
The internet's phone book. Turns a name like yourapp.com into an IP address like 52.66.12.9.Lesson 3 →
firewallFirewall
A rule list that decides which network traffic is allowed in or out. On EC2, that is the Security Group.Lesson 2 →
HTTPHyperText Transfer Protocol
The language browsers and web servers speak. Plain text, port 80.Lesson 2 →
HTTPSHTTP Secure
HTTP wrapped in TLS encryption, on port 443. The padlock in the browser.Lesson 4 →
IPInternet Protocol address
A number that identifies a device on a network, like a house address. Example: 52.66.12.9.Lesson 2 →
load balancerLoad balancer
Divides incoming traffic between many servers so no single one is overwhelmed. On AWS this is the ALB.Lesson 12 →
localhostlocalhost / 127.0.0.1
“This same machine only.” A service bound here cannot be reached from outside the server.Lesson 2 →
MXMail Exchange record
A DNS record that says where email for this domain should be delivered.Lesson 3 →
nameserverNameserver
A server that answers DNS questions for a domain. Route 53 gives you four.Lesson 3 →
NSNameserver record
A DNS record naming the servers that are authoritative for a domain — for us, the four Route 53 nameservers.Lesson 3 →
portNetwork port
A numbered door (0–65535) on an IP address. Each service listens on its own: SSH 22, HTTP 80, HTTPS 443, PostgreSQL 5432.Lesson 2 →
reverse proxyReverse proxy
A server (Nginx for us) that receives public requests on 80/443 and forwards them to your app on a private port like 3000.Lesson 10 →
SPFSender Policy Framework
A DNS TXT record listing which servers may send email for your domain.Lesson 13 →
SSHSecure Shell
Encrypted terminal login to a remote server, on port 22. Your only way into an EC2 box.Lesson 1 →
SSLSecure Sockets Layer
The old name for TLS. People still say “SSL certificate”, but it is TLS underneath.Lesson 4 →
TCPTransmission Control Protocol
Reliable, ordered delivery: every packet is checked and re-sent if lost. Websites, databases and SSH all use it.Lesson 2 →
TLSTransport Layer Security
The encryption layer under HTTPS. The modern name for SSL.Lesson 4 →
TTLTime To Live
How long, in seconds, a DNS answer may be cached before resolvers must ask again. 300 = 5 minutes.Lesson 3 →
TXTText record
A DNS record holding free text, used to prove domain ownership and for email rules like SPF.Lesson 3 →
UDPUser Datagram Protocol
Fast delivery with no guarantee. Used for video calls, DNS lookups and gaming, where speed beats perfection.Lesson 2 →

Linux

chmodchange mode
Set who may read, write or execute a file: chmod 600 .env = only the owner.Lesson 1 →
chownchange owner
Change which user and group own a file, e.g. chown ubuntu:www-data file.Lesson 1 →
PM2PM2 process manager
Keeps your Node app running after you close the terminal, and restarts it if it crashes.Lesson 1 →
processProcess
A running program. Your Next.js app is one; close the terminal that started it and it dies — unless a process manager owns it.Lesson 1 →
sudosuperuser do
Run one command as the admin (root) user, then go back to being a normal user.Lesson 1 →
WSLWindows Subsystem for Linux
Real Ubuntu running inside Windows. Install with wsl --install to practise Linux commands without a server.Lesson 1 →

Tools

CLICommand Line Interface
Controlling a tool by typing commands instead of clicking. The AWS CLI lets you drive AWS from your terminal.Lesson 0 →
containerContainer
A running instance of a Docker image: your app in an isolated box that shares the host's kernel. Starts in under a second.Lesson 9 →
digdomain information groper
The command-line tool for asking DNS questions: dig yourapp.com +short.Lesson 3 →
DockerDocker
Packages your app and everything it needs into one image that runs identically on your laptop and on a server.Lesson 9 →
Docker ComposeDocker Compose
Describes several containers (app, database, cache) in one file and starts them together with one command.Lesson 9 →
DockerfileDockerfile
The text file of instructions Docker follows to build an image.Lesson 9 →
GitHub ActionsGitHub Actions
GitHub's built-in CI/CD: runs your tests, builds and deploys on every push.Lesson 14 →
HCLHashiCorp Configuration Language
The language Terraform files are written in: structured settings, not a programming language.Lesson 15 →
Let's EncryptLet's Encrypt
A free, automated certificate authority. Gives you a trusted HTTPS certificate in one command.Lesson 4 →
NginxNginx web server
The receptionist in front of your app: handles HTTPS, static files and compression, and forwards requests to port 3000.Lesson 10 →
OIDCOpenID Connect
Lets GitHub prove a workflow's identity to AWS so the job receives temporary credentials with no stored access keys.Lesson 14 →
OpenTofuOpenTofu
A community fork of Terraform with the same language and workflow, run with the tofu command.Lesson 15 →
PostgreSQLPostgreSQL
The open-source relational database this series uses. On AWS it runs as RDS.Lesson 8 →
RedisRedis
Very fast in-memory key-value store, used for sessions, caching and rate limiting.Lesson 16 →
TerraformTerraform
Describe your cloud in files, review changes in pull requests, and rebuild the whole setup in minutes.Lesson 15 →
ValkeyValkey
A drop-in open-source replacement for Redis, supported by ElastiCache at a lower price. Same commands, same client libraries.Lesson 16 →
VercelVercel
The PaaS this series starts from. git push and it hosts your Next.js app — until cost, long jobs or control become a problem.Lesson 0 →

Concepts

allow-listingAllow-listing
Block everything, then permit only what you explicitly list. The default behaviour of a Security Group.Lesson 2 →
authoritativeAuthoritative nameserver
The one source of truth for a domain's DNS records. Everything else is a cached copy.Lesson 3 →
blast radiusBlast radius
How much can be damaged when one credential, server or change goes wrong. Good design keeps it small.Lesson 18 →
cache-asideCache-aside pattern
Check the cache first; on a miss read the database, store the result with a TTL and return it.Lesson 16 →
CI/CDContinuous Integration / Continuous Deployment
Every push is automatically tested, built and deployed — no one SSH-ing into a server.Lesson 14 →
defence in depthDefence in depth
Layering independent protections so that when one fails, the next still holds.Lesson 18 →
driftConfiguration drift
When the real infrastructure no longer matches the code, usually because someone changed it in the console.Lesson 15 →
evictionCache eviction
What a full cache does with new data: delete old keys, or refuse writes, depending on the eviction policy.Lesson 16 →
golden signalsThe four golden signals
Latency, traffic, errors and saturation: the four measurements that reveal almost every user-visible problem.Lesson 17 →
IaaSInfrastructure as a Service
You get raw building blocks and wire them together yourself. AWS.Lesson 0 →
IaCInfrastructure as Code
Describing servers, networks and databases in files that are reviewed, versioned and applied by a tool such as Terraform.Lesson 15 →
least privilegePrinciple of least privilege
Give an identity the minimum access needed to do its job and nothing more, so a mistake or a leak stays small.Lesson 5 →
multi-tenantMulti-tenant SaaS
One application serving many customer companies, with each company's data kept separate — often one subdomain per customer.Lesson 3 →
p95Percentile latency
p95 means 95% of requests were faster than this value. Percentiles reveal the slow tail that averages hide.Lesson 17 →
PaaSPlatform as a Service
You push code; the platform decides everything else. Vercel, Railway, Render.Lesson 0 →
RPORecovery Point Objective
How much data you can afford to lose, measured in time. It drives how often you back up.Lesson 8 →
RTORecovery Time Objective
How long you can afford to be down. Measure it by actually running a restore drill.Lesson 8 →
SaaSSoftware as a Service
Software you use through a browser and pay for monthly, instead of installing it. Your product.
serverlessServerless functions
Small pieces of code that run on demand and are billed per request. Convenient, but with time limits and per-request cost.Lesson 0 →
SLOService Level Objective
A reliability target for a measurement (SLI), such as 99.9% of requests succeed. The gap to 100% is the error budget.Lesson 17 →
state fileTerraform state file
Terraform's record of which real resources it created. Keep it remote, versioned and locked; it can contain secrets.Lesson 15 →
statefulStateful (firewall)
Remembers connections: if a request was allowed in, its reply is automatically allowed out. Security Groups are stateful.Lesson 2 →
statelessStateless
Remembers nothing between requests. A stateless firewall needs rules for both directions; a stateless app can run on any server.Lesson 2 →
wildcardWildcard DNS record
A record like *.yourapp.com that answers for every subdomain, including ones that do not exist yet.Lesson 3 →