Cloud & AI Glossary

A training memory optimization that discards intermediate layer activations, recalculating them during the backward pass.

A mathematical formula introducing non-linear thresholds to model outputs, allowing networks to learn complex representations.

The identity backbone of enterprise Windows: directory, Kerberos authentication, and Group Policy — and the highest-value target on any corporate network.

A database scaling strategy where write operations can be committed concurrently to multiple active nodes.

The veteran JMS message broker — protocol-polyglot, deeply embedded in Java estates, and the 'Classic vs Artemis' fork every operator must understand.

A variant of the Adam optimizer that decouples weight decay from gradient updates to improve regularization.

An LLM system that plans, calls tools, observes results, and iterates in a loop to complete tasks rather than answering once.

Tracing, logging, and monitoring for LLM systems — seeing what the model was asked, what it did, what it cost, and where it failed.

A TLS handshake extension that negotiates the application protocol (like HTTP/2 vs HTTP/1.1) during the secure handshake itself — saving a round trip and enabling HTTP/2 on the web.

AWS's CDN: hundreds of edge locations caching your content near users, tightly integrated with S3 and the AWS security stack — with cache-hit ratio as the metric that decides everything.

Amazon's managed Kubernetes — AWS runs the control plane, you run (or don't) the nodes. Power and portability at the cost of Kubernetes's full operational weight.

AWS's managed relational database — Postgres, MySQL, and friends with backups, patching, and failover handled, so you run schemas instead of servers.

AWS's petabyte-scale data warehouse — columnar, massively parallel analytics on data too big for a transactional database, and the wrong tool for anything transactional.

Amazon Resource Names — the globally unique addressing scheme for every AWS resource, and the string format that IAM policies are actually written against.

AWS's DNS service with a 100% availability SLA — where routing policies and health checks turn name resolution into a load-balancing and failover layer.

AWS's managed pub/sub messaging — publish once, fan out to many subscribers (queues, functions, HTTP, email). The one-to-many complement to SQS's one-to-one queue.

AWS's fully-managed message queue — a simple, durable buffer that decouples services and absorbs load spikes. Serverless, cheap, and the default first reach for async work in AWS.

An agentless configuration-management and automation tool — pushes changes over SSH using simple YAML playbooks. Popular for its low barrier to entry and broad reach.

One IP address announced from many locations, with the network routing each user to the nearest — the backbone of CDNs, global DNS, and DDoS absorption.

A distributed event-streaming platform — a durable, replayable log of events that many consumers read independently. The backbone of event-driven data pipelines, not a task queue.

A managed entry point that routes, secures, and monitors API traffic.

A simple shared secret string that identifies and authorizes an application (not a user) calling an API — easy to use, easy to leak, and often misused for the wrong job.

Evolving an API without breaking existing clients — the discipline that decides whether you can change your API or are held hostage by it.

Google Cloud's enterprise API management platform — heavyweight gateway plus developer portal, analytics, and monetization, priced and positioned for large API programs.

A Layer-7 proxy routing HTTP/HTTPS request payloads dynamically based on content paths and headers.

A GitOps continuous-delivery tool for Kubernetes: your Git repo declares the desired cluster state, and ArgoCD makes reality match it.

A declarative deployment loop syncing Git repository states to Kubernetes clusters.

AWS's serverless SQL engine that queries data directly in S3 — no clusters to run, billed at $5 per terabyte scanned, which makes file format your real query optimizer.

An independent parallel compute sub-unit inside self-attention layers that tracks relationships between words.

Authorization decided by policies over attributes — user, resource, and context — rather than static roles. Vastly more expressive, meaningfully harder to reason about.

Amazon Aurora that scales its capacity up and down automatically — even to zero — instead of running a fixed instance. Great for spiky or intermittent loads, tricky for steady ones.

The recommended OAuth 2.0 flow for browser and mobile apps — Authorization Code with PKCE adds a dynamic proof that stops an intercepted authorization code from being usable by an attacker.

A developer-focused identity platform (now part of Okta) for adding login, SSO, and user management to your own apps — customer identity (CIAM) via APIs and SDKs, so you don't build auth from scratch.

Automatically adjusting capacity to match demand — the cloud's core elasticity promise, and a discipline of choosing the right metric, limits, and reaction speed.

An unsupervised neural network designed to compress inputs into low-dimensional latent spaces and reconstruct them.

AWS's fully-managed container-to-URL service — push an image or repo, get a scaling HTTPS endpoint, skip the orchestration entirely.

A security auditing service that records AWS API calls, user actions, and resource changes.

An AWS service that continuously records your resource configurations and evaluates them against rules — answering 'what changed, when, and is it compliant?' for audit and drift detection.

A dedicated physical circuit from your data center into AWS — consistent latency and lower per-GB egress in exchange for weeks of provisioning and real commitment.

AWS's foundational virtual servers — the instance-type catalog, pricing models, and the rent-vs-commit math that underpins most AWS bills.

AWS's original PaaS — deploy code and it provisions the EC2, load balancers, and scaling underneath, with the resources left visible for when you outgrow the abstraction.

AWS's serverless container runtime — run containers on ECS or EKS without managing the underlying servers, trading per-node control for zero cluster ops.

AWS's function-as-a-service — code that runs on demand in Firecracker microVMs, scales to zero, and bills per millisecond. The reference implementation of serverless.

AWS's service for managing many accounts as one org — consolidated billing plus guardrails (SCPs) that cap what accounts can do. The foundation of a multi-account strategy.

Private, one-way connectivity to services across VPCs and accounts via interface endpoints — traffic that never touches the public internet or requires network peering.

A secure network service mapping endpoint targets privately inside a local subnet via network interface cards.

Managed storage, rotation, and audited retrieval of credentials — the antidote to passwords in environment variables and API keys in Git.

Microsoft's cloud identity platform (formerly Azure AD, now Entra ID) — the identity provider behind Microsoft 365 and countless enterprise apps. The identity backbone of the Microsoft ecosystem.

Azure's managed Kubernetes — a free control plane and deep Entra ID integration, the natural K8s choice for Microsoft-centric enterprises.

Microsoft Azure's virtual machines — the compute core for Windows, .NET, and hybrid enterprises, with hybrid licensing as a distinctive cost lever.

The algorithm that calculates loss gradients backwards through neural layers to update model weights.

A dedicated physical server with no hypervisor between you and the hardware — maximum performance and control, at the cost of cloud elasticity.

The single hardened jump box that funnels admin access into private networks — a pattern now being replaced by session brokers that need no open ports at all.

Processing LLM requests asynchronously in bulk at ~50% discount — the right mode for any AI workload that doesn't need an answer in seconds.

An access token where mere possession grants access — like cash, whoever holds it can use it. Simple and ubiquitous in APIs, and dangerous if intercepted, so it lives and dies by TLS and short lifetimes.

A 16-bit floating-point format that matches the dynamic range of FP32, preventing underflow issues.

The routing protocol that ties the internet's ~75,000 independent networks together — deciding how traffic finds its way between them. Foundational, trust-based, and famously fragile.

Google's serverless data warehouse — run SQL analytics over terabytes to petabytes with no infrastructure to manage, priced mainly by data scanned. Powerful for analytics, wrong for transactions.

Atlassian's CI/CD built into Bitbucket — YAML pipelines next to your code, tightly integrated with Jira, priced by build minutes.

A high-performance quantization library providing lightweight CUDA wrappers for 8-bit and 4-bit optimizers.

Running two identical production environments and flipping traffic from old to new all at once — instant cutover, instant rollback, double the infrastructure.

A deployment strategy utilizing two identical environments to eliminate release downtime.

A probabilistic term-matching keyword search algorithm widely used in information retrieval.

Deciding when cached data is stale and must be refreshed or removed — famously one of computing's two hardest problems, because serving wrong data and re-fetching too often both hurt.

A release strategy that rolls out updates to a small fraction of users to verify stability.

Rolling out a new version to a small slice of real users first, watching the metrics, then widening — the strategy built to limit the blast radius of a bad deploy.

A wide-column database built for massive write throughput and no single point of failure — masterless, tunably consistent, and unforgiving of bad data modeling.

The trusted third party that issues and vouches for TLS certificates — the root of the trust chain that lets your browser believe a site is really who it claims to be.

A prompting strategy instructing models to generate step-by-step reasoning paths before outputting final answers.

An emergent capability where models yield higher accuracy by breaking problems down into sequential reasoning steps.

A veteran configuration-management tool that treats servers as code — but from an era of long-lived servers now largely displaced by immutable infrastructure and containers.

Automating the path from code commit to production — continuous integration tests every change, continuous delivery ships it safely.

The slash notation that defines IP address ranges — and the one networking decision that becomes permanent the moment two networks need to talk.

A managed CI/CD platform built around reusable config (orbs), first-class caching, and per-credit pricing — where pipeline speed is the product.

A resilience pattern that stops calling a failing service to let it recover — 'tripping' after repeated failures instead of pounding a dead dependency and cascading the outage.

The OAuth 2.0 flow for machine-to-machine authentication — a service authenticates as itself (not on behalf of a user) to get an access token. No human, no browser, no user consent.

Google Cloud's dedicated private connection between on-premises and GCP — the GCP equivalent of AWS Direct Connect and Azure ExpressRoute, in Dedicated and Partner flavors.

Google's globally-distributed relational database that scales horizontally while keeping strong consistency and SQL — famously breaking the 'you must give up consistency to scale' assumption, at a premium.

Google Cloud's managed relational database (MySQL, PostgreSQL, SQL Server) — GCP's equivalent of Amazon RDS. You run schemas; Google runs the servers, backups, and failover.

Serverless that runs at the network edge in V8 isolates, not containers — near-zero cold starts and global-by-default, with a distinct execution model to design around.

AWS's native infrastructure-as-code service — declarative stacks with managed state and automatic rollback, at the cost of YAML verbosity and AWS lock-in.

The audit log of every API call in your AWS account — who did what, when, from where. The difference between an incident report and a shrug.

AWS's managed user directory and authentication service — sign-up, sign-in, MFA, and OIDC token issuance without running your own identity stack.

The latency penalty when a serverless function runs after being idle — the defining performance tax of [serverless](/glossary/serverless/), and the thing every FaaS optimization targets.

The gradual divergence of a system's real state from its intended, defined state as manual changes accumulate — the silent cause of 'works here but not there' failures and failed deploys.

Reusing a fixed set of established database connections instead of opening one per request — the difference between a database that scales and one that falls over at 100 connections.

A hashing scheme where adding or removing a node reshuffles only a small fraction of keys — the distribution primitive behind sharded databases, caches, and CDNs.

HashiCorp's multi-purpose tool for service discovery, health checking, a distributed key-value store, and service mesh — the connective tissue for services across VMs, clouds, and Kubernetes.

A lightweight, isolated package that runs an application and its dependencies.

A distributed network of edge servers that caches content closer to users.

The discipline of deciding what goes into an LLM's context window — instructions, retrieved data, memory, tool results — and what stays out.

The ranking pipeline sorting external retrieval chunks to ensure high-density information fits in LLM context windows.

The maximum amount of text (in tokens) an LLM can consider at once, covering the prompt, conversation history, and its own output.

An iteration-level scheduling algorithm that groups active inference requests dynamically rather than waiting for full sequence completion.

AWS's managed multi-account landing zone: automated account creation with guardrails, centralized logging, and organization-wide policy from day one.

A metric that measures the angular distance between two vectors in a high-dimensional space.

Azure's globally-distributed, multi-model database with turnkey global replication and five tunable consistency levels. Powerful and pricey — and the pricing punishes bad modeling.

Splitting a system's write model from its read model so each is optimized independently — powerful for complex, high-scale domains, overkill for ordinary CRUD.

How to let a principal in one AWS account securely act in another — via assumed IAM roles and temporary credentials, not shared long-lived keys. The backbone of multi-account AWS.

A secondary retrieval pipeline step that scores document-query pairs using deep attention classification.

The browser mechanism that controls cross-origin requests — universally misunderstood as an error to disable, actually a security boundary to configure correctly.

An HTTP header security mechanism that controls browser access to resources hosted on external domains.

An attack that injects malicious JavaScript into a web page other users view — running in their browser with their privileges. Prevented by proper output encoding and CSP.

Defending against attacks that trick a logged-in user's browser into making unwanted requests to a site they're authenticated to — using the browser's own cookies against them.

The universal ID system for publicly known security flaws — a CVE number gives everyone one unambiguous name for the same vulnerability, so the whole industry can coordinate.

The 0–10 standardized severity score for vulnerabilities — a useful common language for 'how bad in theory,' but a dangerous substitute for real risk prioritization in your environment.

Deploying a feature to production but keeping it hidden — running its code silently to test performance and correctness with real traffic before anyone sees it.

Keeping copies of a database on multiple servers for availability, read scaling, and disaster recovery — with consistency as the price of admission.

Splitting one logical database across many machines by partitioning the data — the way past a single server's limits, and a decision that reshapes your entire application.

A commercial, all-in-one observability SaaS covering metrics, traces, logs, and more in one integrated platform. Fast to adopt, famously easy to overspend on.

Defending against traffic floods designed to exhaust your capacity — absorbed at the edge, filtered by layer, and increasingly a cost problem as much as an uptime problem.

The token-by-token generation stage of LLM inference — sequential, memory-bandwidth-bound, and the reason output tokens cost more than input.

The security architecture principle that every control will eventually fail — so you layer independent controls such that no single failure is a breach.

The service that automatically hands out IP addresses and network config to devices when they join a network — so you don't configure every device by hand. Invisible until it breaks.

An AWS component that lets one Direct Connect private link reach VPCs in many regions and accounts — so you don't need a separate physical connection per region. The hub for private AWS connectivity.

An alignment algorithm that optimizes policy networks directly using pairwise preference data without reward model training.

Direct Preference Optimization — preference tuning without a reward model or RL loop: train directly on chosen-vs-rejected response pairs.

Direct Server Return — load-balanced requests arrive via the balancer, but responses bypass it entirely, straight from server to client. Huge asymmetric-traffic win, real operational sharp edges.

Mathematical formulas used to calculate similarity scores between vector coordinates.

A cryptographic signature proving an email really came from your domain and wasn't altered — one leg of the SPF/DKIM/DMARC tripod that decides deliverability.

The policy layer that ties SPF and DKIM to the visible From: address and tells receivers what to do on failure — now mandatory for bulk senders.

The time window required for global DNS servers to update cached records with new IP targets.

A set of DNS extensions that cryptographically sign DNS records so resolvers can verify answers haven't been forged — closing DNS's original lack of authentication. Powerful but underdeployed and complex.

The tool that popularized containers — packaging an app with all its dependencies into a portable image that runs the same everywhere. The unit modern deployment is built on.

AWS's managed MongoDB-compatible database — Aurora-style storage with the Mongo API on top, and a compatibility asterisk you must test against.

The system that translates human-readable domain names into IP addresses.

An approach to modeling complex software around the business domain and its real language — bounded contexts, ubiquitous language. Its value is in the hard domains.

Security testing that attacks the running application from the outside — catching the runtime and config flaws static analysis can't see, at the cost of coverage and speed.

AWS's fully-managed key-value/document database — single-digit-millisecond latency at any scale, priced by throughput, and only fast if you model around its access patterns.

A cache placed at CDN edge locations near users, so content is served from a nearby city instead of a distant origin — the core mechanism that makes CDNs fast.

A markup language that lets a CDN assemble a page from separately-cached fragments — caching the static shell aggressively while fetching only the dynamic bits. Powerful but niche and quirky.

AWS's network-attached block storage for EC2 — persistent virtual disks that live independently of the instance. The durable disk under your databases and boot volumes.

AWS's managed, elastic NFS — a shared filesystem many instances mount at once, growing and shrinking automatically, priced well above block or object storage.

AWS's managed Redis and Memcached — in-memory caching that turns millisecond database queries into microsecond lookups, with cache-invalidation as the eternal catch.

A SAML identity assertion whose contents are encrypted, not just signed — so intermediaries can't read the personal data inside it, only the intended Service Provider can.

Encrypting stored data so a stolen disk or leaked backup is useless — nearly free, mostly a checkbox, and frequently mistaken for access control.

Protecting data as it moves between systems — table stakes on the public internet, and increasingly mandatory inside your own network too.

A high-performance L7 proxy built for cloud-native networking — the data plane inside most service meshes and many API gateways, handling routing, load balancing, retries, and observability.

Systematic testing of LLM outputs against defined criteria — the AI equivalent of a test suite, and the thing that separates demos from products.

Storing state as an immutable log of events rather than current values — a perfect audit trail and time machine, bought with real complexity most systems don't need.

Systems that communicate by emitting and reacting to events rather than calling each other directly — loose coupling and scale, bought with eventual consistency and debugging difficulty.

The retry discipline that prevents failed calls from becoming outages: wait longer after each failure, add randomness, and give up on purpose.

Azure's dedicated private connection between on-premises and Azure — the Azure equivalent of AWS Direct Connect. Bypasses the public internet for consistent bandwidth, low latency, and compliance.

A DNS routing policy that sends all traffic to a primary endpoint and automatically switches to a standby only when the primary fails a health check — active-passive disaster recovery at the DNS layer.

Runtime switches that decouple deploying code from releasing it — enabling canary rollouts, instant kill switches, and A/B tests without redeploying.

Letting users log into many services with one identity from a trusted provider — the basis of SSO and 'Sign in with Google.' Centralizes credentials where they can be secured.

A fully-connected neural network layer processing token vectors independently after attention calculations.

A prompting technique providing multiple input-output examples to guide model generation formatting.

Further training a pretrained model on your own examples to change its behavior, style, or task performance.

The discipline of making cloud spend an engineering metric — visibility, accountability, and optimization as a continuous loop, not a quarterly panic.

An IO-aware attention algorithm that computes exact attention without materializing the full N×N matrix — making long context windows computationally practical.

An optimized self-attention algorithm designed for Hopper GPUs, exploiting asynchronous execution and FP8 precision.

A GitOps operator for Kubernetes — it runs inside the cluster and continuously reconciles it to match config declared in Git. Automation-first, a peer to Argo CD.

A half-precision 16-bit floating-point data format providing wide dynamic range for deep learning.

Compressing model weights to lower-precision numbers (8-bit, 4-bit) so models need less memory and run faster with minimal quality loss.

A data-parallel training strategy that shards model states (parameters, gradients, and optimizer states) across distributed GPU pools.

DNS that answers differently based on where the query comes from — routing users to the nearest or most appropriate region at the resolution layer.

GitHub's built-in CI/CD — workflows in YAML in your repo, triggered by git events, with a huge marketplace of reusable actions. The default for anything already on GitHub.

GitLab's built-in CI/CD system — pipelines defined in a YAML file in your repo, tightly integrated with the whole GitLab platform. A single-vendor alternative to stitching tools together.

An operating model where Git is the single source of truth for infrastructure and deployments, and automation continuously makes the live system match what's in Git. Declarative, auditable, self-healing.

AWS's cheapest storage tier — roughly $1 per terabyte per month — for data you must keep but almost never read, with retrieval measured in hours.

Google's original PaaS — the pioneering 'just deploy your code' platform, now a mature elder alongside its serverless successors.

Google's serverless container platform — deploy any container, scale to zero, pay per use. The middle path between functions and Kubernetes.

Google Cloud's virtual machines — live migration, sustained-use discounts, and per-second billing distinguish it from the EC2 model.

Google's managed Kubernetes — from the company that created Kubernetes — with Autopilot mode offering the most hands-off managed-K8s experience available.

Google Workspace's built-in user directory — the identity backbone that stores accounts and groups and acts as an identity provider for SSO across Google and third-party apps.

The parallel processors that train and serve AI models — and the supply-constrained line item that shapes every AI infrastructure decision.

A training technique that aggregates gradients across multiple micro-batches before performing an optimization step.

A safety training strategy that caps maximum gradient values to prevent numerical instability.

The default open-source dashboarding and visualization layer — it turns metrics, logs, and traces from many sources into graphs and alerts. It stores nothing itself.

A query language for APIs that lets the client ask for exactly the data it needs in one request — solving over- and under-fetching, at the cost of new complexity.

An attention mechanism that groups query heads together to share single key-value projection heads, optimizing memory footprints.

A high-performance RPC framework using HTTP/2 and Protocol Buffers — fast, strongly-typed service-to-service calls. Great between backends, awkward from browsers.

AWS's managed threat detection — machine-analyzed CloudTrail, VPC, and DNS signals surfacing compromised credentials and instances without agents to deploy.

When an LLM confidently generates false information — a statistical property of how these models work, not a bug that will be patched out.

Tamper-resistant hardware that performs cryptography without ever exposing the keys — the root of trust behind KMS, PKI, and payment systems.

Hierarchical Navigable Small World — the graph-based index behind most vector databases; logarithmic-feeling search across millions of embeddings, paid for in RAM.

An approximate nearest neighbor vector search index based on multi-layered graph networks.

The major HTTP upgrade that added multiplexing, header compression, and server push over a single connection — a big performance win over HTTP/1.1, itself now succeeded by HTTP/3.

The latest HTTP version, running over QUIC (a UDP-based transport) instead of TCP — eliminating head-of-line blocking and speeding up connection setup, especially on flaky mobile networks.

A search technique combining keyword-based lexical retrieval (BM25) and vector-based semantic retrieval.

The software layer that runs virtual machines by partitioning physical hardware — the invisible foundation every cloud instance depends on.

An AWS guardrail that caps the maximum permissions an IAM entity can have — it doesn't grant access, it limits it. Key to safely letting teams manage their own IAM without granting escalation.

A JSON definition block declaring permission scopes for specific cloud resources.

An IAM identity that defines temporary credential configurations for cloud resources.

The distinction that underpins secure AWS access: users hold permanent credentials, roles grant temporary ones on assumption — and roles should be your default.

The 'is this host reachable and how fast?' tool — ping uses ICMP echo request/reply to test connectivity and measure round-trip time. Ubiquitous for diagnostics, and often blocked or rate-limited.

A unique client-supplied identifier that lets a server safely de-duplicate retried requests — so a payment or order sent twice (after a timeout) only happens once.

Framework for defining who can access which cloud resources and how.

The system that authenticates users and vouches for their identity to other applications — the trusted center of SSO and federated login. Compromise it and you compromise everything.

An approach where servers are never modified after deployment — to change anything you build a new image and replace them. Eliminates drift and 'works on my machine,' at the cost of a build pipeline.

The OAuth flow that returned tokens directly in the browser URL — deprecated for a decade of good reasons, replaced everywhere by Authorization Code + PKCE.

The capacity of LLMs to recognize patterns and adapt behaviors based on examples provided in the prompt.

A rendering strategy that serves pre-built static pages while regenerating them in the background — static-site speed with content that stays fresh.

Running a trained model to produce outputs in production — where nearly all AI compute cost and latency engineering lives.

A purpose-built time-series database for metrics and sensor data — fast timestamped ingestion and time-window queries, with cardinality as its defining constraint.

Defining cloud infrastructure in version-controlled files instead of console clicks — reviewable, repeatable, and recoverable.

The methodology managing and provisioning cloud networks and compute units using configuration files.

Traffic direction from your network's point of view — a vocabulary distinction that decides real money, because clouds let data in free and charge for every byte leaving.

AWS's automated, continuous vulnerability scanner for EC2, container images, and Lambda — it finds known CVEs and exposures in your workloads without you scheduling scans.

An 8-bit integer data format used to reduce model VRAM footprints and accelerate compute stages.

The VPC component that makes two-way internet connectivity possible — horizontally scaled, free, and meaningful only through routing and public IPs.

A vector search optimization that clusters vector spaces to limit search scopes.

Limiting how many requests a single IP address can make in a time window — a simple, common first line of defense against abuse, brute-force, and scraping. Effective but easily evaded and prone to false positives.

An encrypted tunnel that securely connects two networks over the public internet at the IP layer — the classic technology behind site-to-site VPNs linking offices, data centers, and cloud VPCs.

The internet running out of unique IPv4 addresses years ago — the scarcity that gave us NAT, carrier-grade NAT, IP markets, and the slow push toward IPv6.

The vastly larger 128-bit address system built to replace IPv4, whose ~4 billion addresses ran out years ago. Adoption is real but slow because of workarounds like NAT.

A service mesh that moves inter-service networking — mTLS, retries, traffic splitting, telemetry — out of application code and into a uniform infrastructure layer.

A vector search index combining Inverted File indexing and Product Quantization for memory efficiency.

The veteran, plugin-heavy CI/CD automation server — enormously flexible and self-hosted, but showing its age against lighter, git-native tools like GitHub Actions and GitLab CI.

Deliberate randomness added to timing — retries, cron schedules, cache TTLs — to break the synchronization that turns many well-behaved clients into an accidental DDoS.

A published set of public keys (as JSON) that lets anyone verify JWT signatures and lets services rotate signing keys without breaking every client.

A cryptographically signed, URL-safe data structure used to pass authentication claims between systems.

A signed, self-contained token carrying identity claims — verifiable by any service without a database call, and revocable by none of them.

An alignment algorithm that optimizes models using binary utility signals (good/bad) rather than pairwise preferences.

Kahneman-Tversky Optimization — preference tuning from simple thumbs-up/down signals instead of paired comparisons, weighted asymmetrically like human loss aversion.

Reusing one TCP (and TLS) connection for many requests — the difference between paying handshake latency once and paying it on every call.

AWS's managed key service — envelope encryption backed by HSMs, where the master keys never leave and every use is logged.

A defined schedule and process for regularly replacing cryptographic keys and secrets — limiting the damage window if a key is ever compromised. Only valuable if rotation is automated.

The resource policy that is the root authority over a KMS key — powerful enough to lock out even the account root, which is exactly how people brick keys.

Training a small, cheap model to imitate a large one's outputs — the standard route to frontier-quality behavior on a narrow task at a fraction of the cost.

A popular open-source API gateway — the single entry point that sits in front of your services and handles auth, rate limiting, routing, and observability so each service doesn't have to.

An open-source platform for orchestrating containerized workloads at scale.

An API object managing external application access to services inside a Kubernetes cluster.

An infrastructure layer managing secure, observable service-to-service cluster communication.

The attention key/value tensors an LLM stores per token during generation — the memory bottleneck of inference and the mechanism behind prompt caching discounts.

An optimization strategy that discards low-attention key-value states to stay within VRAM bounds.

Storing the KV cache in 8- or 4-bit precision instead of FP16 — the lever that decides how many long-context conversations fit on one GPU.

A pre-configured, secure, multi-account cloud foundation set up before you deploy workloads — accounts, networking, identity, logging, and guardrails done right from the start so you don't retrofit governance later.

A DNS routing policy that sends each user to whichever region will respond fastest for them — improving performance for globally distributed apps. Routes by network latency, not geography.

A regularization technique that normalizes activations across a single token's feature dimensions.

The directory protocol under Active Directory and enterprise auth — hierarchical, fast for reads, and the backend a surprising amount of infrastructure still binds against.

A training framework that adjusts optimizer step sizes dynamically over training epochs.

Grant the minimum access required, for the minimum time — the principle every breach postmortem cites and every deadline erodes.

The free, automated certificate authority that made HTTPS universal — 90-day certificates issued via the ACME protocol, renewed by software instead of humans.

The negotiation protocol that bonds multiple physical links into one logical pipe — more aggregate bandwidth and instant failover, with per-flow hashing as the catch.

A lightweight, security-focused service mesh for Kubernetes — deliberately simpler than Istio, using its own ultralight Rust micro-proxy to give mTLS, observability, and reliability with minimal overhead.

A neural network trained on massive text corpora to predict the next token — the foundation under chatbots, coding assistants, and AI agents.

Programmatic checks around an LLM's inputs and outputs that enforce safety, format, and policy rules the model alone can't guarantee.

Distributes incoming traffic across multiple servers or containers.

The write-optimized storage engine behind Cassandra, RocksDB, and most NoSQL — buffer writes in memory, flush to sorted files, compact in the background.

A trainable low-rank decomposition matrix injected into transformer attention layers during model tuning.

The hardware address burned into a network interface — used to deliver frames on the local network segment. Layer 2's addressing, distinct from the IP addresses that route globally.

An AWS service that uses machine learning to find and classify sensitive data — PII, credentials, financial info — sitting in your S3 buckets, so you know where your risk lives.

An open standard for connecting AI models to tools and data sources, replacing per-app custom integrations with one reusable interface.

A bare-bones in-memory cache — pure key-value, multithreaded, no persistence, no data structures. Fast and simple, and that simplicity is the whole point.

An asynchronous buffer between services: producers enqueue work, consumers process at their own pace — decoupling that turns traffic spikes into backlogs instead of outages.

An architecture style where an application is split into small, independently deployable services.

A training method combining half-precision (FP16/BF16) and single-precision (FP32) to speed up GPU operations.

A sparse model architecture that uses a routing network to activate specific subset expert parameters per token.

A optimization technique that removes low-contribution weights from neural networks to reduce parameter counts.

The dominant document database — stores flexible JSON-like documents instead of rigid tables. Great when your schema evolves fast; a trap when you actually needed relational.

A database high-availability pattern maintaining synchronous standby database replicas in separate availability zones.

Requiring a second proof of identity beyond the password — with a factor hierarchy that matters enormously, because SMS and phishable codes are no longer enough.

An attention mechanism where all query heads share a single key-value head to minimize KV cache storage overhead.

A single software instance serves multiple customers with isolated data and configuration.

The SaaS architecture where one application instance serves many customers with isolated data — economies of scale on one side, a single fat-fingered query from a breach on the other.

Models that process and generate multiple data types — text, images, audio, video — in a single system rather than text alone.

A security protocol requiring both client and server to verify each other's certificates before establishing connections.

Managed outbound-only internet access for private subnets — and the quietly notorious line item on cloud bills, at $0.045 per gigabyte processed.

The leading graph database — stores relationships as first-class data so traversals that would be brutal multi-join queries in SQL become fast, natural graph walks.

Netlify's serverless functions — backend code deployed alongside your frontend with no server management, wrapping AWS Lambda in a simpler developer experience for Jamstack apps.

The stateless subnet-level firewall in a VPC — numbered rules, explicit deny, and return-traffic gotchas that surprise everyone exactly once.

A high-performance Layer-4 proxy routing TCP/UDP connections at ultra-low latency.

A commercial all-in-one observability platform — metrics, traces, logs, and APM in one product. You pay to skip assembling the open-source stack yourself.

An information-theoretically optimal quantile quantization data type designed to compress parameters.

Databases that trade SQL's relational model and strict consistency for horizontal scale, flexible schemas, or specialized data shapes.

An authorization framework that lets apps access resources on behalf of a user without sharing passwords.

Cloud storage that keeps files as objects in flat buckets accessed over HTTP — cheap, effectively unlimited, and the backbone of cloud data.

A TLS optimization where the web server fetches and 'staples' a fresh proof that its certificate isn't revoked to the handshake — so clients don't have to check with the CA, fixing OCSP's speed and privacy flaws.

Okta is a leading vendor-neutral identity provider — its whole value is connecting to everything, so 'Okta integration' means wiring an app into Okta for SSO, provisioning, and centralized access control.

An authentication layer built on top of OAuth 2.0 — it adds a standard identity token (JWT) so apps can actually know *who* the user is, not just what they can access.

The vendor-neutral standard for traces, metrics, and logs — instrument once, send anywhere, and finally escape observability-vendor lock-in.

The veteran TLS-based VPN — runs anywhere, traverses anything, configurable to a fault — now the incumbent that WireGuard is steadily retiring.

The link-state interior routing protocol: every router learns the full network map and computes shortest paths — instant convergence math in exchange for design discipline.

An awareness document ranking the ten most critical web-application security risks — the industry's common baseline for what to defend against. A starting point for security, not a complete checklist.

vLLM's virtual-memory trick for the KV cache: store attention state in fixed-size pages instead of contiguous blocks, eliminating the fragmentation that wasted most GPU memory.

A memory allocation algorithm that partitions the KV cache into non-contiguous virtual pages to prevent fragmentation.

A collection of fine-tuning techniques that adapt pre-trained models by modifying only a tiny fraction of parameters.

An authorized simulated attack where skilled testers actively try to exploit a system's weaknesses — going beyond automated scanning to prove what an attacker could actually achieve.

A disaster recovery strategy keeping critical data replicated while compute resources remain inactive until failover.

A distributed training and inference model that partitions layer blocks sequentially across different GPU nodes.

An offline compression technique that converts weights to lower precision after model training finishes.

The first stage of LLM inference: the entire prompt is processed in parallel to build the KV cache before any output token appears.

Grant every user, service, and process only the minimum access it needs to do its job — nothing more. The single most important access-control principle, and the hardest to actually maintain.

A lossy vector compression technique that reduces database RAM footprints.

The de-facto open-source metrics system — pull-based scraping, a time-series database, and PromQL. It tells you your systems' vital signs; it is not for logs or traces.

An on-policy reinforcement learning algorithm that restricts step updates to maintain training stability.

The declarative configuration-management veteran: agents continuously converge servers toward a cataloged desired state — still ruling large regulated fleets.

A fine-tuning method that backpropagates gradients through frozen, 4-bit quantized base models into LoRA adapters.

A training process that models quantization error during the forward pass to minimize precision loss.

A mature message broker for routing tasks and events between services — flexible routing and per-message reliability. A queue for work, not a log for streaming like Kafka.

Architecture that fetches relevant external data at query time and injects it into an LLM's context before generating an answer.

The second-stage filter in retrieval pipelines: a cross-encoder rescores the top candidates so only genuinely relevant chunks reach the LLM's context.

Capping how many requests a client can make in a window — the fundamental control that protects APIs from abuse, overload, and runaway costs.

Two models for deciding who can do what: RBAC grants access by assigned roles (simple, coarse), ABAC by evaluating attributes (flexible, fine-grained). Most real systems blend both.

Read-only copies of a database that receive the primary's changes and serve read traffic — the first and simplest database scaling move, bounded by replication lag.

An asynchronous replication pattern offloading read-heavy query loads to read-only database copies.

An LLM trained to generate internal chain-of-thought before answering, trading latency and tokens for large gains on math, code, and planning.

The in-memory data-structures server that became infrastructure — cache, queue, rate limiter, session store, and leaderboard in one, with durability caveats to respect.

A long-lived credential used only to obtain new short-lived access tokens — so users stay logged in without keeping a powerful long-lived access token exposed. The high-value target you must protect.

The post-training technique that turns a raw next-token predictor into a helpful assistant by optimizing against human preference judgments.

A specialized model that re-evaluates the relevance of document chunks retrieved by search stages.

The OAuth flow where the app collects the user's password directly — formally deprecated, kept alive only by legacy systems, and the anti-pattern worth knowing by name.

Automatically re-attempting a failed operation to ride out transient errors — essential for resilient distributed systems, and dangerous without backoff, jitter, and idempotency.

A server that sits in front of backend apps and forwards client requests to them.

A distributed training communication algorithm where GPUs share gradients in a logical ring topology, optimizing network bandwidth utilization.

A scoring model trained on human feedback to evaluate language model generation quality.

Permissions granted through roles rather than to individuals — the access model that scales to thousands of users, until role explosion sends you toward ABAC.

Updating a service by replacing its instances a few at a time while the rest keep serving traffic — the default zero-downtime deployment, and Kubernetes's built-in strategy.

Rotary Position Embeddings — the technique that tells transformers where tokens are by rotating query/key vectors, and the knob behind every context-window extension.

A positional encoding method that applies a rotation matrix to Query and Key vectors in self-attention layers.

A DNS routing policy redirecting query lookups to regions providing the lowest round-trip latency.

The per-subnet decision list that determines where packets go — the actual mechanism behind 'public' and 'private' in cloud networks.

A compliance storage parameter enforcing write-once-read-many retention windows on object storage buckets.

How a multi-tenant SaaS keeps each customer's data and activity walled off from every other customer's — the security foundation that determines trust, blast radius, and cost.

The XML-based federation standard behind most enterprise SSO — verbose, battle-tested, and full of signature-validation traps that became real CVEs.

An AWS Organizations guardrail that caps the maximum permissions for entire accounts — an org-wide ceiling that even account admins can't exceed. It limits, it never grants.

AWS's stateful instance-level firewall — allow-rules only, return traffic automatic, and the most common place cloud exposure actually happens.

AWS's central dashboard that aggregates security findings from many AWS services and partner tools into one prioritized view, checked against best-practice standards.

A TLS certificate an entity issues to itself, with no trusted CA vouching for it — it encrypts traffic but proves no identity, which is why browsers warn on it.

Caching LLM responses by meaning rather than exact text — similar questions hit the cache even when worded differently.

A dynamic text chunking method that splits documents based on semantic transitions rather than character counts.

Splitting a sensitive process across multiple people so no single individual can complete it alone — the control that prevents both fraud and catastrophic single-actor mistakes.

A dead-simple way to stream server-to-client updates over plain HTTP — one-directional, auto-reconnecting, and the natural fit for streaming LLM token output.

Generating a page's HTML on the server for each request rather than in the browser — better first-load performance and SEO, at the cost of server work. One point on a spectrum of rendering strategies.

A cloud model where the provider runs your code on demand without you managing servers.

How services find each other's current network locations in a dynamic environment where instances constantly appear, move, and disappear — the phone book for microservices.

In federated login (SAML/SSO), the application the user is trying to access — it trusts an external Identity Provider to vouch for who the user is.

The live directory at the heart of service discovery — a constantly-updated database of which service instances exist and where. Powerful, and a single point of failure if you let it be.

How long a user session stays valid before requiring re-authentication — the balance between security (short sessions limit stolen-session damage) and usability (nobody wants to log in constantly).

AWS's paid, managed DDoS protection tier — adds 24/7 response team access, cost protection against attack-driven scaling bills, and advanced mitigations over free Shield Standard.

AWS's foundational object store — eleven nines of durability, virtually unlimited scale, and the storage-class and egress decisions that decide your bill.

The SSO counterpart nobody implements well: ending a user's session everywhere at once — and why 'log out of all apps' is one of identity's genuinely hard problems.

One login for many applications — the productivity win that's also a security consolidation, concentrating both convenience and risk in the identity provider.

The SaaS model where each customer gets a dedicated, isolated stack — maximum isolation and per-customer flexibility, at the cost of the multi-tenant efficiencies that make SaaS cheap.

A documented commitment to service availability, performance, or support response times.

A text chunking method that generates overlapping segments to preserve context across boundaries.

A TLS handshake extension that tells the server which hostname the client wants — so one IP can host many HTTPS sites with different certificates. Also a privacy leak TLS is now closing.

A mathematical state where extremely large input logits result in near-zero gradients during training.

Scanning your dependencies for known vulnerabilities and license risks — where most real-world CVEs actually live, and the least glamorous, highest-yield security tool.

An inference acceleration technique that uses a small draft model to generate candidate tokens verified in parallel by a target model.

A DNS record listing which mail servers are authorized to send email for your domain — one of the three pillars (with DKIM and DMARC) that stop spammers from forging your address.

An attack that smuggles malicious SQL into a query because user input was concatenated into it — decades old, still devastating, and fully preventable with parameterized queries.

The negotiation that establishes an encrypted session before any data flows — the round trips behind 'HTTPS feels slow', and why TLS 1.3 cut them.

The process of decrypting SSL/TLS traffic at a proxy to reduce cryptographic compute overhead on backend nodes.

An attack that tricks a server into making requests to targets the attacker chooses — often internal systems and cloud metadata endpoints the attacker can't reach directly.

Automated code analysis that finds vulnerability patterns before anything runs — cheap, early, and only as valuable as your triage discipline.

Pre-rendering a whole site into static HTML at build time so it can be served as plain files from a CDN — the fastest, cheapest, most secure way to serve content that doesn't change per request.

An optimization method that estimates gradients using mini-batches to update parameters iteratively.

Sending tokens to the client as the model generates them, so users see output immediately instead of waiting for the full response.

A slice of a VPC bound to one availability zone — the unit where routing, exposure, and blast radius are actually decided.

The bitmask that splits an IP address into network and host portions — the arithmetic beneath every CIDR block, subnet, and routing decision.

The methodology partitioning IP spaces into smaller, isolated networks using subnet mask notation.

Supervised Fine-Tuning — teaching a pretrained model to follow instructions by imitating curated example responses; the first and most accessible post-training stage.

A high-priority context block defining the behavior, constraints, and operational persona of a language model.

An attack where malicious instructions hidden in content an LLM processes hijack the model's behavior — the top security risk for LLM applications.

The layered protocol family carrying essentially all internet traffic — and the layer model that tells you where latency, drops, and mysterious hangs actually live.

The parameter controlling randomness in LLM output — low values pick likely tokens for consistency, high values spread probability for variety.

An intra-model parallelism technique that splits individual matrix multiplication weights across multiple GPUs within a single layer.

NVIDIA's library for squeezing maximum LLM inference speed out of NVIDIA GPUs by compiling models into highly-optimized engines — top performance, at the cost of a heavier build step and NVIDIA lock-in.

The dominant infrastructure-as-code tool — declare cloud resources in config, and Terraform plans and applies the changes to reach that state. Cloud-agnostic, with state as its double-edged core.

A plugin translating declarative HCL resource configs into specific cloud API commands.

A structured exercise to find what could go wrong in a system before you build it — asking what you're protecting, who might attack it, and how, so you design defenses in.

A PostgreSQL extension purpose-built for time-series data — keeps full SQL and the Postgres ecosystem while adding automatic time-partitioning and massive ingest/query speedups for time-stamped data.

Skipping the full TLS negotiation on reconnection by reusing prior session keys — the optimization behind fast repeat HTTPS connections, culminating in TLS 1.3's 0-RTT.

Invalidating an access or refresh token before it expires — straightforward for stateful tokens, genuinely hard for stateless JWTs, and the gap attackers exploit.

The subword units LLMs read and write; the billing and capacity unit for context windows, API pricing, and rate limits.

The mechanism that lets an LLM invoke external functions — the model outputs a structured call, your code executes it, results return to the model.

Tokens Per Second — LLM speed measured two ways: per-request streaming speed users see, and aggregate GPU throughput that sets your unit economics.

A cloud hub-and-spoke router connecting multiple virtual networks, on-premises environments, and accounts.

Cryptographic protocol that encrypts data in transit between clients and servers.

An early cloud CI pioneer that popularized YAML pipelines for open source — now a cautionary tale about platform decline and a security-incident case study.

NVIDIA's production inference server for serving any model from any framework at scale — a general-purpose serving platform, distinct from LLM-specialized engines like vLLM.

Time to First Token — the delay between sending a request and the first output token arriving; the metric users actually feel.

An open-source API gateway written in Go — full-featured rate limiting, auth, and versioning without an enterprise paywall around the core.

The lightweight, connectionless transport protocol — fast and low-overhead, but with no delivery guarantees, ordering, or congestion control. The right choice when speed beats reliability.

A database optimized for storing embeddings and finding nearest neighbors fast, using approximate indexes like HNSW.

Numeric vector representations of text, images, or code that place semantically similar items close together in vector space.

High-dimensional coordinate lists that capture the semantic meanings of words, sentences, or images.

Vercel's global edge platform — a CDN plus edge compute that serves and runs your app close to users worldwide. The deploy-target side of the modern frontend/Jamstack stack.

A software emulation of a physical computer — the abstraction that made cloud computing possible, now sharing the stage with the lighter-weight container.

An isolated virtual network inside a public cloud where you control IP ranges and routing.

Encrypted tunnels over public networks — site-to-site links that stitch clouds to data centers, and the remote-access model zero trust is busily replacing.

The open-source LLM inference engine that made high-throughput serving practical — its PagedAttention manages the KV cache like virtual memory, dramatically raising GPU utilization.

A private doorway that lets resources in your VPC reach AWS services (like S3) over Amazon's internal network instead of the public internet — more secure, and it can save on data costs.

Network-level records of accepted and rejected traffic in your VPC — the forensic and debugging layer that answers 'did the packet even arrive?'

A private link that merges routing between two VPCs — simple and free of hourly charges, but non-transitive by design, which is where every peering architecture eventually hurts.

A point-to-point network route enabling private communication between two virtual networks using internal IPs.

Automated tooling that inspects systems, code, containers, and dependencies for known security weaknesses — a continuous baseline of security hygiene, only useful if its findings drive action.

A disaster recovery pattern maintaining replicated data and minimally scaled compute resources for fast failover.

An application-layer firewall that inspects HTTP requests for attacks — real value against common exploits, real limits against determined attackers, and a false-positive budget to manage.

An HTTP callback that sends real-time event notifications from one system to another.

A reverse API: instead of you polling a service for changes, it calls your URL when something happens. Efficient and real-time — and a security surface you must lock down.

A protocol for a persistent, two-way connection between browser and server — real-time, low-overhead, bidirectional. The right tool for chat and live collaboration; overkill for one-way updates.

The strategy of assigning initial random numeric values to neural weights to prevent gradient explosion.

A DNS routing policy that splits traffic across endpoints by percentages you set — the mechanism behind gradual rollouts, A/B tests, and controlled migrations between environments.

A single TLS certificate that covers all first-level subdomains of a domain (*.example.com) — convenient for managing many subdomains, but concentrates risk in one shared private key.

The modern VPN protocol that made its predecessors feel obsolete — tiny codebase, kernel-speed, effortless roaming — and the engine under most 2026 mesh-networking products.

Write-Ahead Logging — record every change to a durable log *before* applying it, so a crash can always be recovered. The mechanism behind database durability itself.

A security flaw that's exploited before the vendor knows about it or has a patch — 'day zero' of the defenders' awareness. The hardest class of threat to defend against.

A memory optimization protocol that shards parameters, gradients, and optimizer states across data-parallel ranks.

Security model that verifies every access request regardless of network location.

A prompting approach where a model generates answers directly without seeing task examples.