Cloud glossary

Short definitions for the terms used in the guides. Official provider docs remain the product source of truth. These entries exist to stop AWS, Azure, Google Cloud and Alibaba Cloud words from being treated as synonyms.

Account

On AWS, the billable isolation boundary inside an Organization. On Alibaba Cloud, a similar Resource Directory member. Not the same object as an Azure subscription or a Google Cloud project.

Subscription

Azure’s billable container under a management group. Role assignments and many quotas attach here. Do not translate this 1:1 to an AWS account without checking identity and policy scope.

Project

Google Cloud’s resource and IAM boundary under a folder or organization. APIs are enabled per project. Billing is attached via a billing account.

Landing zone

The baseline environment: identity, network, logging and guardrails that workloads land into. Each provider documents a different implementation (Control Tower, CAF, Google landing zones, Resource Directory).

Region

A provider-defined geographic area containing isolated failure domains (availability zones or equivalents). Data residency and SKU availability are regional. Confirm current lists on official location pages.

Availability zone

An isolated location inside a region, documented by AWS, Azure, Google Cloud and Alibaba Cloud with different physical and networking details. Multi-AZ is not the same as multi-region.

VPC / VNet

A software-defined network: Amazon VPC, Azure Virtual Network, Google Cloud VPC, Alibaba Cloud VPC. CIDR, subnets, route tables and gateways are the shared ideas; names and defaults differ.

Transit gateway

AWS Transit Gateway attaches VPCs and on-prem connections in a hub. Azure uses a hub VNet or Virtual WAN. Google Cloud uses Shared VPC or Network Connectivity Center. Alibaba Cloud uses CEN. Do not assume feature parity.

Private endpoint

A network interface that brings a platform service into a VPC/VNet (PrivateLink, Azure Private Link, Private Service Connect, Alibaba PrivateLink). It changes DNS and egress paths; it is not a VPN.

IAM

Identity and access management: principals, roles or policies, and evaluation. AWS IAM, Azure RBAC, Google Cloud IAM and Alibaba Cloud RAM are different languages for the same problem.

Workload identity

A non-human identity for compute (instance role, managed identity, service account, RAM role). Prefer this over long-lived access keys stored on disk.

Reserved capacity

A term commitment for a specific SKU or family (AWS Reserved Instances, Azure reservations). Unused reservations still bill. Rates belong on official pricing pages.

Savings plan

An AWS spend or compute commitment that applies more flexibly than a classic Reserved Instance. Still unused if usage disappears. See AWS Savings Plans documentation.

Committed use discount

Google Cloud CUD: resource-based or spend-based discounts for a term. Other providers have analogous but not identical products.

Cost allocation

Mapping invoice lines to owners using tags, labels, accounts or Kubernetes namespaces. Unallocated spend is a first-class metric.

Unit economics

Cost per business unit (request, tenant, training run, inference token). Requires allocation plus a denominator you already measure.

FinOps

The operating model for cloud cost: allocation, anomaly response and commitment decisions. Defined by the FinOps Foundation; not a product SKU.

AI FinOps

FinOps applied to GPU, training and inference: idle capacity, reservations and data-egress around model work. Separate from generic VM rightsizing.

RTO

Recovery Time Objective: how long a service may stay down. It is a product decision. Architecture can only meet an RTO you have written and tested.

RPO

Recovery Point Objective: how much data loss is acceptable, usually in time. Replication lag and backup interval set the floor.

Multi-cloud

Two or more production providers with live traffic or required standby. Accounts opened “just in case” are not multi-cloud operations.

Cloud egress

Data leaving a zone, region or provider toward the internet or another region. Often billed separately from compute. NAT Gateways add their own processing charges on AWS.