A blog-friendly guide with real examples from AWS, Azure, and Google Cloud (plus quick notes on other providers).
If you’re new to cloud, the hardest part isn’t spinning up a server—it’s decoding the language: region vs zone, VPC vs subnet, IAM vs role, object storage vs block storage, and why “egress” can quietly wreck your bill.
This guide explains the most common terms in plain English and shows what each looks like across today’s major providers—AWS, Microsoft Azure, and Google Cloud (GCP). I’ll also sprinkle in cross-cloud notes when names differ.
The cheat sheet: how cloud terms usually group together
When you see a new term, it typically belongs to one of these buckets:
Location: Region, Zone/AZ, Edge
Compute: VM, Container, Kubernetes, Serverless
Storage: Object, Block, File, Snapshot
Networking: VPC/VNet, Subnet, IPs, Load Balancer, DNS
Security: IAM, Roles, Policies, MFA, Encryption
Reliability: High availability, DR, RTO/RPO, SLA
Operations: Logs, Metrics, Traces, Monitoring
Cost: Pay-as-you-go, Egress, Reserved/Committed use, TCO
Keep that model in mind—everything starts to feel less random.
1) Location terms: where your stuff runs
Region
A geographic area (like “US East”, “West Europe”, “Mumbai”) where cloud data centers are located.
AWS: us-east-1, eu-west-1
Azure: East US, West Europe
GCP: us-central1, europe-west1
Why it matters: latency, legal/compliance requirements, and resilience.
Availability Zone (AZ) / Zone
A separate data-center location within a region. Designed so a single zone failure doesn’t take down everything—if you architect for it.
AWS: Availability Zones (e.g., us-east-1a, us-east-1b)
Azure: Availability Zones (Zone 1/2/3 within a region)
GCP: Zones (e.g., us-central1-a, us-central1-b)
Edge / CDN
Infrastructure closer to users for faster delivery and protection (often caching static content).
2) Compute terms: what runs your code
Virtual Machine (VM) / Instance
A “virtual server” you rent: you choose CPU/RAM, OS, disk, etc.
AWS: EC2 instance
Azure: Virtual Machines
GCP: Compute Engine VM
Image
A template for a VM’s disk/OS (like Ubuntu, Windows, etc.).
AWS: AMI (Amazon Machine Image)
Azure: VM image (Marketplace images, custom images)
GCP: Images (public or custom)
Autoscaling
Automatically adds/removes compute based on load (CPU, requests, queue depth).
Container
A packaged app + dependencies, designed to run consistently across environments.
- You’ll typically build containers with Docker and run them on Kubernetes or container platforms.
Kubernetes
Orchestrates containers: scheduling, scaling, rolling updates, service discovery.
AWS: EKS
Azure: AKS
GCP: GKE
Serverless
You deploy code; the platform handles provisioning and scaling. “Serverless” = no server management, not “no servers.”
Cloud Run-style serverless containers (worth knowing)
Run a container without managing servers; often the easiest “modern” way to deploy web APIs.
3) Storage terms: where your data lives
Object Storage
Store files as objects in buckets/containers. Great for images, backups, logs, data lakes.
Block Storage
Disk volumes attached to VMs. Good for databases, low-latency disk workloads.
AWS: EBS
Azure: Managed Disks
GCP: Persistent Disk
File Storage
Shared file systems mounted by multiple machines (NFS/SMB style). Useful for legacy apps.
Snapshot
A point-in-time copy of a disk/volume (often incremental).
4) Networking terms: how things connect
VPC / VNet
Your private network in the cloud.
Subnet
A smaller IP range inside your VPC/VNet. Often mapped to a zone and used to separate tiers.
- Common pattern: public subnet (internet-facing) and private subnet (internal services)
Security Group / Firewall rules / NSG
Controls what traffic is allowed.
Load Balancer
Distributes traffic across multiple backends for HA and scaling.
AWS: Elastic Load Balancing (ALB/NLB)
Azure: Azure Load Balancer / Application Gateway
GCP: Cloud Load Balancing
DNS
Maps names to endpoints (e.g., api.example.com).
AWS: Route 53
Azure: Azure DNS
GCP: Cloud DNS
NAT Gateway
Lets private resources access the internet outbound without exposing them inbound.
AWS: NAT Gateway
Azure: NAT Gateway
GCP: Cloud NAT
5) Security terms: who can do what
IAM (Identity and Access Management)
The system for permissions. This is core to cloud security.
AWS: IAM (users, roles, policies)
Azure: Microsoft Entra ID + Azure RBAC (roles/assignments)
GCP: IAM (members, roles, permissions)
Role
A set of permissions that can be assigned to a user/service/workload.
AWS: IAM Role (often assumed by services)
Azure: RBAC Role (assigned at scope: subscription/resource group/resource)
GCP: IAM Role (predefined or custom)
Policy
The document/rules that define permissions.
Least Privilege
Give only the minimum permissions needed. This is the #1 habit that prevents incidents from becoming disasters.
Encryption (At rest / In transit)
Also useful:
KMS (Key Management Service)
Manage encryption keys used by services.
AWS: KMS
Azure: Key Vault (keys)
GCP: Cloud KMS
Secrets Manager / Vault
Store passwords/API keys safely.
6) Reliability terms: staying up when things break
High Availability (HA)
Design for failures by distributing across multiple instances and zones.
- Typical approach: multi-zone + load balancer + health checks
Disaster Recovery (DR)
Planning for bigger failures (region outage, data corruption, ransomware). Common DR tiers:
Backup & restore (cheapest, slowest recovery)
Warm standby (some infrastructure running)
Active-active (most resilient, most complex/costly)
RTO / RPO
These force you to be honest about what “reliable” really means.
7) Operations terms: knowing what’s happening
Logs
Event records (errors, warnings, audit trails).
Metrics
Numbers over time: CPU, latency, request counts.
Traces
Follow one request across services (microservices debugging superpower).
Observability
The combined practice of logs + metrics + traces + dashboards + alerting.
8) Cost terms: why your bill changes
Pay-as-you-go
You pay based on usage: compute hours/seconds, storage GB, requests, data transfer.
Egress
Outbound data transfer (often charged). Beginners forget this when moving lots of data out of the cloud or across regions.
Reserved / Savings plans / Committed use
Discounts for committing to a certain spend or usage level.
AWS: Reserved Instances / Savings Plans
Azure: Reserved VM Instances / Savings Plans (varies by service)
GCP: Committed Use Discounts
TCO (Total Cost of Ownership)
Cloud bill + engineering time + operational overhead + downtime risk. “Cheaper” services can be expensive if they create a lot of operational work.
Mini-glossary (alphabetical) with provider examples
API Gateway — Managed front door for APIs (auth, routing, rate limits).
- AWS: API Gateway | Azure: API Management | GCP: API Gateway / Apigee
Autoscaling — Adjust capacity automatically.
- AWS: Auto Scaling Groups | Azure: VM Scale Sets | GCP: Managed Instance Groups
Availability Zone / Zone — Separate data center location within a region.
- AWS: AZ | Azure: Availability Zones | GCP: Zone
Bucket / Container — Top-level object storage namespace.
- AWS: S3 bucket | Azure: Blob container | GCP: Storage bucket
CDN — Cache content near users.
- AWS: CloudFront | Azure: Front Door/CDN | GCP: Cloud CDN
Container Registry — Store container images.
- AWS: ECR | Azure: ACR | GCP: Artifact Registry
DDoS Protection — Reduce impact of denial-of-service attacks.
- AWS: Shield | Azure: DDoS Protection | GCP: Cloud Armor (with load balancing)
DNS — Domain name resolution.
- AWS: Route 53 | Azure: Azure DNS | GCP: Cloud DNS
Egress — Data leaving a network/provider/region (often billed).
- Present in all providers’ billing models
Firewall Rules / NSG / Security Group — Network traffic control.
- AWS: Security Groups | Azure: NSG | GCP: Firewall Rules
Function (FaaS) — Event-driven serverless compute.
- AWS: Lambda | Azure: Functions | GCP: Cloud Functions
IAM — Identities + permissions.
- AWS: IAM | Azure: Entra ID + RBAC | GCP: IAM
Instance / VM — Virtual server.
- AWS: EC2 | Azure: Virtual Machines | GCP: Compute Engine
KMS — Key management for encryption.
- AWS: KMS | Azure: Key Vault | GCP: Cloud KMS
Kubernetes — Container orchestration.
- AWS: EKS | Azure: AKS | GCP: GKE
Load Balancer — Distributes incoming traffic.
- AWS: ALB/NLB | Azure: App Gateway/Load Balancer | GCP: Cloud Load Balancing
Logging — Captured events.
- AWS: CloudWatch Logs | Azure: Log Analytics | GCP: Cloud Logging
Metrics — Time-series measurements.
- AWS: CloudWatch Metrics | Azure: Monitor Metrics | GCP: Cloud Monitoring
NAT Gateway — Outbound internet for private resources.
- AWS: NAT Gateway | Azure: NAT Gateway | GCP: Cloud NAT
Object Storage — File/object storage at scale.
- AWS: S3 | Azure: Blob | GCP: Cloud Storage
Policy — Permissions definition.
- AWS: IAM policy JSON | Azure: RBAC role definitions/assignments | GCP: IAM policy bindings
Region — Geographic area containing zones.
- AWS/Azure/GCP: all use regions
Role — A bundle of permissions.
- AWS: IAM Role | Azure: RBAC Role | GCP: IAM Role
Secret Manager — Store sensitive values.
- AWS: Secrets Manager | Azure: Key Vault | GCP: Secret Manager
Serverless Containers — Run containers without managing servers.
- AWS: App Runner | Azure: Container Apps | GCP: Cloud Run
Snapshot — Point-in-time disk copy.
- AWS: EBS snapshot | Azure: Disk snapshot | GCP: Persistent Disk snapshot
Subnet — IP range within a virtual network.
- AWS: Subnet | Azure: Subnet | GCP: Subnet
Tracing — Follow requests across services.
- AWS: X-Ray | Azure: App Insights | GCP: Cloud Trace
VPC / VNet — Private cloud network.
- AWS: VPC | Azure: VNet | GCP: VPC Network
A beginner-friendly “first project” mapping (so terms stick)
If you want this terminology to click, build something tiny and map each component:
Example: “Hello Cloud” API
Deploy an HTTP service (serverless container or function)
Put it behind a domain name (DNS)
Store one file in object storage
Add logging + a basic alert
Lock it down with least-privilege IAM
As you do, you’ll naturally touch: region, IAM, networking, compute, storage, observability, and cost.
