Glossary

AFT — Account Factory for Terraform. A Terraform framework for provisioning and customising AWS accounts created through Control Tower, so new accounts inherit the organisation baseline automatically.

All-at-once deployment. A deployment that replaces every instance in an Auto Scaling group simultaneously. Fast, simple, highest blast radius.

Blue/green deployment. Running two identical environments and shifting traffic from one to the other, so rollback is a traffic switch rather than a redeploy.

CAB — Change Advisory Board. The group that reviews and approves changes above a defined risk threshold.

Control Tower. AWS's managed service for setting up and governing a multi-account organisation, including centralised logging and guardrails.

Golden image. A pre-built, versioned machine image (AMI) containing the OS, patches and base software, produced by a Packer pipeline rather than hand-configured.

Guardrail. A preventive or detective control applied at the organisation level — an SCP, a Config rule, or a Control Tower control.

Immutable deployment. A deployment that replaces instances with new ones built from a new image rather than mutating running instances. Rollback means launching the previous image.

KPI — Key Performance Indicator. A metric tied to an agreed business or operational outcome, with a baseline and a target.

Landing zone. The baseline multi-account AWS environment — identity, network, logging, security and guardrails — on which workloads are deployed.

Policy as code. Expressing compliance and governance rules as version-controlled configuration evaluated by AWS Config, SCPs or CloudFormation Guard, rather than as prose reviewed manually.

RTO — Recovery Time Objective. The maximum acceptable time to restore a service after failure.

RPO — Recovery Point Objective. The maximum acceptable amount of data loss, expressed as time.

Runbook. A documented, repeatable procedure for a routine operation or a known failure mode, including verification and rollback steps.

Rolling deployment. Deploying to a subset of instances at a time, keeping the rest on the previous version until the batch is healthy.

SCP — Service Control Policy. An AWS Organizations policy that sets the maximum permissions available to accounts in an organisation or OU.

Shift-left. Moving security and quality activities earlier in the lifecycle, so defects and weaknesses are found before release rather than in production.

SLI / SLO. A service level indicator is a measured signal (latency, error rate, availability); a service level objective is the target for that signal.

Terraform state. The record of what Terraform believes it has provisioned. Stored remotely and locked, it is the source of truth for infrastructure changes.

Workload health KPI. A metric that indicates whether a workload is delivering its service — for example exam submission success rate or p95 checkout latency — as opposed to a raw infrastructure metric like CPU utilisation.