Introduction to Amazon EC2
Amazon Elastic Compute Cloud (EC2) is a core service of Amazon Web Services (AWS) that provides scalable compute capacity in the cloud. EC2 eliminates the need to invest in hardware upfront, allowing users to develop and deploy applications faster. It enables you to launch virtual servers (instances), configure security and networking, and manage storage. EC2’s pay-as-you-go model lets you scale capacity up or down as needed, paying only for what you use. EC2 is the foundation of many cloud architectures, offering the flexibility, reliability, and affordability needed for workloads ranging from web applications to high-performance computing.
EC2 Core Concepts
Instance Types Overview
| Family | Prefix | Optimized For | Use Cases |
|---|
| General Purpose | t3, t4g, m5, m6g | Balanced CPU, memory, network | Web servers, dev environments |
| Compute Optimized | c5, c6g | High CPU performance | Batch processing, gaming, HPC |
| Memory Optimized | r5, r6g, x1, z1d | Large memory operations | In-memory databases, real-time analytics |
| Storage Optimized | d2, h1, i3, i4i | High I/O performance | Data warehousing, distributed file systems |
| Accelerated Computing | p3, p4d, g4, g5 | GPU, FPGA acceleration | Machine learning, video processing |
Instance Size Scaling
| Size | vCPU | Memory | Relative Capacity | Pricing |
|---|
| nano | 2 | 0.5 GB | Smallest | 0.25x of small |
| micro | 2 | 1 GB | Very small | 0.5x of small |
| small | 2 | 2 GB | Baseline | 1x (baseline) |
| medium | 2 | 4 GB | Moderate | 2x of small |
| large | 2 | 8 GB | Significant | 4x of small |
| xlarge | 4 | 16 GB | Large | 8x of small |
| 2xlarge | 8 | 32 GB | Very large | 16x of small |
| 4xlarge | 16 | 64 GB | Huge | 32x of small |
| … | … | … | … | … |
| 24xlarge | 96 | 384 GB | Massive | 192x of small |
Note: Exact specifications vary by instance family. This is a general pattern.
EC2 Instance States
| State | Description | Billing | State Code |
|---|
| Pending | Instance is preparing to enter running state | No charges | 0 |
| Running | Instance is running and ready for use | Full charges apply | 16 |
| Stopping | Instance is preparing to stop | No charges for EBS-backed; charges continue for instance-store backed | 64 |
| Stopped | Instance is shut down but can be restarted | No instance charges; EBS storage charges apply | 80 |
| Shutting-down | Instance is preparing for termination | No charges | 32 |
| Terminated | Instance has been permanently deleted | No charges | 48 |
EC2 Storage Options
Amazon EBS Volume Types
| Volume Type | Code | Use Case | IOPS | Throughput | Price Point |
|---|
| General Purpose SSD | gp3 | General workloads, boot volumes | 3,000-16,000 | 125-1,000 MB/s | $ |
| General Purpose SSD | gp2 | Boot volumes, dev/test | 100-16,000 | Scales with volume | $ |
| Provisioned IOPS SSD | io2 | Critical business applications | Up to 256,000 | Higher than io1 | $$$ |
| Provisioned IOPS SSD | io1 | Databases, I/O intensive workloads | Up to 64,000 | Up to 1,000 MB/s | $$$ |
| Throughput Optimized HDD | st1 | Big data, data warehouses | 500 | Up to 500 MB/s | $ |
| Cold HDD | sc1 | Infrequently accessed workloads | 250 | Up to 250 MB/s | $ |
Instance Store vs EBS Comparison
| Feature | Instance Store | EBS |
|---|
| Persistence | Temporary, lost on stop/terminate | Persistent, independent of instance |
| Latency | Lowest (physically attached) | Very low |
| Use cases | Cache, scratch data, temporary content | Boot volumes, databases, applications |
| Size limits | Varies by instance type | Up to 64 TiB per volume |
| Backups | Manual only | Snapshots to S3 |
| Data lifecycle | Tied to instance lifecycle | Independent of instance |
| Billing | Included in instance price | Separate charges |
Networking Features
VPC and EC2 Networking
| Feature | Description | Use Case |
|---|
| Elastic IP | Static public IPv4 address | Applications requiring fixed IP |
| ENI (Elastic Network Interface) | Virtual network card | Multi-homed instances |
| Enhanced Networking | High performance networking | High throughput workloads |
| Security Groups | Instance-level firewall | Control inbound/outbound traffic |
| NACL (Network ACL) | Subnet-level firewall | Additional security layer |
| Placement Groups | Control instance placement | Low-latency, high throughput needs |
| VPC Endpoints | Private connection to AWS services | Secure access without internet |
Security Group Rules Syntax
Inbound Rules Format:
Protocol: [tcp/udp/icmp/all]
Port Range: [port or range]
Source: [CIDR block / security group ID / prefix list]
Description: [optional description]
Outbound Rules Format:
Protocol: [tcp/udp/icmp/all]
Port Range: [port or range]
Destination: [CIDR block / security group ID / prefix list]
Description: [optional description]
Common Security Group Configurations:
| Use Case | Inbound | Outbound |
|---|
| Web Server | TCP 80, 443 from 0.0.0.0/0 | All traffic |
| SSH Access | TCP 22 from specific IPs | All traffic |
| Database | TCP 3306 from web tier SG | All traffic |
| Application | Custom ports from load balancer SG | All traffic |
EC2 Purchasing Options
Instance Purchasing Model Comparison
| Option | Description | Discount | Commitment | Best For |
|---|
| On-Demand | Pay per hour or second, no commitment | None | None | Variable workloads, short-term needs |
| Reserved Instances | Pre-purchase capacity for 1 or 3 years | Up to 72% | 1 or 3 years | Steady, predictable workloads |
| Savings Plans | Commit to spend per hour for 1 or 3 years | Up to 72% | 1 or 3 years | Flexible resource usage |
| Spot Instances | Bid for unused EC2 capacity | Up to 90% | None (can be terminated) | Fault-tolerant, flexible workloads |
| Dedicated Hosts | Physical server with EC2 instance capacity | None | On-demand or reservation | Compliance, licensing requirements |
| Capacity Reservations | Reserve capacity in specific AZ | None | As needed | Ensure capacity for critical periods |
Reserved Instance Types
| Type | Payment Options | Flexibility | Discount Level |
|---|
| Standard RI | All Upfront, Partial Upfront, No Upfront | Limited modification options | Highest (up to 72%) |
| Convertible RI | All Upfront, Partial Upfront, No Upfront | Can change family, OS, tenancy | Good (up to 66%) |
| Scheduled RI | All Upfront | Reserved for specific time windows | Varies based on schedule |
EC2 Management and Deployment
AMI Creation and Management
# Create AMI from running instance
aws ec2 create-image --instance-id i-1234567890abcdef0 --name "My AMI" --description "My custom AMI"
# Copy AMI to another region
aws ec2 copy-image --source-region us-east-1 --source-image-id ami-12345678 --name "My AMI Copy" --region us-west-2
# Share AMI with another account
aws ec2 modify-image-attribute --image-id ami-12345678 --launch-permission "Add={UserId=123456789012}"
# Make AMI public (use with caution)
aws ec2 modify-image-attribute --image-id ami-12345678 --launch-permission "Add={Group=all}"
EC2 Launch Templates vs. Launch Configurations
| Feature | Launch Templates | Launch Configurations |
|---|
| Versioning | Supports multiple versions | No versioning (immutable) |
| Service integration | EC2, Spot Fleet, Auto Scaling | Auto Scaling only |
| Partial configuration | Supports parameters | Requires complete configuration |
| Modification | Can create new version | Must create new configuration |
| Inheritance | Can use as base for new template | Not inheritable |
| Instance type diversity | Supports multiple types | Single instance type |
User Data Example (Linux)
#!/bin/bash
# Update system packages
yum update -y
# Install web server
yum install -y httpd
# Start web server
systemctl start httpd
systemctl enable httpd
# Create a simple web page
echo "<html><body><h1>Hello from EC2</h1></body></html>" > /var/www/html/index.html
User Data Example (Windows)
<powershell>
# Install IIS
Install-WindowsFeature -name Web-Server -IncludeManagementTools
# Create a simple web page
New-Item -Path "C:\inetpub\wwwroot\index.html" -ItemType File -Value "<html><body><h1>Hello from EC2</h1></body></html>"
# Set administrator password
$admin = [adsi]("WinNT://./administrator, user")
$admin.SetPassword("MySecurePassword123!")
</powershell>
EC2 Auto Scaling
Auto Scaling Components
| Component | Description | Purpose |
|---|
| Auto Scaling Group | Collection of EC2 instances treated as logical unit | Manages instance count and distribution |
| Launch Template/Configuration | Template for new instance launches | Defines instance configuration |
| Scaling Policy | Rules that control scaling actions | Determines when to add/remove instances |
| Scheduled Actions | Time-based scaling | Predictable load changes |
| Scaling Cooldowns | Pause between scaling activities | Prevents rapid scaling fluctuations |
| Health Checks | Instance health monitoring | Ensures only healthy instances serve traffic |
Common Scaling Policies
| Policy Type | Configuration | Use Case |
|---|
| Target Tracking | Maintain metric at target value | Keep CPU utilization at 70% |
| Step Scaling | Add/remove specified capacity based on alarm thresholds | Add 2 instances when CPU > 80% |
| Simple Scaling | Add/remove fixed capacity when alarm triggered | Add 1 instance when alarm triggers |
| Scheduled Scaling | Change capacity at specific times | Increase capacity before business hours |
| Predictive Scaling | Scale based on historical patterns | Weekend traffic patterns |
Auto Scaling CLI Examples
# Create Auto Scaling group
aws autoscaling create-auto-scaling-group \
--auto-scaling-group-name my-asg \
--launch-template LaunchTemplateId=lt-1234567890abcdef0,Version='$Latest' \
--min-size 2 \
--max-size 10 \
--desired-capacity 2 \
--vpc-zone-identifier "subnet-1234567890abcdef0,subnet-0987654321abcdef0"
# Configure target tracking scaling policy
aws autoscaling put-scaling-policy \
--auto-scaling-group-name my-asg \
--policy-name cpu70-target-tracking-scaling-policy \
--policy-type TargetTrackingScaling \
--target-tracking-configuration file://config.json
# Content of config.json:
# {
# "TargetValue": 70.0,
# "PredefinedMetricSpecification": {
# "PredefinedMetricType": "ASGAverageCPUUtilization"
# }
# }
EC2 Load Balancing
Load Balancer Types
| Type | Use Case | Protocol Support | Layer | Special Features |
|---|
| Application Load Balancer (ALB) | HTTP/HTTPS applications | HTTP, HTTPS, WebSocket | Layer 7 | Path-based routing, host-based routing, TLS termination |
| Network Load Balancer (NLB) | TCP/UDP/TLS traffic, extreme performance | TCP, UDP, TLS | Layer 4 | Ultra-low latency, static IP, preserve source IP |
| Gateway Load Balancer (GWLB) | Network appliances (firewalls, IDS/IPS) | IP packets | Layer 3 | Transparent network gateway, high availability |
| Classic Load Balancer (CLB) | Legacy applications (not recommended for new) | HTTP, HTTPS, TCP, SSL | Layer 4/7 | Basic load balancing, legacy support |
Common Load Balancer Settings
| Setting | Description | Typical Configuration |
|---|
| Idle Timeout | How long connection can be idle | 60 seconds |
| Cross-Zone Load Balancing | Distribute traffic across all zones | Enabled |
| Connection Draining | Time to complete in-flight requests | 300 seconds |
| Health Checks | Verify instance health | HTTP:80/health, Interval: 30s |
| Sticky Sessions | Session persistence | Cookie-based (application-generated or load balancer generated) |
| SSL/TLS Certificates | Secure connections | ACM-managed certificates |
EC2 Monitoring and Management
CloudWatch Metrics for EC2
| Metric | Description | Namespace | Dimensions |
|---|
| CPUUtilization | CPU usage percentage | AWS/EC2 | InstanceId |
| DiskReadOps | Disk read operations | AWS/EC2 | InstanceId |
| DiskWriteOps | Disk write operations | AWS/EC2 | InstanceId |
| NetworkIn | Bytes received | AWS/EC2 | InstanceId |
| NetworkOut | Bytes sent | AWS/EC2 | InstanceId |
| StatusCheckFailed | Failed status checks | AWS/EC2 | InstanceId |
| StatusCheckFailed_Instance | Failed instance status checks | AWS/EC2 | InstanceId |
| StatusCheckFailed_System | Failed system status checks | AWS/EC2 | InstanceId |
CloudWatch Alarm Example (CLI)
# Create alarm for high CPU utilization
aws cloudwatch put-metric-alarm \
--alarm-name ec2-high-cpu \
--alarm-description "Alarm when CPU exceeds 80%" \
--metric-name CPUUtilization \
--namespace AWS/EC2 \
--statistic Average \
--period 300 \
--threshold 80 \
--comparison-operator GreaterThanThreshold \
--dimensions Name=InstanceId,Value=i-1234567890abcdef0 \
--evaluation-periods 2 \
--alarm-actions arn:aws:sns:us-east-1:123456789012:my-topic
CloudWatch Agent Configuration (Basic)
{
"metrics": {
"append_dimensions": {
"InstanceId": "${aws:InstanceId}"
},
"metrics_collected": {
"mem": {
"measurement": ["mem_used_percent"]
},
"disk": {
"measurement": ["used_percent"],
"resources": ["/"]
}
}
},
"logs": {
"logs_collected": {
"files": {
"collect_list": [
{
"file_path": "/var/log/messages",
"log_group_name": "/var/log/messages"
}
]
}
}
}
}
EC2 Security Best Practices
Security Checklist
Instance Hardening
- Use up-to-date AMIs
- Regularly patch OS and applications
- Remove unnecessary services and ports
- Implement host-based firewalls
Access Control
- Use IAM roles instead of access keys
- Implement least privilege principles
- Rotate credentials regularly
- Use SSH keys for Linux, complex passwords for Windows
Network Security
- Restrict security groups to necessary traffic
- Place instances in private subnets where possible
- Use VPC endpoints for AWS service access
- Implement network monitoring and logging
Data Protection
- Encrypt EBS volumes and snapshots
- Encrypt sensitive data in transit
- Implement backup and recovery procedures
- Secure AMIs with sensitive configurations
Compliance and Auditing
- Enable CloudTrail for API call logging
- Configure CloudWatch for monitoring
- Implement tagging for resource tracking
- Regular security assessments and audits
EC2 Compliance Summary
| Framework | Key Requirements | Implementation on EC2 |
|---|
| PCI DSS | Network segmentation, encryption, access control | Security groups, encrypted EBS, IAM roles |
| HIPAA | Data encryption, access controls, auditing | Encrypted volumes, VPC isolation, CloudTrail |
| GDPR | Data protection, breach notification | Encryption, IAM policies, monitoring |
| SOC 2 | Security, availability, confidentiality | HA configurations, encryption, access controls |
| ISO 27001 | Information security management | Security groups, IAM, encryption, monitoring |
EC2 Cost Optimization
Cost Optimization Strategies
| Strategy | Implementation | Potential Savings |
|---|
| Right-sizing | Match instance size to workload | 10-20% |
| Reserved Instances | Purchase 1-3 year reservations | 40-72% |
| Spot Instances | Use for fault-tolerant workloads | 60-90% |
| Auto Scaling | Scale based on demand | 15-30% |
| Scheduled Scaling | Turn off dev/test instances after hours | 65% for 12hr/day usage |
| Instance Generation | Use current generation instances | 10-20% + performance gains |
| Consolidated Billing | Aggregate usage across accounts | Varies with volume discounts |
| Savings Plans | Commit to usage for 1-3 years | Up to 72% |
Cost Analysis Tools
| Tool | Purpose | Key Features |
|---|
| Cost Explorer | Analyze and visualize costs | Usage patterns, forecasting, RI recommendations |
| AWS Budgets | Set cost budgets and alerts | Budget tracking, notifications |
| AWS Trusted Advisor | Cost optimization recommendations | Idle resources, reservation coverage |
| Cost Allocation Tags | Track costs by project/department | Custom tagging, cost reports |
| Compute Optimizer | Instance right-sizing recommendations | AI-powered analysis, specific recommendations |
AWS CLI Commands for EC2
Instance Management
# Launch a new instance
aws ec2 run-instances --image-id ami-0abcdef1234567890 --instance-type t3.micro --key-name MyKeyPair --security-group-ids sg-0abcdef1234567890 --subnet-id subnet-0abcdef1234567890 --count 1
# Describe instances (list all running instances)
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running"
# Stop an instance
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
# Start an instance
aws ec2 start-instances --instance-ids i-1234567890abcdef0
# Terminate an instance
aws ec2 terminate-instances --instance-ids i-1234567890abcdef0
# Get console output
aws ec2 get-console-output --instance-id i-1234567890abcdef0
Volume Management
# Create a new EBS volume
aws ec2 create-volume --availability-zone us-east-1a --size 50 --volume-type gp3
# Attach volume to instance
aws ec2 attach-volume --volume-id vol-1234567890abcdef0 --instance-id i-1234567890abcdef0 --device /dev/sdf
# Create snapshot of volume
aws ec2 create-snapshot --volume-id vol-1234567890abcdef0 --description "My snapshot"
# Copy snapshot to another region
aws ec2 copy-snapshot --source-region us-east-1 --source-snapshot-id snap-1234567890abcdef0 --region us-west-2 --description "Copy of snapshot"
Security Group Management
# Create security group
aws ec2 create-security-group --group-name MySecurityGroup --description "My security group" --vpc-id vpc-1234567890abcdef0
# Add inbound rule (allow SSH)
aws ec2 authorize-security-group-ingress --group-id sg-1234567890abcdef0 --protocol tcp --port 22 --cidr 203.0.113.0/24
# Add outbound rule (allow all traffic)
aws ec2 authorize-security-group-egress --group-id sg-1234567890abcdef0 --protocol all --port all --cidr 0.0.0.0/0
# Delete rule
aws ec2 revoke-security-group-ingress --group-id sg-1234567890abcdef0 --protocol tcp --port 22 --cidr 203.0.113.0/24
EC2 Troubleshooting
Common Issues and Solutions
| Issue | Possible Causes | Troubleshooting Steps |
|---|
| Instance won’t start | Insufficient capacity, corrupt filesystem | Check status check results, console output |
| Can’t connect via SSH | Security group rules, key issues, network ACLs | Verify SG rules, key permissions, VPC routing |
| High CPU utilization | Undersized instance, application issues | Monitor CloudWatch metrics, check processes |
| Insufficient IOPS | EBS volume type limitations, throughput limits | Upgrade volume type, check instance limits |
| Instance termination | Spot instance interruption, scheduled events, billing issues | Check termination protection, activity history |
| Boot failure | Missing OS files, configuration errors | Check system log, use recovery AMI |
Instance Status Checks
| Check Type | What It Verifies | Failed When |
|---|
| System Status Check | Physical host issues | Host has hardware/network problems |
| Instance Status Check | Instance’s software/network configuration | OS not booting, network not configured |
Recovery Procedures
Unresponsive Instance:
# Stop and start (EBS-backed only)
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
aws ec2 start-instances --instance-ids i-1234567890abcdef0
# If still failing, create AMI and launch new instance
aws ec2 create-image --instance-id i-1234567890abcdef0 --name "Recovery-AMI" --no-reboot
Volume Recovery:
# Create snapshot of problematic volume
aws ec2 create-snapshot --volume-id vol-1234567890abcdef0 --description "Recovery snapshot"
# Create new volume from snapshot
aws ec2 create-volume --availability-zone us-east-1a --snapshot-id snap-1234567890abcdef0
# Attach to recovery instance
aws ec2 attach-volume --volume-id vol-0abcdef1234567890 --instance-id i-0abcdef1234567890 --device /dev/sdf
Advanced EC2 Features
EC2 Nitro System
| Feature | Description | Benefits |
|---|
| Nitro Hypervisor | Lightweight hypervisor | Improved performance, security |
| Nitro Cards | Specialized hardware | Offloads network, storage, management functions |
| Nitro Security Chip | Hardware security module | Enhanced protection, verification |
| Bare Metal Support | No hypervisor option | Direct hardware access for specialized workloads |
EC2 Instance Connect
# Install EC2 Instance Connect CLI
pip install ec2instanceconnectcli
# Connect to instance (no need for key management)
mssh ec2-user@i-1234567890abcdef0 --region us-east-1
Hibernation vs. Stop vs. Terminate
| Feature | Hibernation | Stop | Terminate |
|---|
| Memory state | Saved to EBS | Lost | Lost |
| Billing | EBS only (no instance charges) | EBS only (no instance charges) | No charges |
| Boot time | Faster (no OS boot) | Standard boot time | N/A (new provision) |
| IP address | Changed (unless EIP) | Changed (unless EIP) | New IP |
| Instance ID | Preserved | Preserved | New instance ID |
| Data persistence | RAM + EBS preserved | Only EBS preserved | All data lost (unless separate EBS) |
EC2 Fleet Types
| Fleet Type | Description | Best For |
|---|
| EC2 Fleet | Manage mix of instance types, purchase options | Optimizing for price and performance |
| Spot Fleet | Group of Spot Instances with defined capacity | Fault-tolerant applications, batch jobs |
| Instance Refresh | Replace Auto Scaling instances | Rolling updates, replacing outdated configurations |
Resources for Further Learning
Official AWS Documentation
AWS Training and Certification
- AWS Certified Solutions Architect
- AWS Certified SysOps Administrator
- AWS Technical Essentials
- Architecting on AWS
Community Resources
- AWS re:Invent sessions (YouTube)
- AWS This Week (A Cloud Guru)
- AWS Blog
- Reddit r/aws community
- Stack Overflow aws tag
Quick Reference: EC2 Resource Limits
| Resource | Default Limit | Adjustable |
|---|
| Running On-Demand instances | 5-32 per region (varies by type) | Yes |
| Spot Instance requests | 20 per region | Yes |
| Active Elastic IP addresses | 5 per region | Yes |
| Launch templates | 5,000 per region | No |
| Security groups per VPC | 500 | Yes |
| Rules per security group | 60 inbound, 60 outbound | Yes |
| AMIs | 50,000 per region | No |
| Volumes per instance | 40 | No |
| Snapshots | 100,000 per region | No |
Note: Limits may change over time. Check AWS Service Quotas for current values.
