EC2

1What EC2 Is

EC2 (Elastic Compute Cloud) rents you a virtual machine — an instance — by the second. Unlike owning hardware, you can launch one in minutes, resize it, or terminate it entirely, and every instance boots from an AMI (Amazon Machine Image): a snapshot of an OS + pre-installed software that becomes the instance's starting disk state.

aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --subnet-id subnet-0111 \
  --security-group-ids sg-0app \
  --iam-instance-profile Name=AppInstanceProfile \
  --key-name my-keypair

2Instance Types and Sizing

Instance types encode a family (workload shape) and a size (vCPU/RAM amount): t3.micro, m5.large, c5.xlarge, r5.2xlarge.

Doubling the size suffix (large -> xlarge -> 2xlarge) roughly doubles vCPU and RAM together — you don't tune them independently within one family.

3AMIs

An AMI is a template: root volume snapshot + block device mapping + architecture + launch permissions. AWS publishes official AMIs (Amazon Linux, Ubuntu...), or you bake your own custom AMI from a configured instance so every new launch starts pre-installed and pre-configured, instead of running a bootstrap script on every boot.

4Launching: Where an Instance Actually Lives

Every instance launches into exactly one subnet (from 02-vpc_subnets_route_tables), which determines whether it's reachable from the internet (public subnet + public IP) or not (private subnet). It also gets:

• One or more security groups (stateful firewall — its own topic, 09-security_groups) controlling what traffic reaches it
• Optionally, an IAM instance profile (from 01-fundamentals_and_iam) — the mechanism that hands the instance a role, not long-lived credentials
• A key pair for SSH (Linux) or to decrypt the Administrator password (Windows)

aws ec2 run-instances --subnet-id subnet-private-a --no-associate-public-ip-address ...
# instance lands in a private subnet: no public IP, unreachable from the internet directly

5Instance Lifecycle

pending -> running -> [stopping -> stopped -> pending -> running]* -> shutting-down -> terminated

• Stop: the instance halts, but its EBS root volume (by default) persists — restart it later and your disk state is exactly as you left it. A stopped instance's public IP is released unless you attached a persistent Elastic IP; its private IP and EBS volumes survive.
• Terminate: permanent. Any EBS volume with DeleteOnTermination=true (the default for the root volume) is destroyed with the instance.
• Instance store volumes (physically attached to the host, not EBS) are lost on stop too, not just terminate — a common surprise for anyone assuming "stop" always preserves everything.

6EBS: Attached Block Storage

EBS (Elastic Block Store) volumes are network-attached disks, independent of the instance's own lifecycle unless DeleteOnTermination says otherwise. A volume can be detached from one instance and reattached to another, and EBS snapshots (point-in-time, incremental) back up a volume's contents to S3 under the hood.

7User Data: Bootstrapping at Launch

aws ec2 run-instances --user-data file://bootstrap.sh ...

#!/bin/bash
# bootstrap.sh — runs once, as root, on first boot only
yum install -y nginx
systemctl enable --now nginx

User data is how a from-scratch AMI becomes a configured, running service without manual login — the same mechanism an Auto Scaling Group (11-scalability_and_monitoring) relies on to bring up identical new instances unattended.

# from inside the instance:
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/AppInstanceProfile
# returns short-lived AccessKeyId/SecretAccessKey/SessionToken, auto-rotated by AWS before expiry

⚠️ Common Pitfalls

1. Assuming "stop" preserves everything. Public IPs (unless Elastic) and instance-store data are lost on stop, not just terminate.
2. Hardcoding access keys into an application instead of using an instance profile. The instance profile role (via IMDS) removes the need for any secret to leak in the first place.
3. Launching into a public subnet by default out of habit. Most application/database tiers belong in private subnets, reachable only through a load balancer or bastion.
4. Undersizing/oversizing by guessing. t-family burstable instances throttle hard once CPU credits run out under sustained load — fine for bursty traffic, wrong for steady CPU-bound work.
5. Forgetting DeleteOnTermination on non-root volumes, leaving orphaned EBS volumes (and their cost) behind after terminating instances.

📋 Quick Reference

aws ec2 describe-instances --instance-ids i-0123456789abcdef0
aws ec2 stop-instances --instance-ids i-0123456789abcdef0
aws ec2 terminate-instances --instance-ids i-0123456789abcdef0

🎤 Interview Q&A

🛠️ Practice exercises

Each exercise is a file in this topic folder. Code exercises are self-checking: run them and make the checks pass.

✅ Check yourself

Source: aws_ec2_theory.md · generated by tools/build_lessons.py