# Exercise 1: Launch a Correctly-Isolated Application Instance

```
STEP 1. Write the run-instances CLI command that launches an instance into
        a PRIVATE subnet (no public IP), attaches an IAM instance profile,
        and attaches an application-tier security group.
STEP 2. Write the user-data script (bash) that installs and starts a
        placeholder web service on boot.
STEP 3. Explain (as a comment) why this instance needs NO hardcoded AWS
        credentials anywhere in the user-data script or the app itself.
```

This is a config-only exercise (CLI + bash) — no interpreter to run, so verify yourself against the **Requirements Checklist** at the bottom instead of a PASS/FAIL script.

## CLI Command (TODO)

```bash
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type TODO-pick-a-reasonable-general-purpose-type \
  --subnet-id TODO-a-private-subnet-id \
  --TODO-the-flag-that-prevents-a-public-ip-from-being-assigned \
  --security-group-ids TODO-app-tier-sg-id \
  --iam-instance-profile Name=TODO-instance-profile-name \
  --user-data file://bootstrap.sh
```

## bootstrap.sh (TODO)

```bash
#!/bin/bash
# TODO: install a web server package and start it, enabled on boot
```

## Requirements Checklist

- [ ] The command does NOT include `--associate-public-ip-address`; it explicitly disables a public IP.
- [ ] `--subnet-id` refers to a subnet whose route table has no `0.0.0.0/0 -> igw-...` route (i.e., a private subnet per `02-vpc_subnets_route_tables` section 3).
- [ ] `--iam-instance-profile` is set — no `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` appear anywhere in `bootstrap.sh`.
- [ ] `bootstrap.sh` installs and enables the service so it survives a reboot, not just starts it once.
- [ ] Your comment correctly explains that the instance profile's role credentials are fetched from IMDS at runtime (theory section 8) — no secret ever needs to be baked into an image or script.