AWS EC2 — Elastic Compute Cloud Fundamentals

What is Amazon EC2?#

Elastic Compute Cloud (EC2) is AWS's virtual machine service. It lets you rent virtual servers in the cloud, choosing the OS, CPU, RAM, storage, and network configuration you need.

EC2 is the backbone of the AWS compute layer and is central to the SAA-C03 exam.

EC2 Instance Types#

Instance types define the hardware characteristics of your VM. They follow a naming pattern:

m5.xlarge
│  │ └── Size: nano / micro / small / medium / large / xlarge / 2xlarge…
│  └──── Generation: 5 (higher = newer)
└─────── Family: m (general purpose)

Instance Families#

Amazon Machine Images (AMIs)#

An AMI is a template that contains:

• The operating system (e.g., Amazon Linux, Ubuntu, Windows Server)
• Pre-installed software and configuration
• EBS snapshot(s) for the root volume

Sources of AMIs:

1. AWS provided — Amazon Linux 2023, Ubuntu, Windows
2. AWS Marketplace — vendor-provided (e.g., Palo Alto firewall, NGINX Plus)
3. Community AMIs — shared by other users (use with caution)
4. Custom AMIs — AMIs you create from existing instances

Security Groups#

A Security Group is a virtual firewall that controls inbound and outbound traffic to your EC2 instance.

Key rules:

• Security groups are stateful — if you allow inbound, the response is automatically allowed outbound
• Default: all inbound traffic blocked, all outbound traffic allowed
• You can attach multiple security groups to one instance
• Rules allow traffic only — you cannot create deny rules (use NACLs for that)

# Example: allow SSH from a specific IP
Inbound rule:
  Type: SSH
  Protocol: TCP
  Port: 22
  Source: 203.0.113.0/32   # Your IP only

Key Pairs#

A key pair provides SSH access to Linux instances:

1. AWS stores the public key on the instance
2. You download and store the private key (.pem file)
3. You use the private key to authenticate SSH connections

# Connect to an EC2 instance
chmod 400 my-key.pem
ssh -i my-key.pem ec2-user@<public-ip>

# For Ubuntu AMIs, the default user is 'ubuntu'
ssh -i my-key.pem ubuntu@<public-ip>

EBS Volumes#

Elastic Block Store (EBS) provides persistent block storage for EC2 instances. Think of it as the hard drive attached to your VM.

EBS volumes persist independently of the instance. By default, the root volume is deleted on termination — you can change this.

Instance Lifecycle#

Pending → Running → Stopping → Stopped → Terminated
                 ↘ Rebooting ↗

User Data#

User Data is a script that runs once when an instance first launches (before it becomes available). Used for bootstrapping:

#!/bin/bash
yum update -y
yum install -y nginx
systemctl start nginx
systemctl enable nginx

Paste this into the "User data" field when launching an instance. It runs as root.

Elastic IP Addresses#

By default, an EC2 instance gets a new public IP each time it starts. An Elastic IP (EIP) is a static public IP you own and can reassign between instances.

# EIPs are free while attached to a running instance
# You're charged if an EIP is allocated but NOT attached

Launching Your First Instance (Quick Steps)#

1. Go to EC2 Console → Launch Instance
2. Choose an AMI (Amazon Linux 2023 for labs)
3. Choose instance type (t3.micro for free tier)
4. Create or select a key pair
5. Configure security group: allow SSH (port 22) from your IP
6. Launch

Hands-on: Launch an EC2 Web Server#

Goal: Create an Amazon Linux instance, bootstrap a web server, connect to it, and verify the app from a browser.

1. Open the EC2 console and choose Launch instance.
2. Name the instance cloudops-web-01.
3. Choose Amazon Linux 2023 AMI.
4. Choose t3.micro or the free-tier eligible option available in your Region.
5. Create a new key pair named cloudops-lab-key, or choose Proceed without a key pair if you will use EC2 Instance Connect or SSM later.
6. Create a security group with SSH TCP 22 from My IP only and HTTP TCP 80 from 0.0.0.0/0.
7. Expand Advanced details and paste this user data:

#!/bin/bash
dnf update -y
dnf install -y nginx
systemctl enable nginx
systemctl start nginx
echo "hello from $(hostname -f)" > /usr/share/nginx/html/index.html

8. Launch the instance and wait for both status checks to pass.
9. Copy the public IPv4 address and open http://<public-ip> in a browser.
10. Connect using EC2 Instance Connect from the console, then run:

systemctl status nginx
curl -s http://localhost

11. Stop the instance when done, or terminate it if you no longer need the lab.

Hands-on: Create and Use a Custom AMI#

Goal: Capture a configured instance as an AMI and launch a second instance from that image.

1. Use the web server instance from the previous lab.
2. In EC2 > Instances, select the instance.
3. Choose Actions > Image and templates > Create image.
4. Set image name to cloudops-nginx-ami.
5. Keep No reboot unchecked for a cleaner filesystem snapshot.
6. Choose Create image.
7. Go to AMIs and wait until the AMI state is Available.
8. Select the AMI and choose Launch instance from AMI.
9. Launch a new instance with a different name, such as cloudops-web-02.
10. Open the new instance public IP and confirm nginx is already installed and serving the same content.
11. Clean up by deregistering the AMI and deleting the associated snapshot after the lab.

Hands-on: Change EC2 Instance Type#

Goal: Safely resize an instance when CPU or memory needs change.

1. Select a non-production test instance.
2. Choose Instance state > Stop instance and wait for Stopped.
3. Choose Actions > Instance settings > Change instance type.
4. Change from t3.micro to t3.small or another compatible type.
5. Start the instance.
6. Verify the application and instance status checks.
7. If the instance fails to start, review whether the AMI, virtualization type, architecture, EBS optimization, and ENA support match the target family.

Common Interview Questions#

Q: What is the difference between stopping and terminating an EC2 instance? Stopping an instance shuts it down but preserves the EBS root volume and associated resources (EIP, ENI). You can restart it. Terminating permanently deletes the instance and (by default) the root EBS volume.

Q: What is an AMI and why would you create a custom one? An AMI is a template containing OS, software, and configuration. You'd create a custom AMI from a configured instance to replicate that exact environment across multiple instances — useful for Auto Scaling groups or blue-green deployments.

Q: What is the difference between a Security Group and a NACL? Security Groups are stateful, instance-level firewalls that only allow rules. NACLs are stateless, subnet-level firewalls that support both allow and deny rules. Because they're stateless, you must explicitly allow both inbound and outbound traffic for each connection.

Common Mistakes#

• Using t2.micro in production — burstable instances throttle CPU after credits are exhausted
• Opening port 22 to 0.0.0.0/0 — immediately targeted by bots; restrict to your IP
• Forgetting EBS costs for stopped instances — stopped instances still incur EBS storage charges
• Using the default security group — it allows all traffic from instances in the same group

What to Learn Next#

1. AWS EC2 Auto Scaling — scale capacity automatically
2. AWS Networking — VPC Fundamentals — how networking works in AWS
3. AWS IAM Roles for EC2 — securely grant permissions to instances