Launching Your First EC2 Instance

Amazon Elastic Compute Cloud (EC2) provides resizable virtual machines in the cloud called instances. You choose the operating system, CPU, memory, storage, and networking capacity. EC2 is the foundational compute service on AWS—almost every architecture that needs persistent, stateful compute relies on EC2 directly or through services built on top of it (ECS, EKS, EMR). Instances run inside your VPC and can be started, stopped, rebooted, or terminated on demand.

An Amazon Machine Image (AMI) is a template that defines the operating system, software, and configuration of an EC2 instance. AWS provides thousands of AMIs (Amazon Linux 2023, Ubuntu, Windows Server), Marketplace vendors publish AMIs with pre-configured software, and you can create your own custom AMIs by capturing a running instance. When you launch an instance, you select an AMI—it determines the root volume content and architecture (x86_64 or ARM).

The EC2 Launch Wizard in the console walks you through: 1) Name and tags; 2) AMI selection; 3) Instance type (CPU/memory combination); 4) Key pair for SSH access; 5) Network settings (VPC, subnet, security group); 6) Storage (root EBS volume size and type); 7) Advanced settings (IAM role, user data script, metadata options). Understanding each step lets you answer configuration-based exam questions confidently.

A key pair consists of a public key (stored by AWS) and a private key (downloaded by you—only once). When you launch an EC2 instance, AWS injects the public key into the ~/.ssh/authorized_keys file of the default user (e.g., ec2-user for Amazon Linux, ubuntu for Ubuntu). You connect using the private key: ssh -i my-key.pem ec2-user@<public-ip>. Losing the private key means you cannot SSH into the instance unless you use Systems Manager Session Manager as an alternative.

An EC2 instance moves through several states. Pending: instance is starting up (not billed). Running: instance is active (billed per second or hour). Stopping: transitioning to stopped (EBS-backed instances only). Stopped: instance is off—you only pay for attached EBS storage. Terminated: permanently deleted—cannot be restarted. Understanding these states matters for billing (On-Demand charges only accrue while Running) and architecture (Spot instances terminate without entering Stopped).

By default, instances in public subnets receive a public IPv4 address (dynamic—changes on stop/start) and a private IPv4 address (persistent across stop/start within the VPC). For a persistent public IP, allocate an Elastic IP (EIP)—a static public IPv4 address you own until you release it. EIPs are free when attached to a running instance but charged when unattached or when you have more than one per running instance.

User data is a shell script (or cloud-init configuration) that runs once when an instance launches for the first time. Use it to install packages, configure software, or pull application code from S3. User data runs as root and is not re-executed on reboot by default. It is passed as base64-encoded text via the launch configuration. Keeping user data short and relying on pre-baked AMIs for heavy setup speeds up auto-scaling launch times.

There are two primary ways to access EC2 instances. SSH: requires port 22 open in the security group and the private key file. AWS Systems Manager Session Manager: provides browser-based or CLI shell access without opening any ports, without a key pair, and with full audit trail via CloudTrail. Session Manager requires the SSM agent (pre-installed on Amazon Linux and Windows Server AMIs) and an IAM role with the AmazonSSMManagedInstanceCore policy. Session Manager is the preferred access method for production instances.

The EC2 Instance Metadata Service (IMDS) is an HTTP endpoint at 169.254.169.254 accessible only from within the instance. It provides runtime information: instance ID, AMI ID, public IP, IAM role credentials, Availability Zone, and more. IMDSv2 (the current best practice) requires a session-oriented token, preventing server-side request forgery (SSRF) attacks from reading metadata via a vulnerable application. Always configure instances to require IMDSv2.

Placement groups control how instances are distributed across the underlying hardware. Cluster: packs instances close together in one AZ for ultra-low network latency and high bandwidth—ideal for HPC. Spread: places each instance on distinct hardware to reduce correlated failures—ideal for small critical sets of instances (max 7 per AZ). Partition: divides instances into logical partitions on separate racks—ideal for large distributed systems like Hadoop or Cassandra where rack-awareness matters.

Termination protection prevents an instance from being accidentally terminated via the console, CLI, or API. Enable it when launching critical instances. Note: even with termination protection enabled, Auto Scaling Groups can still terminate instances during scale-in events unless you configure instance protection separately. The DeleteOnTermination attribute on the root EBS volume controls whether the volume is automatically deleted when the instance is terminated—best practice is true for root volumes and false for data volumes you want to retain.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: EC2 instances are launched from AMIs with a chosen instance type, key pair, security group, and optional user data, Elastic IPs provide persistent public addresses while standard public IPs change on stop/start, and Systems Manager Session Manager is the preferred access method over SSH for production instances. Next up we compare instance types and pricing models.