EC2: virtual servers in the cloud

Why rent a virtual server?

Buying a physical server means paying lakhs of rupees up front, waiting weeks for delivery, and guessing how big it must be. EC2 lets you start a server in about a minute, use it for an hour or a year, and throw it away when you are done. An instance is one virtual server: a slice of a big physical machine in an AWS data centre, with its own CPU, memory, disk and network card.

AMIs: the starting disk image

An AMI (Amazon Machine Image) is a template for the instance's first disk: the operating system plus any software already installed. AWS publishes AMIs for Amazon Linux 2023, Ubuntu, Windows Server and others. You can also make your own AMI from a configured instance, so every new server starts with your app already on it. AMI IDs are different in each region, so the same Ubuntu image has one ID in Mumbai (ap-south-1) and another in Singapore.

Instance types and how to read the name

The instance type decides how much CPU, memory and network you get. The name follows a pattern: family letter(s), generation number, optional attribute letters, a dot, then the size. In m7g.large, m is the family (general purpose), 7 is the generation (newer is usually faster and cheaper per unit of work), g is an attribute (AWS Graviton, an ARM processor) and large is the size. Each size step up (large, xlarge, 2xlarge, 4xlarge) roughly doubles CPU and memory, and the price.

Common attribute letters: g means Graviton (ARM), a means AMD, i means Intel, d means local NVMe instance storage, n means extra network bandwidth. Graviton types are often around 20 percent cheaper for the same work, but your software must run on ARM (most Linux software, Node.js, Python and Java do).

Burstable t types have a low baseline CPU level and earn CPU credits while idle. When traffic rises, they spend credits to run faster for a while. t3 and t4g start in unlimited mode by default, which means they can keep bursting after credits run out, but you pay a small extra charge for it. A t instance that is busy all day is usually cheaper as an m instance.

Connecting to an instance

• SSH with a key pair: AWS keeps the public key and you download the private key once as a .pem file. Run chmod 400 on it, because SSH refuses keys that other users can read.
• EC2 Instance Connect: the console or CLI pushes a short-lived public key to the instance for about 60 seconds, so you do not manage .pem files. Port 22 must still be reachable.
• Session Manager (part of AWS Systems Manager): opens a shell through the SSM agent, with no inbound port open at all. The instance needs an IAM role with the AmazonSSMManagedInstanceCore policy. Sessions can be logged, which auditors like.

chmod 400 asha-key.pem
ssh -i asha-key.pem ec2-user@203.0.113.10      # Amazon Linux user is ec2-user, Ubuntu uses ubuntu
aws ssm start-session --target i-0abc1234def567890   # Session Manager: no SSH port needed

Security groups: the instance firewall

A security group is a set of allow rules attached to an instance's network card. There are no deny rules: anything not allowed is blocked. Security groups are stateful, which means if a request is allowed in, the reply is allowed out automatically. A new security group allows all outbound traffic and no inbound traffic. Allow SSH (port 22) only from your own IP address, written as a /32, never from 0.0.0.0/0 (the whole internet).

User data: set up the server at first boot

User data is a script you pass at launch. By default it runs once, as root, on the first boot. It is the simplest way to install software automatically, so you never set up servers by hand.

# setup.sh, passed as user data
#!/bin/bash
dnf update -y
dnf install -y nginx
echo "<h1>Hello from $(hostname -f)</h1>" > /usr/share/nginx/html/index.html
systemctl enable --now nginx

# Launch one instance with that script
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --key-name asha-key \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --user-data file://setup.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-1}]' \
  --count 1

Lifecycle and billing

An instance moves through states: pending (starting), running, stopping, stopped, shutting-down and terminated. Stop is like switching a laptop off: the root EBS disk is kept and you can start it again, but anything on instance store disks is lost and the automatic public IP usually changes. Terminate deletes the instance for good, and by default its root volume too.

Linux instances are billed per second, with a minimum of 60 seconds each time they start. Some operating systems and Marketplace images are billed per hour, so check the pricing page. A stopped instance has no compute charge, but you still pay for its EBS volumes. Since February 2024 every public IPv4 address is charged by the hour, about 0.005 USD per hour at the time of writing, whether it is an auto-assigned public IP or an Elastic IP (a fixed public address you keep until you release it). That is small for one server and large for a hundred forgotten ones.