Amazon EC2 – Virtual Servers

1. What Amazon EC2 is

EC2 is one of the most popular of AWS’ offerings. EC2 = Elastic Compute Cloud = Infrastructure as a Service.

It mainly consists of the capability of:

• Renting virtual machines (EC2)
• Storing data on virtual drives (EBS)
• Distributing load across machines (ELB)
• Scaling the services using an auto-scaling group (ASG)

Knowing EC2 is fundamental to understanding how the cloud works — EC2 Instance Storage and Load Balancing & Auto Scaling both build directly on it.

2. Sizing and configuration options

When you launch an instance you choose:

• Operating System (OS): Linux, Windows or Mac OS
• How much compute power and cores (CPU)
• How much random-access memory (RAM)
• How much storage space:
  • Network-attached (EBS and EFS)
  • Hardware (EC2 Instance Store)
• Network card: speed of the card, public IP address
• Firewall rules: security group
• Bootstrap script (configured at first launch): EC2 User Data

3. EC2 User Data

It is possible to bootstrap instances using an EC2 User Data script. Bootstrapping means launching commands when a machine starts.

• The script is only run once, at the instance’s first start.
• It is used to automate boot tasks such as installing updates, installing software, downloading common files from the internet — anything you can think of.
• The EC2 User Data script runs with the root user.

Exam tip

Two details the exam checks: User Data runs once, on first boot only, and it runs as root (so no sudo needed in the script).

Real-world example

The course’s hands-on launches a Linux instance from the AWS Console and installs a web server purely through EC2 User Data — so the instance is serving a page the moment it finishes booting, with nobody logging in.

4. Instance types

You can use different types of EC2 instances optimised for different use cases. The AWS naming convention:

m5.2xlarge
 │ │  └── size within the instance class
 │ └───── generation (AWS improves them over time)
 └─────── instance class

General Purpose

• Great for a diversity of workloads such as web servers or code repositories.
• A balance between compute, memory and networking.
• The course uses t2.micro, which is a General Purpose instance.

Compute Optimized

Great for compute-intensive tasks that require high performance processors:

• Batch processing workloads
• Media transcoding
• High performance web servers
• High performance computing (HPC)
• Scientific modeling and machine learning
• Dedicated gaming servers

Memory Optimized

Fast performance for workloads that process large data sets in memory:

• High performance relational / non-relational databases
• Distributed web scale cache stores
• In-memory databases optimized for BI (business intelligence)
• Applications performing real-time processing of big unstructured data

Storage Optimized

Great for storage-intensive tasks that require high, sequential read and write access to large data sets on local storage:

• High frequency online transaction processing (OLTP) systems
• Relational and NoSQL databases
• Cache for in-memory databases (for example, Redis)
• Data warehousing applications
• Distributed file systems

Examples

Instance	vCPU	Mem (GiB)	Storage	Network Performance	EBS Bandwidth (Mbps)
t2.micro	1	1	EBS-Only	Low to Moderate
t2.xlarge	4	16	EBS-Only	Moderate
c5d.4xlarge	16	32	1 x 400 NVMe SSD	Up to 10 Gbps	4,750
r5.16xlarge	64	512	EBS Only	20 Gbps	13,600
m5.8xlarge	32	128	EBS Only	10 Gbps	6,800

Exam tip

Match the family to the keyword in the scenario: “in-memory database” → Memory Optimized; “media transcoding” / “HPC” → Compute Optimized; “high sequential read/write on local storage”, “data warehouse” → Storage Optimized; anything generic like a web server → General Purpose. These lists evolve, so the exam tests the category, not the specific instance names.

5. Security Groups

Security Groups are the fundamental of network security in AWS. They control how traffic is allowed into or out of your EC2 instances.

• Security groups only contain allow rules.
• Security group rules can reference by IP or by security group.

They act as a “firewall” on EC2 instances, regulating:

• Access to ports
• Authorised IP ranges — IPv4 and IPv6
• Control of inbound network traffic (from others to the instance)
• Control of outbound network traffic (from the instance to others)

Good to know

• Can be attached to multiple instances.
• Locked down to a Region / VPC combination.
• Live “outside” the EC2 — if traffic is blocked, the EC2 instance never sees it.
• It’s good practice to maintain one separate security group for SSH access.
• If your application is not accessible (time out) → it’s a security group issue.
• If your application gives a “connection refused” error → it’s an application error, or the application isn’t launched.
• All inbound traffic is blocked by default.
• All outbound traffic is authorised by default.

Referencing other security groups

A security group’s inbound rule can authorise another security group instead of an IP range. In the deck’s diagram, Security Group 1 authorises both Security Group 1 and Security Group 2 on port 123: instances carrying either of those groups get through, while an instance carrying Security Group 3 is refused — no matter what its IP is.

Exam tip

The timeout vs connection refused distinction is a favourite. Timeout = security group. Connection refused = the app itself. Also remember the defaults: inbound blocked, outbound allowed.

6. Classic ports to know

Port	Protocol	Purpose
22	SSH (Secure Shell)	Log into a Linux instance
21	FTP (File Transfer Protocol)	Upload files into a file share
22	SFTP (Secure File Transfer Protocol)	Upload files using SSH
80	HTTP	Access unsecured websites
443	HTTPS	Access secured websites
3389	RDP (Remote Desktop Protocol)	Log into a Windows instance

Exam tip

Memorize this table outright — it reappears across the networking and security chapters. Note that SSH and SFTP share port 22 (SFTP runs over SSH), and that 3389 is Windows RDP while 22 is Linux SSH.

7. Connecting to your instance

Your machine	How you connect
Mac	SSH
Linux	SSH
Windows < 10	Putty
Windows ≥ 10	SSH
Any	EC2 Instance Connect

On Linux / Mac OS X, SSH lets you control a remote machine entirely from the command line, connecting to the instance’s public IP on port 22. You can configure OpenSSH’s ~/.ssh/config to make repeated connections easier. On Windows, the free tool Putty does the same job with the required parameters configured in its GUI.

EC2 Instance Connect

• Connect to your EC2 instance within your browser.
• No need to use the key file that was downloaded.
• The “magic”: a temporary key is uploaded onto EC2 by AWS.
• Works out-of-the-box only with Amazon Linux 2.
• Port 22 must still be open!

Real-world example

The deck’s own advice on SSH trouble: re-watch the lecture, read the troubleshooting guide, then try EC2 Instance Connect. If any one method works — SSH, Putty or Instance Connect — you’re fine.

8. EC2 purchasing options

There are seven, and they are heavily tested:

• On-Demand Instances — short workload, predictable pricing, pay by second
• Reserved Instances (1 & 3 years) — long workloads
• Convertible Reserved Instances (1 & 3 years) — long workloads with flexible instances
• Savings Plans (1 & 3 years) — commitment to an amount of usage, long workload
• Spot Instances — short workloads, cheap, can lose instances (less reliable)
• Dedicated Hosts — book an entire physical server, control instance placement
• Dedicated Instances — no other customers will share your hardware
• Capacity Reservations — reserve capacity in a specific AZ for any duration

On-Demand

• Pay for what you use: Linux or Windows — billing per second, after the first minute; all other operating systems — billing per hour.
• Highest cost but no upfront payment, and no long-term commitment.
• Recommended for short-term and un-interrupted workloads where you can’t predict how the application will behave.

Reserved Instances

• Up to 72% discount compared to On-Demand.
• You reserve specific instance attributes: Instance Type, Region, Tenancy, OS.
• Reservation period — 1 year (+discount) or 3 years (+++discount).
• Payment options — No Upfront (+), Partial Upfront (++), All Upfront (+++).
• Scope — Regional or Zonal (reserve capacity in an AZ).
• Recommended for steady-state usage applications (think database).
• You can buy and sell in the Reserved Instance Marketplace.
• Convertible Reserved Instance — can change the EC2 instance type, instance family, OS, scope and tenancy; up to 66% discount.

Savings Plans

• Discount based on long-term usage — up to 72%, same as Reserved Instances.
• Commit to a certain type of usage (e.g. $10/hour for 1 or 3 years).
• Usage beyond the Savings Plan is billed at the On-Demand price.
• Locked to a specific instance family and AWS Region (e.g. M5 in us-east-1).
• Flexible across: instance size (m5.xlarge, m5.2xlarge), OS (Linux, Windows), tenancy (Host, Dedicated, Default).

Spot Instances

• Discount of up to 90% compared to On-Demand — the most cost-efficient instances in AWS.
• Instances you can “lose” at any point in time if your max price is less than the current spot price.
• Useful for workloads resilient to failure: batch jobs, data analysis, image processing, any distributed workload, workloads with a flexible start and end time.
• Not suitable for critical jobs or databases.

Dedicated Hosts

• A physical server with EC2 instance capacity fully dedicated to your use.
• Lets you address compliance requirements and use your existing server-bound software licenses (per-socket, per-core, per-VM).
• Purchasing options: On-Demand (pay per second for an active Dedicated Host) or Reserved for 1 or 3 years (No Upfront, Partial Upfront, All Upfront).
• The most expensive option.
• Useful for software with a complicated licensing model (BYOL — Bring Your Own License), or for companies with strong regulatory or compliance needs.

Dedicated Instances

• Instances run on hardware that’s dedicated to you.
• May share hardware with other instances in the same account.
• No control over instance placement — hardware can move after a Stop / Start.

Capacity Reservations

• Reserve On-Demand instance capacity in a specific AZ for any duration.
• You always have access to EC2 capacity when you need it.
• No time commitment (create/cancel anytime), no billing discounts.
• Combine with Regional Reserved Instances and Savings Plans to get billing discounts.
• You’re charged at the On-Demand rate whether you run instances or not.
• Suitable for short-term, uninterrupted workloads that need to be in a specific AZ.

Real-world example

The deck’s resort analogy: On-Demand = come and stay whenever you like, full price. Reserved = plan ahead for a long stay and get a discount. Savings Plans = pay a set amount per hour for a period and stay in any room type. Spot = the hotel auctions empty rooms to the highest bidder, and you can be kicked out at any time. Dedicated Hosts = you book an entire building. Capacity Reservations = you book a room for a period at full price even if you never sleep in it.

Price comparison — m4.large in us-east-1

Price type	Price (per hour)
On-Demand	$0.10
Spot Instance (Spot price)	$0.038 – $0.039 (up to 61% off)
Reserved Instance (1 year)	$0.062 (No Upfront) – $0.058 (All Upfront)
Reserved Instance (3 years)	$0.043 (No Upfront) – $0.037 (All Upfront)
EC2 Savings Plan (1 year)	$0.062 (No Upfront) – $0.058 (All Upfront)
Reserved Convertible Instance (1 year)	$0.071 (No Upfront) – $0.066 (All Upfront)
Dedicated Host	On-Demand price
Dedicated Host Reservation	Up to 70% off
Capacity Reservations	On-Demand price

Exam tip

The exact percentages change over time and are not needed for the exam — the deck says so explicitly. What is needed is the ranking and the use case: Spot is cheapest and interruptible, Dedicated Host is most expensive and for licensing/compliance, Reserved and Savings Plans are for steady long-running workloads, and Capacity Reservations give you capacity but no discount.

Also keep Dedicated Hosts vs Dedicated Instances straight: the Host gives you a whole physical server and control over instance placement; Dedicated Instances only guarantee that no other customer shares your hardware.

9. Shared Responsibility Model for EC2

AWS	You
Infrastructure (global network security)	Security Groups rules
Isolation on physical hosts	Operating-system patches and updates
Replacing faulty hardware	Software and utilities installed on the EC2 instance
Compliance validation	IAM Roles assigned to EC2 and IAM user access management
	Data security on your instance

Exam tip

OS patching on EC2 is the customer’s job. That is the classic trap — people assume a managed cloud means AWS patches the guest OS. It does not, for EC2.

Quick recap

Concept	What to remember for the exam
EC2 instance	AMI (OS) + instance size (CPU + RAM) + storage + security groups + EC2 User Data
Security Groups	Firewall attached to the instance; allow rules only; inbound blocked and outbound allowed by default; locked to a Region/VPC
Timeout vs refused	Timeout → security group issue; connection refused → application error or not launched
EC2 User Data	Script launched at the first start of an instance, runs as root
Instance families	General Purpose · Compute Optimized · Memory Optimized · Storage Optimized; naming is class + generation + size (m5.2xlarge)
Classic ports	22 SSH/SFTP · 21 FTP · 80 HTTP · 443 HTTPS · 3389 RDP
SSH	Terminal into an instance on port 22; EC2 Instance Connect does it in the browser (Amazon Linux 2, port 22 still needed)
EC2 Instance Role	Gives the instance permissions to call AWS, via IAM roles
Purchasing options	On-Demand · Reserved (Standard + Convertible) · Savings Plans · Spot · Dedicated Host · Dedicated Instance · Capacity Reservations
Spot	Up to 90% off, can be reclaimed any time — never for critical jobs or databases
Dedicated Host	Entire physical server, BYOL and compliance, control over placement, most expensive
Shared responsibility	AWS: hardware, host isolation, compliance. You: security group rules, OS patching, installed software, IAM roles, data