Amazon EC2 – Basics

1. What Amazon EC2 is

EC2 (Elastic Compute Cloud) is one of AWS’s most popular offerings, and it is the textbook example of Infrastructure as a Service. Rather than one feature, it is really a bundle of four capabilities that together let you run a workload the way you would in your own data center:

• Renting virtual machines — EC2 itself.
• Storing data on virtual drives — EBS.
• Distributing load across machines — ELB.
• Scaling the service up and down — Auto Scaling Groups (ASG).

Knowing EC2 is fundamental to understanding how the cloud works, which is why the deck spends several sections on it before touching anything else. Every later chapter — load balancing, databases, containers — assumes you can picture an EC2 instance.

2. Sizing and configuration options

When you launch an instance you are really choosing a set of dials:

Dial	What you pick
Operating System	Linux, Windows or Mac OS
Compute	How much CPU power and how many cores
Memory	How much RAM
Storage	Network-attached (EBS and EFS) or hardware-attached (EC2 Instance Store)
Network card	The speed of the card, and whether the instance gets a public IP address
Firewall rules	The security group
Bootstrap script	EC2 User Data, run at first launch

The split between network-attached and hardware-attached storage is the one that resurfaces later — see EC2 Instance Storage.

3. EC2 User Data

You can bootstrap an instance with an EC2 User Data script. Bootstrapping just means running commands when the machine starts, and User Data is where you put those commands.

The critical property: the script runs only once, at the instance’s very first start. Reboot the instance later and it does not run again.

Typical boot tasks people automate this way:

• Installing updates.
• Installing software.
• Downloading common files from the internet.
• Anything else you can express as shell commands.

One more detail with security consequences: the EC2 User Data script runs as the root user. You do not need sudo inside it, and anything it does has full privileges on the machine.

Exam tip

Two facts get tested constantly: User Data runs once, on first boot only, and it runs as root. If a question describes a command that must run on every restart, User Data is the wrong answer.

4. Instance type families

AWS offers many EC2 instance types, each optimized for a different kind of work. The naming convention is consistent and worth decoding — take m5.2xlarge:

• m — the instance class.
• 5 — the generation; AWS improves each class over time.
• 2xlarge — the size within that class.

General Purpose

Good for a diversity of workloads, such as web servers or code repositories. They strike a balance between compute, memory and networking. The course’s working example is t2.micro, a General Purpose instance.

Compute Optimized

Built for compute-intensive tasks that need high-performance processors:

• Batch processing workloads.
• Media transcoding.
• High-performance web servers.
• High performance computing (HPC).
• Scientific modeling and machine learning.
• Dedicated gaming servers.

Memory Optimized

Fast performance for workloads that process large data sets in memory:

• High-performance relational and non-relational databases.
• Distributed web-scale cache stores.
• In-memory databases optimized for business intelligence (BI).
• Applications doing real-time processing of large volumes of unstructured data.

Storage Optimized

For storage-heavy work that has to push large data sets through local disks with sustained sequential reads and writes:

• High-frequency online transaction processing (OLTP) systems.
• Relational and NoSQL databases.
• Cache for in-memory databases, for example Redis.
• Data warehousing applications.
• Distributed file systems.

Some concrete examples

Instance	vCPU	Mem (GiB)	Storage	Network performance	EBS bandwidth (Mbps)
t2.micro	1	1	EBS-Only	Low to Moderate
t2.xlarge	4	16	EBS-Only	Moderate
c5d.4xlarge	16	32	1 x 400 NVMe SSD	Up to 10 Gbps	4,750
r5.16xlarge	64	512	EBS-Only	20 Gbps	13,600
m5.8xlarge	32	128	EBS-Only	10 Gbps	6,800

The deck also points to instances.vantage.sh as a convenient comparison site.

Exam tip

You are not asked to memorize vCPU or RAM figures. You are asked to map a described workload onto a family: an in-memory database points at Memory Optimized, media transcoding at Compute Optimized, a data warehouse with heavy sequential local I/O at Storage Optimized, and an ordinary web server at General Purpose.

5. Security Groups

Network security in AWS rests on Security Groups. They decide which traffic reaches your EC2 instances and which traffic may leave them, behaving like a “firewall” placed in front of the instance.

What a security group regulates:

• Access to ports.
• Authorised IP ranges — both IPv4 and IPv6.
• Inbound traffic — from the outside world to the instance.
• Outbound traffic — from the instance to the outside world.

Two structural points: security groups only contain rules (there is nowhere to put anything else), and rules can reference either an IP range or another security group.

Things to remember

The deck’s “good to know” list is dense with exam answers:

• A security group can be attached to multiple instances.
• It is locked down to a Region / VPC combination — it does not follow you across Regions.
• It lives outside the EC2 instance: if traffic is blocked, the instance never even sees it.
• It is good practice to maintain one separate security group just for SSH access.
• All inbound traffic is blocked by default.
• All outbound traffic is authorised by default.

Referencing another security group

Instead of writing IP ranges, an inbound rule can name another security group. Picture an instance with Security Group 1 attached, whose inbound rule on port 123 authorises Security Group 1 and Security Group 2. Any instance carrying either of those groups can reach port 123, whatever its IP address is; an instance carrying only Security Group 3 is refused.

Real-world example

Your load balancer sits in one security group and your application servers in another. Rather than tracking the load balancer’s changing IPs, the app servers’ inbound rule simply authorises the load balancer’s security group. Instances can come and go, and the rule never needs editing.

Exam tip

The troubleshooting pair shows up almost verbatim in questions: if the application is unreachable and the connection times out, it is a security group issue. If the application returns “connection refused”, the traffic got through and the problem is the application itself — an error, or it simply is not running.

6. Classic ports to know

Port	Protocol	Use
22	SSH (Secure Shell)	Log into a Linux instance
21	FTP (File Transfer Protocol)	Upload files into a file share
22	SFTP (Secure File Transfer Protocol)	Upload files over SSH
80	HTTP	Access unsecured web sites
443	HTTPS	Access secured web sites
3389	RDP (Remote Desktop Protocol)	Log into a Windows instance

Exam tip

Note that SFTP shares port 22 with SSH, because it is SSH carrying files — while plain FTP is a different protocol on port 21. The other easy confusion is 22 versus 3389: 22 for Linux, 3389 for Windows.

7. Connecting to an EC2 instance

SSH is the workhorse: it lets you control a remote machine entirely from the command line, over port 22 to the instance’s public IP. How you get there depends on your desktop:

Your machine	Tool
Mac	SSH
Linux	SSH
Windows < 10	Putty
Windows >= 10	SSH
Any	EC2 Instance Connect

On Mac and Linux you can configure OpenSSH’s ~/.ssh/config to make connecting to your instances less tedious. On older Windows you use the free Putty tool, configuring the required parameters there instead.

The deck is candid that SSH is where learners hit the most problems, and its advice is pragmatic: rewatch the instructions, read the troubleshooting guide, then try EC2 Instance Connect. If any one of the three methods works, you are fine.

EC2 Instance Connect

EC2 Instance Connect lets you connect to your instance from within the browser, with no need for the key file you downloaded. The trick behind it is that AWS uploads a temporary key onto the instance for the session.

Two constraints: it works out of the box only with Amazon Linux 2, and port 22 still has to be open in the security group.

Exam tip

“No key file needed” does not mean “no port 22 needed”. EC2 Instance Connect still requires inbound 22 to be allowed — the connection is ordinary SSH, just initiated from AWS’s side with a temporary key.

8. The EC2 purchasing options

There are seven ways to pay for EC2 capacity, and picking the right one for a described workload is a recurring exam task:

Option	In one line
On-Demand Instances	Short workload, predictable pricing, pay by the second
Reserved (1 and 3 years)	Reserved Instances for long workloads; Convertible Reserved Instances for long workloads that need flexible instances
Savings Plans (1 and 3 years)	Commit to an amount of usage, long workload
Spot Instances	Short workloads, cheap, you can lose the instance (less reliable)
Dedicated Hosts	Book an entire physical server, control instance placement
Dedicated Instances	No other customer shares your hardware
Capacity Reservations	Reserve capacity in a specific AZ for any duration

9. The options in detail

EC2 On Demand

You pay only for the time you actually use. Linux and Windows are metered per second once the first minute has passed; every other operating system is metered per hour. Nothing is paid in advance and nothing is committed to, but the hourly rate is the highest of all the options — which is why AWS points it at short-lived workloads that must not be interrupted and whose behavior you cannot predict yet.

EC2 Reserved Instances

Up to 72% discount compared to On-Demand, in exchange for reserving specific instance attributes: instance type, Region, tenancy and OS.

• Reservation period: 1 year (discount) or 3 years (bigger discount).
• Payment options: No Upfront, Partial Upfront, or All Upfront — each step increasing the discount.
• Scope: Regional, or Zonal, which reserves capacity in a specific AZ.
• Recommended for steady-state usage applications; a database is the canonical example.
• You can buy and sell reservations in the Reserved Instance Marketplace.

The Convertible Reserved Instance is the flexible variant: you can change the instance type, instance family, OS, scope and tenancy later, for a smaller discount of up to 66%.

About the percentages

The deck notes that AWS changes these discount percentages over time and that the exact numbers are not needed for the exam. What matters is the shape of the trade-off: the longer and firmer the commitment, the deeper the discount.

EC2 Savings Plans

A discount based on long-term usage, up to 72% — the same as Reserved Instances — but the commitment is expressed in money rather than instances: you commit to a certain amount of usage, such as $10/hour for 1 or 3 years. Anything you use beyond the plan is billed at the On-Demand price.

A Savings Plan is locked to a specific instance family and AWS Region (for example, M5 in us-east-1), but is flexible across:

• Instance size — m5.xlarge, m5.2xlarge and so on.
• OS — Linux, Windows.
• Tenancy — Host, Dedicated, Default.

EC2 Spot Instances

A discount of up to 90% compared to On-Demand, making these the most cost-efficient instances in AWS. The catch is in the definition: these are instances you can lose at any moment if your maximum price falls below the current spot price.

Good fits, because they tolerate interruption:

• Batch jobs.
• Data analysis.
• Image processing.
• Any distributed workload.
• Workloads with a flexible start and end time.

Bad fits: critical jobs and databases.

EC2 Dedicated Hosts

You take an entire physical server whose EC2 capacity is reserved for you and nobody else. Having the whole machine is what lets you satisfy compliance requirements and keep using server-bound software licenses — per-socket, per-core or per-VM.

• Purchasing options: On-Demand (pay per second for the active host) or Reserved for 1 or 3 years (No Upfront, Partial Upfront, All Upfront).
• It is the most expensive option.
• Useful for software with complicated licensing models — BYOL, Bring Your Own License — and for companies with strong regulatory or compliance needs.

EC2 Dedicated Instances

Instances that run on hardware dedicated to you, but the isolation is weaker than a Dedicated Host:

• They may share hardware with other instances in the same account.
• You have no control over instance placement, and the instance can move to different hardware after a Stop/Start.

EC2 Capacity Reservations

Reserve On-Demand instance capacity in a specific AZ for any duration, so that you always have access to EC2 capacity when you need it.

• No time commitment — create and cancel any time — and no billing discount.
• Combine with Regional Reserved Instances and Savings Plans if you want the discount as well.
• You are charged at the On-Demand rate whether you run instances or not.
• Suitable for short-term, uninterrupted workloads that must live in a specific AZ.

Choosing between the options

Option	How you obtain the capacity
On-Demand	Launch when you want, keep it as long as you want, pay the full rate for the time used
Reserved	Commit to 1 or 3 years of a given instance shape in exchange for a lower rate
Savings Plans	Commit to a fixed hourly spend for 1 or 3 years, usable across sizes, OSes and tenancies in the family
Spot Instances	Name a maximum price for spare capacity: the cheapest rate, but AWS can take the instance back
Dedicated Hosts	A whole physical server held for your account, with control over where instances land
Capacity Reservations	Hold capacity in one AZ so it is there when needed, at the On-Demand rate whether used or not

10. Price comparison

The deck’s worked example, an m4.large in us-east-1:

Price type	Price per hour
On-Demand	$0.10
Spot Instance (spot price)	$0.038 – $0.039 (up to 61% off)
Reserved Instance (1 year)	$0.062 (No Upfront) – $0.058 (All Upfront)
Reserved Instance (3 years)	$0.043 (No Upfront) – $0.037 (All Upfront)
EC2 Savings Plan (1 year)	$0.062 (No Upfront) – $0.058 (All Upfront)
Reserved Convertible Instance (1 year)	$0.071 (No Upfront) – $0.066 (All Upfront)
Dedicated Host	On-Demand price
Dedicated Host Reservation	Up to 70% off
Capacity Reservations	On-Demand price

Two things stand out. The 3-year All Upfront reservation is about a third of the On-Demand rate, and a Capacity Reservation costs exactly the On-Demand price — it buys certainty, not savings.

Exam tip

Watch the phrasing that selects an option. “Cannot be interrupted, unpredictable duration” leads to On-Demand; “steady state for years” to Reserved or Savings Plans; “fault-tolerant batch, cheapest possible” to Spot; “bring your own per-socket license” or “compliance requires a dedicated physical server” to Dedicated Hosts; “must be able to launch in a specific AZ whenever we need it” to Capacity Reservations.

11. Spot Instance Requests and Spot Fleets

Spot Instance Requests

You define a maximum spot price and you keep the instance while the current spot price stays below your maximum. The hourly spot price moves with supply and demand.

If the current spot price rises above your maximum, you can choose to stop or terminate your instance, and you get a 2-minute grace period to do so cleanly.

There is also Spot Block: you “block” a spot instance for a specified window of 1 to 6 hours without interruption, though in rare situations the instance may still be reclaimed.

Cancelling Spot Instances properly

The order of operations here is a favorite trap:

• You can only cancel Spot Instance requests that are open, active, or disabled.
• Cancelling a spot request does not terminate the instances.
• You must first cancel the spot request, then terminate the associated Spot Instances.

Exam tip

Get the sequence the right way round. Terminate the instances without cancelling the request and the request simply launches replacements; cancel the request and walk away and the running instances keep billing you.

Spot Fleets

A Spot Fleet is a set of Spot Instances plus, optionally, On-Demand Instances. The fleet tries to meet a target capacity within your price constraints, and it stops launching instances when it reaches that capacity or your maximum cost.

You define launch pools — combinations of instance type (say m5.large), OS and Availability Zone. Giving the fleet several pools lets it choose where to get capacity.

The allocation strategies:

Strategy	Behavior
lowestPrice	Take from the pool with the lowest price — cost optimization, short workloads
diversified	Spread across all pools — good for availability, long workloads
capacityOptimized	The pool with the optimal capacity for the number of instances requested
priceCapacityOptimized	Pools with the highest available capacity first, then the lowest price among them — recommended, and the best choice for most workloads

In short, Spot Fleets let you request Spot Instances automatically at the lowest price you can get.

Quick recap

Item	What to remember for the exam
EC2	IaaS: rent VMs (EC2), virtual drives (EBS), load balancing (ELB), scaling (ASG)
User Data	Bootstrap script, runs once at first boot, runs as root
Naming	m5.2xlarge = class m, generation 5, size 2xlarge
Families	General Purpose (balanced), Compute Optimized (CPU-heavy), Memory Optimized (big in-memory data), Storage Optimized (sequential local I/O)
Security Groups	Rules only; reference IPs or other security groups; attachable to many instances; bound to a Region/VPC; inbound blocked by default, outbound allowed by default
Troubleshooting	Timeout = security group; “connection refused” = application error or not running
Ports	22 SSH/SFTP, 21 FTP, 80 HTTP, 443 HTTPS, 3389 RDP
EC2 Instance Connect	Browser-based, temporary key uploaded by AWS, Amazon Linux 2 out of the box, port 22 still required
On-Demand	Highest cost, no commitment; per-second billing after the first minute on Linux/Windows, per hour otherwise
Reserved	Up to 72% off; reserve type/Region/tenancy/OS for 1 or 3 years; Regional or Zonal; sellable on the Marketplace; Convertible up to 66%
Savings Plans	Up to 72% off; commit to $/hour; locked to instance family and Region; flexible on size, OS, tenancy
Spot	Up to 90% off; lost when spot price exceeds your max, with a 2-minute grace period; never for critical jobs or databases
Dedicated Hosts	Whole physical server, BYOL and compliance, most expensive, On-Demand or 1/3-year reserved
Dedicated Instances	Dedicated hardware, may share with your own account’s instances, no placement control
Capacity Reservations	Capacity in a specific AZ, no commitment, no discount, charged at On-Demand whether used or not
Spot requests	Cancel the request first, then terminate the instances; Spot Block for 1–6 uninterrupted hours
Spot Fleet strategies	lowestPrice, diversified, capacityOptimized, priceCapacityOptimized (recommended)