Amazon EC2

AWS CLF-C02 — Domain 3: Cloud Technology & Services

EC2 Overview

EC2 = Elastic Compute Cloud — the most popular AWS service for compute
Provides resizable virtual servers (instances) in the cloud
It's an IaaS (Infrastructure as a Service) offering
You can choose the OS (Linux, Windows, macOS), CPU, RAM, storage, and networking
You have full control over the guest operating system
You are responsible for patching the OS, installing software, and configuring security

Key Point:

EC2 is IaaS. You manage the OS and everything above it. AWS manages the physical hardware, hypervisor, and networking infrastructure beneath.

EC2 Instance Types

Naming Convention

Example: m5.2xlarge

m = Instance family (General Purpose)
5 = Generation (5th generation)
2xlarge = Size within the instance family

Family	Optimized For	Example Types	Use Cases
General Purpose	Balance of compute, memory, networking	`t2`, `t3`, `m5`, `m6i`	Web servers, code repositories, small/mid databases, dev environments
Compute Optimized	High-performance processors	`c5`, `c6i`, `c6g`	Batch processing, media transcoding, HPC, ML inference, gaming servers
Memory Optimized	Large datasets in memory	`r5`, `r6i`, `x1`, `x2idn`	In-memory databases (Redis, Memcached), real-time big data analytics
Storage Optimized	High sequential read/write to local storage	`i3`, `i3en`, `d2`, `h1`	Data warehousing, distributed file systems, high-frequency OLTP
Accelerated Computing	Hardware accelerators / GPUs	`p3`, `p4d`, `g4dn`, `g5`	Machine learning training, graphics rendering, video processing

Exam Tip:

Remember the first letter: T/M = General, C = Compute, R/X = Memory (RAM), I/D = Storage (I/O), P/G = Accelerated (GPU). The exam won't ask for specific instance specs but will test which family fits a use case.

Security Groups

Security Groups act as a virtual firewall for your EC2 instances to control inbound and outbound traffic.

Key Characteristics

Stateful: If you allow inbound traffic, the response traffic is automatically allowed outbound (and vice versa)
Contain only ALLOW rules — you cannot create deny rules
Rules reference IP addresses or other security groups
Can be attached to multiple instances
An instance can have multiple security groups
Region/VPC-scoped — locked to a Region & VPC combination
All inbound traffic is blocked by default
All outbound traffic is allowed by default
Changes take effect immediately

Feature	Security Groups	Network ACLs (for comparison)
Level	Instance level	Subnet level
Rules	Allow only	Allow and Deny
State	Stateful	Stateless
Evaluation	All rules evaluated	Rules processed in order

Exam Tip:

If an application on EC2 is not reachable, the first thing to check is the Security Group rules. A "timeout" error usually means a security group issue. A "connection refused" error means the application itself has an issue.

EC2 Purchasing Options

Option	Commitment	Discount	Best For
On-Demand	None — pay by the second (Linux) or hour (Windows)	0% (full price)	Short-term, unpredictable workloads; no upfront payment
Reserved Instances (RI)	1 year or 3 years	Up to 72%	Steady-state usage (databases, web servers that run 24/7)
Convertible Reserved	1 year or 3 years	Up to 66%	Long-term but may need to change instance type/family/OS
Savings Plans	1 year or 3 years ($/hr commitment)	Up to 72%	Flexible across instance sizes, OS, tenancy; commit to $/hr spend
Spot Instances	None	Up to 90%	Fault-tolerant, flexible workloads (batch, data analysis, image processing)
Dedicated Hosts	None or Reserved	Varies	Regulatory/compliance needs, bring your own server-bound licenses (BYOL)
Dedicated Instances	None	Varies	Instances running on hardware dedicated to you (no control over placement)
Capacity Reservations	None — reserve capacity in a specific AZ	0% (On-Demand price)	Guarantee capacity is available when you need it

Key Point:

Spot Instances can be interrupted by AWS with a 2-minute warning. Never use Spot for critical or stateful workloads. Dedicated Hosts give you access to the physical server and let you use per-socket or per-core licenses.

Exam Tip:

"Which option provides the highest discount?" → Spot Instances (up to 90%). "Which option is best for compliance with server-bound software licenses?" → Dedicated Hosts. "Which option is best for steady-state workloads?" → Reserved Instances or Savings Plans.

Connecting to EC2 Instances

SSH (Secure Shell)

Used to connect to Linux instances from your terminal
Requires port 22 to be open in the Security Group
Uses a key pair (.pem file) for authentication
Command: ssh -i key.pem ec2-user@public-ip

EC2 Instance Connect

Connect to your instance from the browser using the AWS Console
No need to manage SSH keys — AWS generates a temporary key
Still requires port 22 to be open
Works only with Amazon Linux 2 and Ubuntu

Other Connection Methods

RDP (Remote Desktop Protocol): Connect to Windows instances (port 3389)
Systems Manager Session Manager: Connect without opening any ports (no SSH key needed, no port 22)

Exam Tip:

"How to connect to an EC2 instance without opening port 22?" → AWS Systems Manager Session Manager. This is more secure because no inbound ports need to be open.

EC2 User Data (Bootstrap Scripts)

A script that runs only once when the instance first starts (at launch)
Used to automate boot tasks such as:
- Installing software updates
- Installing packages and applications
- Downloading files from the Internet
- Starting services
Runs with root user privileges
The more you add to user data, the longer the instance takes to boot

Key Point:

User data scripts run as root and only execute on the first boot of the instance. They are commonly used to install web servers, pull code from repositories, or configure the environment.

EC2 Key Pairs

Used for SSH authentication to Linux instances
Consist of a public key (stored by AWS on the instance) and a private key (downloaded by you)
Supported formats: RSA and ED25519
The private key file (.pem) must be kept secure — if lost, you cannot retrieve it
You can create key pairs in the EC2 console or import your own
File permissions must be set to 400 (chmod 400 key.pem) on Linux/Mac

Exam Tip:

If you lose your private key, you cannot SSH into the instance using that key pair. You would need to use EC2 Instance Connect, Session Manager, or create a new key pair and update the instance.