/ec2

name: ec2
description: >
  AWS EC2 virtual machine management — instances, security groups, key pairs, AMIs, EBS volumes,
  Auto Scaling Groups, Spot Instances, Session Manager, placement groups, and instance lifecycle automation.

  Trigger on ANY of these, even when EC2 isn't named explicitly:
  - Launching or provisioning: "spin up a server", "create a VM", "new instance", "run-instances", mention of instance types (t3, m5, c5, r6, g5, p4d, t4g, c7g, etc.)
  - SSH / connectivity problems: "connection refused", "connection timed out", "permission denied publickey", "can't connect to my instance", "SSH not working"
  - Instance management: resize, stop, start, terminate, reboot, change instance type
  - Cost optimization: stop dev instances overnight, save money on EC2, spot vs on-demand, reserved instances
  - Auto Scaling: ASG, launch template, mixed instances policy, scale to zero, scheduled scaling
  - Spot Instances: spot fleet, spot interruption, capacity-optimized, price-capacity-optimized
  - AMIs and backups: create image, custom AMI, EBS snapshot, DLM lifecycle policy, copy AMI
  - Monitoring: EC2 CPU utilization, CloudWatch metrics for instance, instance status checks, console output
  - Access methods: Session Manager, EC2 Instance Connect, bastion host, port forwarding
  - Security: IMDSv2, instance metadata, IAM role on instance, security group rules
  - User data and bootstrap scripts, cloud-init
last_updated: "2026-05-12"
doc_source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/

AWS EC2

Amazon Elastic Compute Cloud (EC2) provides resizable compute capacity in the cloud.

**Advanced patterns** (Auto Scaling, Spot Fleets, Session Manager, Instance Connect, IMDS, Placement Groups, scheduled scaling): see [instance-management.md](instance-management.md).

Table of Contents

• [Core Concepts](#core-concepts)
• [Common Patterns](#common-patterns)
• [CLI Reference](#cli-reference)
• [Best Practices](#best-practices)
• [Troubleshooting](#troubleshooting)
• [References](#references)

Core Concepts

Instance Types

| Category | Example | Use Case | |----------|---------|----------| | General Purpose | t3, m6i, t4g (Graviton) | Web servers, dev environments | | Compute Optimized | c6i, c7g (Graviton) | Batch processing, gaming | | Memory Optimized | r6i, r7g (Graviton) | Databases, caching | | Storage Optimized | i3, d3 | Data warehousing | | Accelerated | p4d, g5 | ML, graphics |

Graviton (ARM) instances (t4g, m7g, c7g, r7g) are ~20% cheaper than x86 equivalents for the same performance — worth considering for new workloads.

Purchasing Options

| Option | Description | |--------|-------------| | On-Demand | Pay by the hour/second | | Reserved | 1-3 year commitment, up to 72% discount | | Spot | Unused capacity, up to 90% discount — can be interrupted with 2-minute notice | | Savings Plans | Flexible commitment-based discount |

AMI (Amazon Machine Image)

Template containing OS, software, and configuration for launching instances. Use SSM Parameter Store to look up the latest official AMIs rather than hardcoding IDs:

# Latest Amazon Linux 2 AMI
aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2 \
  --query 'Parameter.Value' --output text

# Latest Amazon Linux 2023
aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query 'Parameter.Value' --output text

# Latest Ubuntu 22.04
aws ssm get-parameter \
  --name /aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id \
  --query 'Parameter.Value' --output text

Security Groups

Virtual firewalls controlling inbound and outbound traffic. Changes take effect immediately — no restart required.

Common Patterns

Launch an Instance

# Create key pair
aws ec2 create-key-pair \
  --key-name my-key \
  --query 'KeyMaterial' \
  --output text > my-key.pem
chmod 400 my-key.pem

# Create security group
aws ec2 create-security-group \
  --group-name web-server-sg \
  --description "Web server security group" \
  --vpc-id vpc-12345678

# Allow SSH and HTTP
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 22 \
  --cidr 10.0.0.0/8

aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

# Launch instance
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type t3.micro \
  --key-name my-key \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-12345678 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-server}]'

# Wait until running, then get IP
aws ec2 wait instance-running --instance-ids i-1234567890abcdef0
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query 'Reservations[].Instances[].PublicIpAddress' --output text

**boto3:**

import boto3

ec2 = boto3.resource('ec2')

instances = ec2.create_instances(
    ImageId='ami-0123456789abcdef0',
    InstanceType='t3.micro',
    KeyName='my-key',
    SecurityGroupIds=['sg-12345678'],
    SubnetId='subnet-12345678',
    MinCount=1,
    MaxCount=1,
    TagSpecifications=[{
        'ResourceType': 'instance',
        'Tags': [{'Key': 'Name', 'Value': 'web-server'}]
    }]
)

instance = instances[0]
instance.wait_until_running()
instance.reload()
print(f"Instance ID: {instance.id}")
print(f"Public IP: {instance.public_ip_address}")

User Data Script

> **OS package manager note:** > - **Amazon Linux 2**: use `amazon-linux-extras install nginx1 -y` — `yum install nginx` fails because nginx is not in the default AL2 repos > - **Amazon Linux 2023**: use `dnf install -y nginx` > - **Ubuntu**: use `apt-get install -y nginx` > - **Amazon Linux 2 / RHEL**: `httpd` (Apache) is always available via `yum install -y httpd`

# Amazon Linux 2 — nginx via amazon-linux-extr