Provisioning an EC2 Instance

EC2 gives you a virtual server. You choose the size, image, network, and firewall.

Syntaxaws ec2 run-instances --image-id AMI --instance-type t3.micro ...

An EC2 instance is a virtual machine in AWS. You pick an AMI (the disk image, e.g. Amazon Linux 2023), an instance type (size, e.g. t3.micro), a network, and a security group (firewall rules).

The core choices

  • AMI — the operating system and pre-installed software.
  • Instance type — CPU and memory. Start small; scale later.
  • Key pair — the SSH key you use to log in.
  • Security group — which ports are open (e.g. 22 for SSH, 443 for HTTPS).

Least-privilege firewalling

Open only the ports you truly need. Restrict SSH (port 22) to your own IP, not the whole internet. Public web traffic goes to 80/443, ideally through a load balancer rather than straight to the box.

Example

Example · bash
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --key-name my-ssh-key \
  --security-group-ids sg-0123456789 \
  --subnet-id subnet-0123456789 \
  --iam-instance-profile Name=app-server-role \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=app-prod}]'

When to use it

  • A backend team provisions an EC2 instance with a specific instance type and security group to host a PostgreSQL database that requires persistent storage.
  • A DevOps engineer launches a GPU instance (g4dn.xlarge) for a machine learning inference server that needs CUDA drivers.
  • A startup runs its Node.js API on a t3.small EC2 instance in a private subnet behind a load balancer for production.

More examples

Launch instance with key and SG

Launches a single t3.small instance with a name tag, keypair for SSH, and a security group controlling inbound traffic.

Example · bash
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t3.small \
  --key-name my-keypair \
  --security-group-ids sg-0abc1234 \
  --subnet-id subnet-0def5678 \
  --associate-public-ip-address \
  --count 1 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=api-server}]'

Create minimal security group

Creates a security group and opens only SSH and HTTPS ports, limiting the instance's attack surface.

Example · bash
# Allow SSH and HTTPS inbound
SG_ID=$(aws ec2 create-security-group \
  --group-name api-sg \
  --description 'API server SG' \
  --query 'GroupId' --output text)

aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp --port 22 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

Describe running instance details

Queries running instances by name tag and returns the instance ID, public IP, and type for verification.

Example · bash
aws ec2 describe-instances \
  --filters 'Name=tag:Name,Values=api-server' \
            'Name=instance-state-name,Values=running' \
  --query 'Reservations[*].Instances[*].[InstanceId,PublicIpAddress,InstanceType]' \
  --output table

Related

deploy user datadeploy systemddeploy elastic ip

Discussion

  • Be the first to comment on this lesson.
Provisioning an EC2 Instance — AWS Deployment | SoundsCode