EC2 Instances

AWS EC2 provides virtual machines in the cloud organized into families based on workload characteristics. General Purpose (M/T series) balances compute, memory, and networking for web servers and development environments. Compute Optimized (C series) delivers high-performance processors for batch processing and gaming. Memory Optimized (R/X series) provides large RAM for in-memory caches and real-time analytics. Storage Optimized (I/D series) offers high sequential read/write for databases and data warehouses. Accelerated Computing (P/G series) includes GPUs for machine learning and HPC.

Each family has generations (e.g., m5, m6i) with improving price-performance. Instance sizes scale from nano (vCPU) to metallic (bare metal). When selecting, consider your dominant resource need: CPU-bound workloads favor compute-optimized while data-intensive applications benefit from storage-optimized instances.

An Amazon Machine Image (AMI) is a template containing the OS, software, and configuration for launching instances. AWS provides Quick Start AMIs (Amazon Linux, Ubuntu, Windows), Marketplace AMIs from vendors, and custom AMIs you create. Always use the latest generation AMIs for better security patches.

Key pairs provide secure SSH access. AWS stores the public key; you keep the private key (.pem file). For Windows instances, the key pair retrieves the administrator password. Lose your private key and you lose access to your instance.

Security groups act as virtual firewalls controlling inbound and outbound traffic. They are stateful—responses to allowed inbound traffic are automatically permitted. A best practice is to use the principle of least privilege: allow SSH only from your IP (not 0.0.0.0/0), allow HTTP only from an ALB security group, and deny all unnecessary traffic. Each instance can have up to 5 security groups attached.

EC2 offers five pricing models to optimize costs. On-Demand charges per second with no commitment—ideal for unpredictable workloads or development. Reserved Instances (RI) commit to 1 or 3 years for up to 75% savings, best for steady-state workloads like production databases.

Savings Plans offer flexible pricing in exchange for a consistent hourly spend (e.g., $10/hour for 3 years) across instance families and regions—more flexible than RIs. Spot Instances use unused capacity at up to 90% discount but can be interrupted with 2 minutes notice. Spot is perfect for batch jobs, CI/CD pipelines, and fault-tolerant workloads.

Dedicated Hosts are physical servers dedicated to your organization, required for licensing that ties to physical sockets. For most workloads, a combination of Savings Plans for baseline and Spot for burst capacity provides optimal cost efficiency. Monitor your usage with Cost Explorer and right-size instances based on actual utilization.

User data scripts run at instance launch—perfect for installing software, joining domains, or bootstrapping applications. Pass a bash script or cloud-init directive to automate setup without manual SSH access.

Instance metadata (http://169.254.169.254/latest/meta-data/) provides dynamic information like instance ID, public IP, and IAM role credentials. Use the metadata service to avoid hardcoding credentials in your application code. IMDSv2 adds session-based protection against SSRF attacks.

Placement groups control instance placement for performance. Cluster placement packs instances close together in a single AZ for ultra-low latency (HPC, MPI). Spread placement places instances on distinct hardware for critical applications requiring high availability. Partition placement divides an AZ into logical segments for large distributed workloads like HDFS or Kafka where you want partition-level fault isolation.