What Is Amazon EC2? Instances, AMIs, EBS and Auto Scaling

Amazon EC2 (Elastic Compute Cloud) gives you virtual servers in the AWS Cloud, called instances, that you launch when you need them and pay instance time for only while they run. Every instance is built from the same few parts: an image to boot from, an instance type that sets its hardware, a security group that controls its traffic, a key pair for logging in, and storage for its data.

This guide is Amazon EC2 explained from the ground up. It covers each of those building blocks, what happens to your data and your bill when you stop or terminate an instance, how Auto Scaling groups keep the right number of instances running, and the services EC2 is normally used with. It ends with the pricing options and the traps the Cloud Practitioner (CLF-C02), Solutions Architect Associate (SAA-C03) and DevOps Engineer Professional (DOP-C02) exams set around EC2. The same material is drawn on a whiteboard in the video linked at the end.

What is Amazon EC2?

EC2 is AWS's service for renting compute capacity. You launch as many or as few instances as you need, scale up when traffic spikes, and scale back down when usage drops. Each instance is a virtual server: it has an operating system, CPUs, memory, storage and a network address, and you manage everything from the operating system up.

A simple way to picture it: imagine a huge warehouse of computers you can rent by the second. The AMI is the disk image already installed on the machine you pick. The instance type is the model, which decides how much processor and memory you get. You choose both, and the warehouse hands you the keys.

Launching an instance, step by step

The console's launch wizard asks for the parts in a fixed order, and it is a good checklist for what every instance needs:

1. A Region. Instances run in one Region, and the AMI must be available there.
2. An AMI. The image to boot from.
3. An instance type. The hardware profile.
4. A key pair. For logging in over SSH or retrieving a Windows password.
5. Network settings. The VPC, the subnet (and so the Availability Zone) and one or more security groups.
6. Storage. The AMI already brings a root volume; you can resize it or add more volumes.

When you launch, the instance moves from pending to running, and billing starts.

The building blocks of an EC2 instance

AMIs: the template

An Amazon Machine Image (AMI) holds the software needed to boot an instance, the operating system plus anything installed on top, and a block device mapping that says which volumes to attach. You can use an AMI provided by AWS, a public AMI, one another account has shared with you, or one bought from AWS Marketplace. You can also create your own from a configured instance, which is how teams build a "golden image" so every new server starts identical.

An AMI is a Regional resource. To launch from it in another Region, copy it there first. Teams that build golden images regularly often automate this; a DevOps practice question on an EC2 Image Builder pipeline covers that pattern.

Instance types and how to read their names

The instance type sets the hardware: CPU, memory, storage and networking capacity. The names look cryptic but follow a pattern of series, generation, options and size. Take m7g.large:

• m is the series, general purpose.
• 7 is the generation.
• g is an option letter meaning an AWS Graviton processor.
• large is the size.

The series letters worth knowing (the full scheme is in AWS's instance type naming conventions):

• M: general purpose
• C: compute optimized
• R: memory optimized
• I: storage optimized
• P: GPU accelerated
• T: burstable

Other option letters: a means AMD and i means Intel processors, d means the type comes with instance store volumes, and n means extra network and EBS performance. So a c7gd is a compute-optimized, seventh-generation Graviton type with local instance store disks.

Security groups: the instance's firewall

Every instance sits behind at least one security group, a virtual firewall that controls traffic reaching and leaving it. There is no extra charge for them. Their rules behave in ways the exams test directly:

• Allow rules only. You can't write a deny rule in a security group.
• Default behaviour of a new group: no inbound rules, so all inbound traffic is denied, and one rule allowing all outbound traffic.
• Stateful. If a request is allowed in, the response is allowed out automatically, whatever the outbound rules say.
• Groups can reference groups. A rule's source can be another security group instead of an IP range. That is how you let only the web tier reach the database tier, without tracking IP addresses as instances come and go.

A Cloud Practitioner question on security group references and its SAA-C03 counterpart both rest on that last point.

Key pairs and Session Manager

A key pair is how you prove who you are when you log in. EC2 stores the public key on the instance, and you keep the private key. AWS keeps no copy of the private key, so if you lose it, it can't be recovered.

You can also avoid keys altogether. AWS Systems Manager Session Manager gives you a shell on the instance with no inbound ports open, no bastion host and no SSH keys to manage. Access is controlled through IAM, and sessions can be logged. It also works for instances with no public IP address.

EC2 storage: EBS, snapshots and instance store

EBS volumes

Amazon Elastic Block Store (EBS) provides volumes that attach to an instance and are used like a local hard drive: you store files and install applications on them. Behind the scenes, a volume's data is automatically replicated across multiple servers within its Availability Zone.

That AZ is also the volume's limit. You can attach a volume only to instances in the same Availability Zone. An instance in us-east-1a can't use a volume in us-east-1b, which is why a question about sharing files across zones points to a shared file system instead, as in the SAA-C03 question on shared storage across AZs.

Snapshots

A snapshot is a point-in-time, incremental backup of an EBS volume. AWS stores snapshots in Amazon S3, in buckets you can't access directly, and replicates them across all Availability Zones in the Region. That gives you two things:

• Backup: restore a volume to the state it was in when the snapshot was taken.
• Moving a volume: to get a volume into another AZ, snapshot it, then create a new volume from the snapshot in the target AZ.

Snapshots are also how you encrypt an existing unencrypted volume: snapshot it, copy the snapshot with encryption on, and create a new volume from the copy. The SAA-C03 question on encrypting an existing EBS volume walks through it.

AWS does not back up EBS volumes for you. You create snapshots yourself, or automate them with Amazon Data Lifecycle Manager or AWS Backup.

Instance store

Some instance types (a d in the name is one sign) come with instance store volumes: disks that are part of the host the instance runs on. They cost nothing beyond the instance price and can only be attached at launch. The catch is their lifetime: instance store data survives a reboot, but it is erased when the instance stops, hibernates or terminates.

So instance store suits data you can lose: caches, buffers and scratch files. Anything that must survive a stop belongs on EBS. That trade-off is exactly what the Cloud Practitioner question on persistent block storage and the SAA-C03 question on scratch space test, from opposite sides.

Stop, hibernate, terminate: what you pay for

An instance moves through states, and billing follows them:

• Running: billed for instance usage.
• Stopped: no instance usage charge, but you still pay for its attached EBS volumes. Its instance store data is gone.
• Hibernated: like a stop, except that billing continues while it is stopping, because memory is being saved to the root volume.
• Terminated: permanently deleted. The root EBS volume is deleted by default; EBS volumes attached after launch or from the console are preserved by default.

Two details catch people out. First, after a stop and start an instance usually gets a new public IPv4 address; its private address stays the same. If you need a fixed public address, attach an Elastic IP, which stays yours until you release it and can be moved to another instance to mask a failure. Second, public IPv4 addresses cost money: since February 1, 2024, AWS charges $0.005 per hour for every public IPv4 address, in use or idle, Elastic IPs included (see the instance lifecycle documentation for what each state is billed).

EC2 Auto Scaling groups

Running one instance is easy. Keeping the right number running, healthy, across several zones, as traffic changes, is the job of an EC2 Auto Scaling group.

Launch templates and capacity

A group launches instances from a launch template, which holds the AMI, instance type, key pair, security groups and block devices. (The older launch configurations are on their way out: accounts created on or after October 1, 2024 can't create new ones at all.)

The group then works with three numbers: minimum, desired and maximum capacity. It launches the desired number and never goes below the minimum or above the maximum. The AWS docs use an example of 4, 6 and 12. The group spans subnets in several Availability Zones and keeps the instance count balanced between them, launching new instances in the zone with the fewest. Adding subnets in more zones is how you spread a group out, as the SAA-C03 question on multi-AZ distribution shows.

Healing: health checks

The group runs health checks and replaces any instance it finds unhealthy, to keep the desired count. The important detail is what "unhealthy" means by default: EC2 status checks and scheduled events, not the load balancer's view. If your application hangs while the server itself is fine, the instance passes those checks and stays in service. To replace instances the load balancer has marked unhealthy, you must turn on Elastic Load Balancing health checks for the group. AWS documents this in its Auto Scaling health checks overview. This is one of the most common EC2 exam traps, and the practice question used in the video, the SAA-C03 question on ASG and ELB health checks, is built on it.

Scaling: policies

The scaling options are fixed size, manual, scheduled, dynamic and predictive:

• Dynamic scaling reacts to a CloudWatch metric. There are three policy types: target tracking, step and simple. AWS strongly recommends target tracking: you choose a target, such as average CPU at 50 percent, and the group scales out above it and in below it, creating and managing the CloudWatch alarms for you, much like a thermostat.
• Scheduled actions change capacity at set times, which suits known patterns such as office hours. A question on scheduled scaling turns on that choice.
• Predictive scaling analyses history for daily or weekly patterns and adds capacity before the forecast load arrives.

One group can also mix Spot and On-Demand Instances across several instance types, which is how many teams cut costs without risking all their capacity on Spot. Auto Scaling itself has no extra fee; you pay for the instances, volumes and alarms it uses.

For the slowest-booting applications there are further tools, such as warm pools of pre-initialised instances, tested in a DevOps question on warm pools.

Who uses EC2

AWS case studies show what these pieces add up to in practice. Each figure below is what the customer reports.

• amaysim, an Australian mobile provider, ran Auto Scaling groups of EC2 instances, first on Reserved Instances and then mixed with Spot. By 2021 all of its production workloads ran on Spot Instances, across six instance families, and its compute costs fell 75 percent.
• Typeform has run its form-building tools on EC2 since 2012, using Spot and Graviton-based instances. It moved 90 percent of its workloads to Graviton in six months and reports 19 percent cost savings.
• Logz.io benchmarked Graviton-based instances, then migrated, and reports infrastructure costs down by up to 30 percent after the move to Graviton.

Services around EC2

EC2 rarely runs alone. The classic web architecture puts these pieces around it:

• Route 53 points your domain at a load balancer with an alias record, which works even at the root of a domain.
• An Application Load Balancer works at HTTP and HTTPS and spreads requests across instances so no single one is overwhelmed. Instances launched or terminated by the Auto Scaling group are registered and deregistered with it automatically.
• Subnets and Availability Zones: each subnet lives in one AZ, AWS recommends running instances in private subnets, and the Auto Scaling group spreads them across several zones. The guide to VPC endpoints vs NAT gateways covers how private instances still reach AWS services.
• An IAM role, attached through an instance profile, gives applications on the instance temporary credentials to call AWS APIs, so there are no access keys to hand out or rotate. The guide to IAM roles, users and policies explains why that beats storing keys on the server.
• CloudWatch supplies the metrics and alarms that scaling policies act on.
• EBS and S3 hold the data: EBS for each instance's disks, S3 for objects shared across them.

EC2 pricing options

How you pay is a decision of its own, and the exams test every option. AWS lists them on its EC2 pricing page.

• On-Demand: pay by the second, with a 60-second minimum, and no commitment or upfront payment. Right for short-term, irregular workloads that can't be interrupted.
• Savings Plans: commit to a consistent amount of usage, in US dollars per hour, for one or three years, for up to 72 percent off On-Demand prices. The commitment is to spend, not to an instance type, so a Compute Savings Plan follows you as your fleet changes (an EC2 Instance Savings Plan is tied to one instance family in one Region).
• Reserved Instances: a billing discount, not a physical instance, for a one- or three-year commitment to a specific instance configuration. AWS's EC2 documentation now says it recommends Savings Plans over Reserved Instances, though exams still ask about both.
• Spot Instances: spare EC2 capacity at up to 90 percent off On-Demand prices. EC2 can take it back, usually with a two-minute warning, so Spot suits work that can be interrupted: data analysis, batch jobs, background processing and optional tasks. A Cloud Practitioner question on interruptible workloads is the simplest form.
• Dedicated Instances: single-tenant hardware, billed per instance.
• Dedicated Hosts: a whole physical server for you, with visibility of sockets and cores, which matters for bring-your-own-license software priced per socket or per core.
• On-Demand Capacity Reservations: reserve capacity in a specific Availability Zone, for any duration, so it is there when you need it.

Real architectures combine them. A typical answer is a Savings Plan for the steady baseline, Spot for the interruptible batch work, and On-Demand for the rest, as in the Cloud Practitioner Savings Plans question and the SAA-C03 question on mixing Savings Plans and Spot.

Other EC2 features to remember

EBS volume types

• gp3 (General Purpose SSD): a baseline of 3,000 IOPS and 125 MiB/s included in the storage price, and 20 percent cheaper per GiB than gp2. Unlike gp2, it doesn't burst; it sustains what you provision. Moving gp2 volumes to gp3 is a common cost fix, covered in the question on gp2 to gp3 migration.
• io2 Block Express: the high-performance tier, with up to 256,000 IOPS and 99.999 percent durability.
• st1 and sc1 (HDD): st1 is throughput-optimized for big data and log processing; sc1 is the lowest-cost option for infrequently accessed data. Neither can be a boot volume.

User data and instance metadata

User data is a script you pass at launch to configure the instance. On Linux it runs as root, and by default only on the first boot; the limit is 16 KB. A script that calls AWS APIs should get its permissions from an instance profile, not from keys in the script.

From inside, an instance can read facts about itself (its ID, its role's temporary credentials) from the instance metadata service at 169.254.169.254. IMDSv2, the session-oriented version, requires the caller to fetch a token with a PUT request before reading anything, which blocks a class of attacks that trick a server into fetching that address.

Placement groups

• Cluster: packs instances close together in one Availability Zone for low-latency networking, as in high-performance computing.
• Spread: places a small group of instances on distinct hardware to reduce correlated failures.
• Partition: spreads instances across partitions that don't share hardware, which suits distributed systems such as Hadoop, Cassandra and Kafka.

What the AWS exams ask about EC2

EC2 runs through most AWS associate and professional exams. On this site:

• Cloud Practitioner (CLF-C02) asks about instance types, EBS vs instance store, security groups and network ACLs, and every purchasing option. Practise in the CLF-C02 practice tests or browse the CLF-C02 question list.
• Solutions Architect Associate (SAA-C03) goes deeper on Auto Scaling, purchasing options and hibernation, and storage choices. See the SAA-C03 practice tests and the SAA-C03 question list.
• DevOps Engineer Professional (DOP-C02) tests automating all of it: golden AMIs, lifecycle hooks, instance refresh, warm pools. See the DOP-C02 practice tests and the DOP-C02 question list.
• The CloudOps Engineer Associate (SOA-C03), the renamed SysOps exam, covers AMIs, scaling and snapshots too.

The traps they keep setting:

• Security group vs network ACL. Security groups are stateful, allow-only and attached to the instance. Network ACLs are stateless, have both allow and deny rules, and apply to the whole subnet. "Block an IP range for a whole subnet" therefore means a NACL, as in the question on a subnet-level deny.
• The Auto Scaling health check default. A hung application on a healthy server is not replaced until ELB health checks are turned on for the group.
• Instance store disappears on stop. If the data must survive, it goes on EBS.
• EBS lives in one AZ. Moving a volume means a snapshot and a new volume.
• Spot means interruptible. Never the answer for a workload that can't be stopped, however cheap.
• Savings Plans over Reserved Instances for flexible, long-term savings, and Dedicated Hosts when licensing is per socket or per core.

Frequently asked questions

Is Amazon EC2 infrastructure as a service?

Yes. EC2 rents you virtual servers, and you manage the operating system, the software and the data on them, while AWS runs the physical hosts and the virtualisation layer underneath. That split is the shared responsibility model, explained further in the shared responsibility model guide.

What happens to my data when I stop an EC2 instance?

Data on EBS volumes stays, and you keep paying for those volumes. Data on instance store volumes is erased. The instance also usually gets a new public IPv4 address when it starts again, unless it has an Elastic IP.

What is the difference between an AMI and an EBS snapshot?

A snapshot is a backup of one EBS volume. An AMI is a launch template for whole instances: it references the snapshots for its volumes and adds what's needed to boot, such as the block device mapping. You launch instances from an AMI; you restore volumes from a snapshot.

What is the difference between a security group and a network ACL?

A security group is a stateful firewall around an instance with allow rules only. A network ACL is a stateless firewall for a subnet with numbered allow and deny rules, so return traffic must be allowed explicitly.

Which EC2 pricing option costs least?

Spot is advertised at up to 90 percent off, but the capacity can be taken back, usually with two minutes' warning. For steady workloads, Savings Plans give up to 72 percent off in exchange for a one- or three-year commitment. The cheapest choice depends on whether the work can be interrupted.

Does EC2 Auto Scaling cost extra?

No. You pay only for the resources it uses, such as instances, EBS volumes and CloudWatch alarms.

Watch the whiteboard video

The video builds an instance from its parts on one board, then shows an Auto Scaling group adding servers as traffic doubles and works through the health-check trap with a practice question: Amazon EC2 Explained on a Whiteboard (CLF-C02, SAA-C03) on YouTube.