EC2: Virtual Machines in the Cloud

Chapter 1 named EC2 as AWS's own real, original compute service — public beta in August 2006, full production by October 2008. Chapter 2 covered who's allowed to do what. This chapter covers the thing itself: launching, configuring, and securing a real virtual machine on AWS.

Instances & AMIs

An instance is a running virtual machine. Every instance boots from an AMI (Amazon Machine Image) — a real template bundling an operating system and, optionally, pre-installed software. AWS provides official AMIs (Amazon Linux, Ubuntu, Windows Server), the AWS Marketplace offers third-party ones, and you can create your own custom AMI from a configured instance to launch identical copies of it later.

Instance Types & Families

Real AWS instance types are named by family and generation (e.g. t3.micro, m5.large), each family tuned for a different real workload shape:

Real Pricing Models

• On-Demand — pay by the hour (or second, for many instance types), with no commitment; the most expensive per-hour rate, the most flexible.
• Reserved — commit to a specific instance type for 1 or 3 years, in exchange for a real, documented discount of roughly 35-75% off the On-Demand rate.
• Spot — bid on AWS's own real spare compute capacity, at discounts up to roughly 90% — but AWS can reclaim a Spot instance with only a short warning if it needs that capacity back, so there's no uptime guarantee.
• Savings Plans (introduced November 2019) — commit to a real dollar-per-hour spend rather than a specific instance type, trading some of Reserved pricing's own rigidity for flexibility across instance families.

Security Groups

A security group is a real virtual firewall attached to an instance's own network interface, controlling inbound and outbound traffic by port, protocol, and source/destination. Security groups are stateful — if inbound traffic on a given connection is allowed in, the matching outbound reply is automatically allowed back out, without needing a separate matching rule. (Chapter 5 covers the network-level, stateless alternative — Network ACLs — and exactly how the two differ.)

SSH Key Pairs

Rather than a password, Linux instances are normally accessed via an SSH key pair: AWS holds the public key, you keep the private key, and only someone holding the matching private key can authenticate. The private key is generated (or provided) once, at instance launch — AWS never stores a copy of it, so losing it means losing that specific access method entirely, with no real recovery path other than provisioning a new key.

A Real Security Deep-Dive: The Instance Metadata Service

Every running EC2 instance can query a real, special local address — 169.254.169.254 — for its own metadata, including, when an IAM role is attached (Chapter 2), that role's own temporary credentials. This service is called IMDS, and its own real history is a genuine security case study in its own right.

AWS's real fix, IMDSv2, requires a session to be explicitly established first via a PUT request, returning a secret token (valid up to 6 hours) that every subsequent metadata request must include as a header. Because a typical SSRF exploit can only manipulate an existing request's headers or URL — not initiate this specific, separate PUT request from the application itself — this two-step design is real, structurally more effective than requiring only a static header, and is now AWS's own recommended default.

Hands-On Exercises