What is Amazon EC2 used for?

Amazon EC2 provides virtual servers for applications, websites, development systems, batch processing and other computing workloads. Customers choose the operating system, compute capacity, storage and network controls.

What is the difference between an AMI and an EC2 instance?

An AMI is the image and configuration used to launch a server. An EC2 instance is the running or stopped virtual machine created from that AMI.

Does EC2 data remain after an instance is stopped?

Data on EBS volumes normally remains when an instance is stopped. Data on instance-store disks is lost when the instance is stopped or terminated, although it usually survives a normal reboot.

Are EC2 security groups stateful?

Yes. When a security-group rule permits a connection, response traffic for that connection is automatically allowed. Security groups contain allow rules and do not support explicit deny rules.

Can the same AMI ID be used in every AWS Region?

No. AMI IDs are specific to an AWS Region, and the same operating-system image has different IDs across Regions. Query an official image source or AWS Systems Manager public parameter in the target Region.

What happens to an EBS root volume when an instance is terminated?

The result depends on its DeleteOnTermination setting. Root volumes are commonly configured for automatic deletion, while additional data volumes may be retained, so the setting should be checked before termination.

Amazon EC2 Explained: AMIs, Storage and Security

Amazon Elastic Compute Cloud (Amazon EC2) provides virtual servers called instances inside AWS. You choose the operating system, processor architecture, compute capacity, storage, network placement and firewall rules required by the workload.

A useful diagram in words is: AMI creates the server → instance type supplies CPU and memory → EBS or instance store holds data → security groups control traffic → IAM role permits AWS API access.

What is Amazon EC2?

Amazon EC2 is an AWS service for launching and managing resizable virtual servers. It is commonly used for web applications, development environments, databases, batch processing, container hosts and administrative tools.

An EC2 instance runs inside an Availability Zone and connects to a subnet through an Elastic Network Interface (ENI). Its lifecycle, network access and data persistence depend on the options selected during launch.

The main building blocks are:

Component	Purpose
AMI	Operating system and initial disk contents
Instance type	CPU, memory, networking and hardware capabilities
EBS volume	Persistent block storage
Instance store	Temporary disks physically attached to the host
Security group	Stateful virtual firewall attached to an ENI
Key pair or Session Manager	Administrative access to the operating system
IAM role	Temporary AWS permissions for applications on the instance

EC2 is an Infrastructure as a Service model. AWS manages the physical facilities and virtualization layer, while the customer normally manages the guest operating system, updates, applications, host firewall and data.

How does an EC2 instance launch?

Launching an instance means combining an AMI with an instance type, subnet, storage configuration and security group. EC2 then places the virtual machine on AWS infrastructure in the selected Availability Zone and attaches its network interface.

The process can be visualised as:

AMI + instance type + subnet + storage + security group
                         |
                         v
                Running EC2 instance
                         |
             ENI with private IP address
                         |
          VPC routing and permitted network traffic

A basic launch workflow is:

Select the AWS Region.
Choose an AMI and confirm its processor architecture.
Choose a compatible instance type.
Select a VPC subnet.
Configure EBS volumes.
Attach one or more security groups.
Select a key pair or configure AWS Systems Manager access.
Launch and check the instance status.

The following AWS CLI command displays running instances. The CLI identity needs permission to call ec2:DescribeInstances.

aws ec2 describe-instances \
  --region ap-south-1 \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,PrivateIP:PrivateIpAddress,AZ:Placement.AvailabilityZone}' \
  --output table

Region selection matters because AMI IDs, subnets, security groups and key pairs are regional resources. Availability Zones and their subnets are selected within that Region.

How should you choose an EC2 instance type?

Choose an instance family based on the workload's CPU, memory, storage, network and accelerator requirements. Start with measured requirements rather than selecting a large instance without evidence, and review monitoring data after deployment.

An instance type name such as m7i.large provides useful information:

m     = instance family
7     = generation
i     = processor or capability suffix
large = size within the family

Common families include:

Workload category	Common families	Example uses
General purpose	T and M	Web servers, small applications, development systems
Compute optimised	C	Compilation, media processing, compute-heavy services
Memory optimised	R, X and high-memory options	In-memory processing and memory-heavy databases
Storage optimised	I and D	High-throughput or low-latency local storage workloads
Accelerated computing	G, P, Inf and Trn	Graphics, machine learning inference and training

T-family instances use a burstable CPU model. They accumulate and consume CPU credits, so they require additional monitoring when an application has sustained CPU demand.

Processor architecture is also important. AWS offers instance types based on x86-64 and Arm processors. An Arm-based instance requires an Arm-compatible AMI and application binaries; an x86 AMI cannot simply boot on an Arm instance.

Check the available information for an instance type with:

aws ec2 describe-instance-types \
  --instance-types m7i.large \
  --query 'InstanceTypes[0].{vCPU:VCpuInfo.DefaultVCpus,MemoryMiB:MemoryInfo.SizeInMiB,Architectures:ProcessorInfo.SupportedArchitectures,Network:NetworkInfo.NetworkPerformance}'

For production sizing, examine CloudWatch metrics such as CPU utilisation, network traffic and EBS activity. Memory and filesystem usage are not standard EC2 host metrics; install and configure the CloudWatch agent when these guest-level measurements are required.

What is an Amazon Machine Image?

An Amazon Machine Image, or AMI, is a launch template containing the information EC2 needs to boot an instance. It includes a root-volume image, block-device mappings and permissions that determine which AWS accounts can use it.

AMIs may come from AWS, AWS Marketplace, trusted software publishers or your own environment. Always verify the owner, operating system, architecture and maintenance source before use.

Important AMI properties include:

Region-specific AMI ID
x86-64 or Arm architecture
Operating system and version
Root device and volume configuration
Boot mode and virtualization support
Launch permissions

AMI IDs differ between Regions. Do not copy an AMI ID from an example and assume it represents the same image in another Region. AWS Systems Manager public parameters can help identify current Amazon Linux images.

aws ssm get-parameter \
  --region ap-south-1 \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query 'Parameter.Value' \
  --output text

How do you create a custom AMI?

A custom AMI captures an EC2 system so that similar instances can be launched consistently. Before creating it, remove temporary data, avoid embedding secrets and confirm that the operating system will generate unique host-specific values at boot.

aws ec2 create-image \
  --region ap-south-1 \
  --instance-id i-0123456789abcdef0 \
  --name "web-base-2026-09" \
  --description "Patched web server base image"

By default, EC2 attempts to reboot the instance during image creation to improve filesystem consistency. A custom AMI is not a complete backup strategy: test restoration, manage associated EBS snapshots and define a retention policy.

How does EC2 storage work?

EC2 mainly uses Amazon EBS for persistent block storage and instance store for temporary host-attached storage. Their lifecycle behaviour is different, so selecting the wrong option can cause data loss or unnecessary complexity.

Amazon EBS volumes

An EBS volume is network-attached block storage created in an Availability Zone. It can remain after an instance stops, and it can be detached and attached to another compatible instance in the same Availability Zone.

Common EBS volume categories are:

EBS type	General purpose
`gp3`	General-purpose SSD for many applications and boot volumes
`io2`	Provisioned IOPS SSD for demanding, latency-sensitive workloads
`st1`	Throughput-optimised HDD for large sequential workloads
`sc1`	Cold HDD for less frequently accessed sequential data

Boot volumes normally use SSD storage. HDD volumes cannot be used as boot volumes.

The root EBS volume is often configured with DeleteOnTermination=true, meaning it is deleted when the instance is terminated. Additional data volumes may have different settings. Stopping an instance does not normally delete its EBS volumes.

Inspect block-device settings with:

aws ec2 describe-instances \
  --instance-ids i-0123456789abcdef0 \
  --query 'Reservations[0].Instances[0].BlockDeviceMappings'

Inside a Nitro-based Linux instance, an EBS device requested as /dev/sdf may appear as an NVMe device such as /dev/nvme1n1. Always inspect devices before formatting them.

lsblk -f
sudo nvme list
sudo blkid

For a new empty volume, create a filesystem and mount it:

sudo mkfs.xfs /dev/nvme1n1
sudo mkdir -p /data
sudo mount /dev/nvme1n1 /data
df -hT /data

Do not run mkfs on a volume containing required data. For persistent mounting, use the filesystem UUID in /etc/fstab and test with sudo mount -a before rebooting.

Instance store

Instance store provides temporary block storage from disks physically attached to the EC2 host. Its data can survive a normal reboot, but it is lost when the instance is stopped, terminated or moved away from the underlying host because of certain failures.

Use instance store for replaceable data such as caches, buffers and replicated temporary processing files. Do not use it as the only location for important application data.

EBS snapshots

EBS snapshots are incremental point-in-time backups stored and managed by AWS. A snapshot can create a new EBS volume, including a volume in another Availability Zone within the same Region.

Application consistency still matters. For databases or active filesystems, use application-aware backup procedures, quiescing or supported snapshot coordination rather than assuming that every crash-consistent snapshot is sufficient.

How do EC2 security groups work?

A security group is a stateful virtual firewall attached to an instance's network interface. It allows matching traffic through inbound and outbound rules, but it does not support explicit deny rules.

Stateful behaviour means that response traffic for an allowed connection is automatically permitted. For example, if inbound TCP port 443 is allowed, return packets for that connection do not need a separate inbound rule.

A secure web-server pattern might be:

Direction	Protocol and port	Source or destination	Reason
Inbound	TCP 443	Approved client range or load balancer security group	HTTPS traffic
Inbound	TCP 22	Administrator address only, if SSH is required	Administration
Outbound	Required application traffic	Specific destinations where practical	Updates and dependencies

Avoid exposing SSH or RDP to 0.0.0.0/0 unless there is a justified and controlled requirement. AWS Systems Manager Session Manager can provide shell access without opening an inbound administrative port when its agent, IAM instance role and network connectivity are configured.

Create a security group and add a restricted HTTPS rule:

SG_ID=$(aws ec2 create-security-group \
  --group-name web-https-sg \
  --description "Allow HTTPS from approved clients" \
  --vpc-id vpc-0123456789abcdef0 \
  --query 'GroupId' \
  --output text)

aws ec2 authorize-security-group-ingress \
  --group-id "$SG_ID" \
  --ip-permissions 'IpProtocol=tcp,FromPort=443,ToPort=443,IpRanges=[{CidrIp=203.0.113.0/24,Description="Approved client range"}]'

203.0.113.0/24 is a documentation range and must be replaced in a real deployment. When application tiers communicate inside a VPC, referencing another security group is often safer and easier to maintain than listing changing instance IP addresses.

Security groups control network traffic; they do not grant AWS API permissions. Attach an IAM role to the instance for AWS service access and apply least privilege. For a focused explanation, see AWS IAM users, roles and policies.

How can you inspect an EC2 instance from inside Linux?

The EC2 Instance Metadata Service exposes information about the current instance through a link-local address. IMDSv2 uses a session token and should be preferred over unrestricted IMDSv1 access.

TOKEN=$(curl -sS -X PUT \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
  http://169.254.169.254/latest/api/token)

curl -sS \
  -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/instance-id

Do not place long-term AWS access keys on an instance. Use an IAM role attached through an instance profile so applications can receive temporary credentials. More complete EC2 and architecture labs are covered in the AWS Solutions Architect course.

How do you troubleshoot a failed EC2 connection?

Start at the instance and move outward through the network path. Confirm instance state, status checks, addressing, routes, security rules and the service running inside the operating system.

Use this sequence for SSH or web-access problems:

Confirm that the instance is running and both EC2 status checks pass.
Verify the destination IP address or DNS name.
Confirm that the subnet route and gateway path match the connection design.
Check inbound security-group rules for the correct protocol, port and source.
Check network ACL rules in both directions, including return traffic.
Verify that the process is listening on the expected interface and port.
Check the guest firewall and application logs.
Confirm the correct SSH username and private key permissions.

Useful Linux checks include:

sudo ss -lntp
ip address show
ip route show
sudo systemctl status sshd
sudo journalctl -u sshd --since "15 minutes ago"
curl -I http://127.0.0.1:80

On Ubuntu, the SSH service may be named ssh rather than sshd. If local curl succeeds but remote access fails, investigate security groups, network ACLs, routes and the host firewall. If nothing is listening locally, troubleshoot the application or service configuration first.

For an unexpected EBS volume problem, check lsblk, blkid, /etc/fstab and the kernel log:

lsblk -f
cat /etc/fstab
sudo mount -a
sudo dmesg | tail -n 50

An incorrect /etc/fstab entry can delay or interrupt boot. Use UUIDs and consider the nofail option for non-critical data volumes where appropriate.

Infrastructure as code makes repeatable instance deployment easier after the manual components are understood. The practical guide to building an AWS resource with Terraform is a useful next step.

What are the main EC2 lessons to remember?

EC2 combines compute, an AMI, storage, networking and access controls into a virtual server. Reliable designs depend on architecture compatibility, correct storage lifecycle decisions, restricted security-group rules and repeatable operational procedures.

Match the instance family and size to measured workload requirements.
Confirm that the AMI architecture matches the instance processor.
Use EBS for persistent block data and instance store only for replaceable data.
Review DeleteOnTermination before terminating an instance.
Restrict administrative ports and prefer managed access where suitable.
Use IAM roles instead of stored long-term access keys.
Monitor both AWS metrics and guest operating-system metrics.
Test backups, restoration and recovery procedures.

To practise EC2 launches, AMI creation, EBS management, security groups and architecture decisions in guided labs, enquire about batch details for the AWS Solutions Architect course.

*Reviewed by Network Rhinos AWS trainers.*

Amazon EC2 Explained: Instances, AMIs, Storage and Security