Ch3. EC2 — AWS's Core Compute Service

What Is EC2?

Amazon EC2 (Elastic Compute Cloud) is AWS’s core IaaS service — virtual servers you can rent by the minute.

Components: CPU, RAM, storage (EBS or instance store), network, OS (defined by AMI).

Instance Types

Family	Use Case	Examples
General Purpose (T, M)	Web servers, small DBs	t3.micro, m5.large
Compute Optimized (C)	CPU-intensive workloads	c5.xlarge
Memory Optimized (R, X)	In-memory DBs, big data	r5.2xlarge
Storage Optimized (I, D)	High IOPS databases	i3.large
Accelerated Computing (P, G)	ML training, gaming	p3.2xlarge

T-series burstable: CPU credit system — use low baseline, burst when needed. Cost-effective for dev/test workloads.

Purchasing Options

Option	Discount	Best for
On-Demand	Baseline (none)	Unpredictable workloads
Reserved (1–3 yr)	Up to 72%	Steady-state workloads
Savings Plans	Up to 72%	Flexible commitment
Spot	Up to 90%	Fault-tolerant batch jobs
Dedicated Hosts	Expensive	Compliance, BYOL

Exam key: Spot instances can be interrupted at any time with 2-minute warning. Use for: batch processing, data analysis, CI/CD pipelines — anything that can checkpoint and restart. Never for: production databases, payment processing, or anything that can’t tolerate interruption.

Security Groups

EC2’s virtual firewall. Controls inbound and outbound traffic.

Key properties:

Only Allow rules (no Deny)
Can be attached to multiple instances
Default: block all inbound, allow all outbound
Stateful: if inbound is allowed, the response is automatically allowed outbound

vs Network ACL (NACL):

NACL: subnet level, Allow + Deny, Stateless (return traffic must be explicitly allowed)
Security Group: instance level, Allow only, Stateful

AMIs (Amazon Machine Images)

Blueprint for EC2 instances — includes OS, software, configuration.

AWS-provided: Amazon Linux 2023, Ubuntu, Windows Server
Marketplace: third-party (paid or free)
Custom: create from a configured instance for rapid replication

AMI pattern: Configure instance → Create AMI → Launch identical instances from that AMI.

EC2 Storage

EBS (Elastic Block Store): Network-attached block storage. Persists independently of the instance. Supports snapshots.

Type	Use Case	Max IOPS
gp3 (General SSD)	Most workloads	16,000
io2 (Provisioned IOPS)	Databases, mission-critical	256,000
st1 (Throughput HDD)	Big data, logs	Lower

Instance Store: Physically attached to the host. Extremely fast. Data lost on instance stop/terminate. Use for temporary data, caches.

Auto Scaling

Automatically adjust EC2 instance count based on demand.

Components:

Launch Template: What to create (AMI, instance type, security groups)
ASG (Auto Scaling Group): How many to maintain (min/max/desired)
Scaling Policy: When to scale (e.g., add instance when CPU > 70%)

Key Concept Cards

Purchasing Options ★★★★★ : On-Demand=baseline, Reserved=72% off (long-term), Spot=90% off (interruptible). Matching option to workload is the key to cost optimization.

Security Groups ★★★★★ : Instance-level firewall. Allow-only, Stateful. Distinguish from NACL (subnet-level, Allow+Deny, Stateless).

EBS vs Instance Store ★★★★☆ : EBS=persistent network storage with snapshots. Instance Store=temporary ultra-fast local storage, lost on stop.

Practice Quiz

Q1. What is the most cost-effective EC2 purchasing option for an irregular batch image processing job that can be interrupted and restarted?

Spot Instances. Batch jobs that can checkpoint and restart are ideal for Spot — up to 90% cheaper than On-Demand. The key requirement is fault tolerance: the job must handle 2-minute interruption notices gracefully.

Q2. Why is opening port 22 (SSH) to 0.0.0.0/0 in a security group dangerous?

It exposes the SSH port to the entire internet, inviting brute-force credential attacks from automated scanners worldwide. Best practice: allow SSH only from specific IPs (office, VPN), or better yet, use AWS Systems Manager Session Manager to eliminate the need for an open SSH port entirely.