EC2: Your First Server

With the account secured in part two, it's time for AWS's best-known service. EC2 (Elastic Compute Cloud) gives you virtual servers you can launch in minutes, pay for while they run, and delete when you're done.

In this part we'll go through the decisions you make when launching a server, start a web server that configures itself, and connect it to AWS services with an IAM role instead of keys.

What you choose when you launch a server #

Every server (called an instance) comes down to a set of decisions:

Instance types #

The type's name describes the whole server. Take m7g.2xlarge:

• m: the family, which sets the server's purpose.
• 7: the generation. Newer generations are usually faster and cheaper for the same work.
• g: an extra attribute, here meaning an AWS Graviton (ARM) processor.
• 2xlarge: the size within the family.

The main families:

Always start small, and grow when the numbers say you need to. The t family uses a CPU "credit" system: it runs at a baseline and can burst above it for short periods, which is great for small projects and wrong for heavy, sustained load.

Most current types run on the AWS Nitro System, a lightweight hypervisor backed by dedicated hardware, which gives a virtual server performance close to the physical machine. If you need the machine itself, such as for software that can't run virtualized, look for .metal sizes.

Security groups: the server's firewall #

A security group is a virtual firewall around the server. The key points:

• Rules can only allow. You never write "deny"; anything not allowed is blocked.
• By default, all inbound traffic is blocked and all outbound traffic is allowed.
• It's stateful: if a request is allowed in, the response goes back out without an outbound rule.
• You can allow an IP address or another security group. For example, a database can accept traffic only from the application servers' security group, even as their addresses change.

Ports you'll run into a lot:

User Data: a server that sets itself up #

User Data is a script you hand the server at launch. It runs once, on first boot, as root. Instead of signing in and installing everything by hand, the server comes up ready. This is the foundation of the auto scaling we'll reach later.

Hands-on: launch a web server #

Now let's launch an Amazon Linux server that comes up with a web server already running.

1. Open EC2, click Launch instance, and name it web-1.

2. Choose the Amazon Linux 2023 image and type t3.micro (or whichever type your free usage covers).

3. Create a key pair and download it, unless you'll sign in from the browser with EC2 Instance Connect.

4. Under Network settings, allow HTTP from anywhere and SSH only from your address (My IP).

5. Under Advanced details, paste this into the User data box:

   #!/bin/bash
   dnf install -y nginx
   echo "<h1>Hello from $(hostname)</h1>" > /usr/share/nginx/html/index.html
   systemctl enable --now nginx

6. Click Launch instance and wait for the state to become Running.

After a minute or two, copy the Public IPv4 address and open it in your browser with http:// (not https). You should see the page and the server's name. To sign in to it:

# The key file must be locked down, or SSH refuses it
chmod 400 ~/keys/my-key.pem

# The default user on Amazon Linux is ec2-user
ssh -i ~/keys/my-key.pem ec2-user@SERVER_ADDRESS

For a detailed walkthrough of the console with screenshots, see How to create a server on AWS.

Hands-on: give the server an IAM role #

In part two we said: for services inside AWS, use a role, not keys. Let's do that now.

1. In IAM, open Roles, then Create role. Choose AWS service, then EC2.
2. Attach the ready-made AmazonS3ReadOnlyAccess policy and name the role web-s3-read.
3. Back in EC2, select the server, then Actions, Security, Modify IAM role, and choose the role.

Now, on the server, with no aws configure and no keys at all:

# Shows a temporary assumed-role identity, not a user
aws sts get-caller-identity

# Works, because the role allows reading S3
aws s3 ls

# Refused, because the role doesn't allow it: least privilege in action
aws ec2 describe-instances --region eu-central-1

The last command returns an UnauthorizedOperation error, which is exactly what we want: the server can do only what you gave it.

Stop or terminate? #

Note that the public IP address changes every time you stop and start the server. We'll see the fix in the next part.

Summary #

• A server is made of an image (AMI), a type, keys, a network, a security group, storage and User Data.
• The type's name says it all: family, generation and size. Start small and grow by the numbers.
• Security groups only allow, remember connections, and can reference other groups.
• A timeout usually means the security group; connection refused means the application.
• User Data sets the server up automatically, and a role gives it permissions without keys.

Test yourself #

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

In part four we see how to pay far less for the same server, and how to handle IP addresses and networking.