EC2

Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers in AWS. You choose the hardware profile, the machine image and the network placement; AWS provides the hypervisor, the physical estate and the APIs to create and destroy capacity in seconds.

Key characteristics:

• Virtual servers you can resize and replace on demand
• Full control of the guest operating system and everything above it
• Minutes rather than weeks to obtain new capacity
• Billing per second for the capacity you actually run

Four topics have pages of their own:

• Instance types — how families are named and which one fits a given CPU, memory, storage or accelerator profile. See also the T instance credit system for burstable instances.
• Amazon Machine Images — what an AMI contains, EBS-backed versus instance-store-backed, and how to build one.
• Purchase options — On-Demand, Reserved Instances, Savings Plans, Spot, Dedicated Hosts and Capacity Reservations, and which one a given workload should be on.
• Auto Scaling groups — launch templates, scaling policies, lifecycle hooks and warm-up/cooldown behaviour.
• Hibernation — suspending an instance to its encrypted root volume and resuming it with memory intact.

The rest of this page covers the parts of EC2 that do not have a page of their own.

Networking

• VPC — instances launch into a subnet of a virtual private cloud that you control the address space and routing of.
• Security groups — stateful, allow-only firewalls attached to the instance’s network interfaces.
• Elastic IP addresses — static IPv4 addresses that can be remapped between instances. They are charged whether or not they are attached, so prefer a load balancer or a DNS record where you can.

Storage options

• Amazon EBS — network-attached block volumes that outlive the instance. This is the root device for almost every modern instance type.
• Instance store — physically attached NVMe or SSD storage. Fast, free with the instance, and gone the moment the instance stops or the host fails.
• Amazon EFS — a managed NFS file system several instances can mount at once.

Load balancing

Elastic Load Balancing distributes incoming traffic across targets in multiple Availability Zones. Three types are current:

• Application Load Balancer (ALB) — HTTP/HTTPS, routing on host, path, header and query string.
• Network Load Balancer (NLB) — TCP/UDP/TLS at very high throughput with static IP addresses per zone.
• Gateway Load Balancer (GWLB) — inserts third-party network appliances into the traffic path.

The Classic Load Balancer is the previous generation. AWS still operates existing ones but recommends migrating them to a current-generation load balancer, and nothing new should be built on it.

Instance metadata and user data

The Instance Metadata Service (IMDS) exposes facts about the running instance on the link-local address 169.254.169.254. Use IMDSv2, which requires a session token on every request. IMDSv2 is what the console selects by default for new launches, accounts can enforce it estate-wide, and instance types released from mid-2024 onwards support nothing else.

Request a token, then use it:

TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")

curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/

Useful paths under /latest/meta-data/:

ami-id                            # AMI the instance was launched from
instance-id                       # Instance ID
instance-type                     # Instance type
local-ipv4                        # Private IPv4 address
public-ipv4                       # Public IPv4 address, if one is attached
iam/security-credentials/         # Temporary credentials for the attached role
placement/availability-zone       # Availability Zone

User data is a script or cloud-init directive supplied at launch and run during first boot, typically to install an agent or fetch configuration. Read it back the same way:

curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/user-data

IMDSv1 — the same URLs with no token — is the legacy path. It is disabled by default on new launches in most accounts and is unavailable entirely on recent instance types, so treat any tooling that still depends on it as a migration item.

Placement groups

Placement groups influence where AWS puts a set of interdependent instances relative to one another.

• Cluster — packs instances close together inside one Availability Zone for the lowest network latency and highest throughput. Suits tightly coupled HPC. All instances sit in one rack, so a rack failure takes all of them.
• Partition — divides the group into logical partitions, each on its own set of racks, and can span Availability Zones. A rack failure affects one partition only. This is the shape distributed systems such as HDFS, HBase and Cassandra want.
• Spread — places every instance on distinct hardware, at most one instance per rack, and can span Availability Zones. Use it for a small number of critical instances that must not fail together.

Enhanced networking

Enhanced networking uses single root I/O virtualisation (SR-IOV) to give the instance direct access to the network card, raising packets per second and lowering latency and jitter. It is enabled by default on current-generation instance types via the Elastic Network Adapter (ENA); the Elastic Fabric Adapter (EFA) extends this with OS-bypass for HPC and distributed training.

Monitoring

CloudWatch collects EC2 metrics at two resolutions:

• Basic monitoring — five-minute periods, no charge, on by default.
• Detailed monitoring — one-minute periods, charged, must be enabled explicitly.

Metrics published without an agent:

Group	Metrics
CPU	CPUUtilization
Disk (instance store only)	DiskReadOps, DiskWriteOps, DiskReadBytes, DiskWriteBytes
Network	NetworkIn, NetworkOut, NetworkPacketsIn, NetworkPacketsOut
Status checks	StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System
T-family credits	CPUCreditUsage, CPUCreditBalance, CPUSurplusCreditBalance, CPUSurplusCreditsCharged

Two gaps catch people out. Memory utilisation is not published by default — the hypervisor cannot see inside the guest. Neither is free disk space, and the disk metrics above cover instance store volumes only; EBS volumes publish their own metrics under the AWS/EBS namespace.

To get memory and filesystem metrics, install the CloudWatch agent, configure the metrics you want, and budget for them as custom metrics.