3) EC2 - Elastic Compute Cloud

Amazon EC2 Fundamentals

• Amazon Elastic Compute Cloud (Amazon EC2) is an Infrastructure as a Service (IaaS) offering and represents one of the core foundational building blocks of Amazon Web Services (AWS).

• EC2 primarily provides on-demand, resizable virtual computer instances in the cloud, allowing complete control over computing resources.

• Core components and features of the EC2 infrastructure include:

  • Renting virtual machines through Amazon EC2.

  • Storing data on persistent virtual block storage drives using Amazon Elastic Block Store (EBS).

  • Distributing network incoming traffic across multiple instances using Elastic Load Balancing (ELB).

  • Automatically scaling compute resources up or down based on workload demand using Auto Scaling Groups (ASG).

• Mastering EC2 parameters and operation is fundamental to understanding cloud architecture and operational models.

EC2 Instance Sizing and Configuration Options

• Operating System (OS) Selection:

  • Linux (various distributions including Amazon Linux 2, Ubuntu, RHEL).

  • Microsoft Windows Server.

  • macOS.

• Compute and Memory Allocation:

  • CPU: Variable allocation of virtual central processing units (vCPUs) and execution cores.

  • RAM: Variable random-access memory allocation ranging from sub-gigabyte to multi-terabyte options.

• Storage Configuration Options:

  • Network-attached storage: Amazon EBS (Elastic Block Store) and Amazon EFS (Elastic File System).

  • Local hardware storage: EC2 Instance Store (ephemeral block storage physically attached to the host server).

• Network Infrastructure Configuration:

  • Network interface card specifications, including maximum network bandwidth capabilities.

  • Public IPv4 and IPv6 address assignment options.

• Firewall and Security Setup:

  • Virtual firewall rules defined via Security Groups.

• Automated Instance Initialization:

  • Bootstrapping configuration via EC2 User Data scripts during initial instance creation.

EC2 User Data and Bootstrapping

• Bootstrapping refers to running automated configuration commands during the initial boot phase of a virtual machine instance.

• The EC2 User Data script is executed only once when the instance completes its very first boot sequence.

• Execution Context:

  • The EC2 User Data script runs automatically with root-level administrative privileges (root user on Linux or Administrator on Windows).

• Common Bootstrapping Tasks:

  • Installing operating system security updates and software packages.

  • Installing web servers, application runtimes, or custom packages.

  • Downloading static application assets or configuration files from S3 or external repositories.

  • Setting up system environment variables or initial runtime commands.

• Lifecycle Management:

  • Instances initialized with User Data can subsequently be started, stopped, or terminated standardly through the AWS Management Console, AWS CLI, or SDKs.

EC2 Instance Types and Naming Conventions

• AWS uses a standardized, structured syntax for naming EC2 instance types, formatted as: [class][generation].[size] (e.g., m5.2xlarge).

  • Instance Class / Family (e.g., m): Indicates the workload optimization profile.

  • Generation Number (e.g., 5): Represents the hardware generation; higher numbers denote newer, improved hardware configurations.

  • Instance Size (e.g., 2xlarge): Defines the proportion of compute, memory, storage, and networking capacity within the instance family.

• Major EC2 Instance Categories:

  • General Purpose:

  • Provides a balanced ratio of compute, memory, and networking resources.

  • Suitable for diverse workloads that utilize CPU, memory, and networking in equal proportions.

  • Use Cases: Web servers, code repositories, microservices, small-to-medium databases.

  • Families: Mac, T4g, T3, T3a, T2 (e.g., t2.micro), M6g, M5, M5a, M5n, M5zn, M4, A1.

  • Compute Optimized:

  • Engineered for compute-bound applications requiring high-performance processing capability.

  • Use Cases: High-performance web servers, batch processing workloads, media transcoding, High Performance Computing (HPC), scientific modeling, dedicated gaming servers, ad server engines, machine learning inference.

  • Families: C6g, C6gn, C5, C5a, C5n, C4.

  • Memory Optimized:

  • Designed to deliver rapid performance for workloads processing massive data sets in system memory.

  • Use Cases: High-performance relational and non-relational database management systems, distributed web-scale caching layers (e.g., Redis, Memcached), in-memory databases optimized for Business Intelligence (BI), real-time processing of unstructured big data.

  • Families: R6g, R5, R5a, R5b, R5n, R4, X1e, X1, High Memory, z1d.

  • Storage Optimized:

  • Tailored for storage-intensive applications requiring high sequential read/write access to large data sets on physical local storage.

  • Delivers tens of thousands of low-latency, random Input/Output Operations Per Second (IOPS).

  • Use Cases: High-frequency Online Transaction Processing (OLTP) systems, relational and NoSQL databases, in-memory database caches, data warehousing applications, distributed file systems.

  • Families: I3, I3en, D2, D3, D3en, H1.

  • Accelerated Computing & HPC Optimized:

  • Designed for compute-heavy parallel processing tasks using specialized hardware acceleration (e.g., GPUs, FPGAs).

• Specific Instance Specification Examples:

  • t2.micro:

  • vCPU: $1$

  • Memory: $1\,GiB$

  • Storage: EBS-Only

  • Network Performance: Low to Moderate

  • EBS Bandwidth: Standard

  • t2.xlarge:

  • vCPU: $4$

  • Memory: $16\,GiB$

  • Storage: EBS-Only

  • Network Performance: Moderate

  • EBS Bandwidth: Standard

  • c5d.4xlarge:

  • vCPU: $16$

  • Memory: $32\,GiB$

  • Storage: $1 \times 400\,NVMe\text{ SSD}$

  • Network Performance: Up to $10\,Gbps$

  • EBS Bandwidth: $4,750\,Mbps$

  • r5.16xlarge:

  • vCPU: $64$

  • Memory: $512\,GiB$

  • Storage: EBS-Only

  • Network Performance: $20\,Gbps$

  • EBS Bandwidth: $13,600\,Mbps$

  • m5.8xlarge:

  • vCPU: $32$

  • Memory: $128\,GiB$

  • Storage: EBS-Only

  • Network Performance: $10\,Gbps$

  • EBS Bandwidth: $6,800\,Mbps$

• Utility Resource:

  • Detailed instance hardware specification cross-comparisons can be viewed at https://instances.vantage.sh.

AWS Security Groups Deep Dive

• Security Groups serve as fundamental network security mechanisms acting as virtual firewalls directly attached to EC2 instances.

• Key Operational Characteristics:

  • Rules contain ALLOW statements only; explicitly specifying deny rules is not supported.

  • Traffic evaluated by Security Groups occurs outside the EC2 instance OS. If incoming traffic is blocked by a Security Group, it never hits the instance network adapter.

  • Bound strictly to a specific AWS Region and VPC (Virtual Private Cloud) combination.

  • Can be associated with multiple EC2 instances simultaneously.

• Default Security Group Behavior:

  • All Inbound traffic is BLOCKED by default.

  • All Outbound traffic is AUTHORIZED by default.

• Rule Referencing Capabilities:

  • Traffic rules can target specific IPv4 or IPv6 IP addresses / CIDR blocks.

  • Rules can directly reference other Security Groups as a source or destination target.

  • When Security Group A references Security Group B, any instance attached to Security Group B is permitted communication access under that rule.

• Diagnostics and Connection Errors:

  • Connection Timeout / Hanging Request: Indicates an inbound traffic blocking issue enforced by a Security Group or network access control layer.

  • Connection Refused Error: Indicates that network traffic reached the instance, but no backend application service is listening on that port or the application service crashed.

• Recommended Practice:

  • Maintain an isolated, dedicated Security Group exclusively configured for SSH network administration access.

Network Ports and Remote Management Protocols

• Essential Networking Ports:

  • Port $22$: SSH (Secure Shell) — Used for encrypted terminal access to Linux instances.

  • Port $21$: FTP (File Transfer Protocol) — Used for transferring files to remote file systems.

  • Port $22$: SFTP (Secure File Transfer Protocol) — Used for secure, encrypted file transfers utilizing SSH tunnels.

  • Port $80$: HTTP — Used for unencrypted web traffic.

  • Port $443$: HTTPS — Used for encrypted web traffic using TLS/SSL.

  • Port $3389$: RDP (Remote Desktop Protocol) — Used for graphical desktop logins to Windows Server instances.

• SSH Access Methods Across Operating Systems:

  • macOS / Linux:

  • Native terminal environment using OpenSSH tools (ssh -i key.pem user@ip).

  • Configuration simplifies via ~/.ssh/config file settings.

  • Windows (< 10):

  • Requires third-party SSH client tools like PuTTY.

  • Windows (>= 10):

  • Standard Windows Command Prompt, PowerShell, or OpenSSH terminal utility, or PuTTY.

  • Universal Access (Browser-based):

  • EC2 Instance Connect.

• EC2 Instance Connect Specifications:

  • Allows browser-based CLI access directly inside the AWS Management Console.

  • Dynamically pushes an ephemeral, single-use public SSH key directly onto the instance instance-metadata layer.

  • Works natively out-of-the-box with Amazon Linux 2.

  • Requires Port $22$ to remain configured and open on the instance Security Group.

EC2 Instance Purchasing Models

• AWS offers multiple purchasing models to optimize infrastructure spend based on workload availability and stability requirements:

• 1. On-Demand Instances:

  • Flexible pay-as-you-go model with no long-term financial commitment or upfront cost.

  • Billing Granularity:

  • Linux and Windows: Billed per second (after an initial minimum threshold of $1\text{ minute}$).

  • Other OS types: Billed hourly.

  • Represents the highest per-hour rate.

  • Best Suited For: Short-term, unpredictable, non-interruptible workloads where baseline runtime patterns cannot be anticipated.

• 2. Reserved Instances (RI):

  • Up to $72\%$ cost reduction relative to On-Demand rates.

  • Term Commitment: Commitment to $1\text{ year}$ or $3\text{ years}$.

  • Payment Options:

  • No Upfront: Lowest discount rate, zero initial cost.

  • Partial Upfront: Medium discount rate, partial upfront payment.

  • All Upfront: Maximum discount rate, full term paid initial step.

  • Scope Attributes:

  • Regional Scope: Applies billing discounts across all Availability Zones within an AWS Region.

  • Zonal Scope: Reserves exact physical capacity within a specific single Availability Zone.

  • Recommended For: Steady-state, long-term predictable server environments (e.g., enterprise database backends).

  • Marketplace: Reserved Instances can be purchased or sold on the AWS Reserved Instance Marketplace.

• 3. Convertible Reserved Instances:

  • Up to $66\%$ cost savings relative to On-Demand pricing.

  • Provides flexibility to modify EC2 instance family, instance type, OS, scope, and tenancy throughout the term duration.

• 4. Savings Plans:

  • Offers up to $72\%$ savings based on a commitment to a specific hourly spend amount (e.g., \\$10/\text{hour}) over $1\text{ year}$ or $3\text{ years}$.

  • Any usage exceeding the committed hourly limit is billed at normal On-Demand rates.

  • Bound to a specific instance family within a chosen AWS Region (e.g., M5 in us-east-1).

  • Provides flexible scaling across:

  • Instance sizes (e.g., swapping m5.xlarge to m5.2xlarge).

  • Operating Systems (e.g., Linux, Windows).

  • Tenancy options (Default, Dedicated Host, Dedicated Instance).

• 5. Spot Instances:

  • Offers the maximum cost reduction of up to $90\%$ compared to On-Demand prices.

  • Underutilized EC2 capacity that AWS can reclaim at any time with a $2\text{-minute}$ warning notice if the current spot market price exceeds your defined bid price.

  • Recommended For: Failure-tolerant, stateless, flexible, or distributed computational workloads:

  • Batch job processing.

  • Big data analysis pipelines.

  • Image and video processing clusters.

  • Workloads with dynamic or flexible start and finish windows.

  • Unsuitable For: Critical application servers, monolithic services, or persistent database instances.

• 6. Dedicated Hosts:

  • Physical servers fully dedicated to a single customer's compute usage.

  • Address strict regulatory compliance demands and allow execution of existing server-bound software licenses (BYOL — Bring Your Own License models charged per-socket, per-core, or per-VM).

  • Purchasing Options: Available On-Demand (per-second billing) or Reserved ($1\text{ year}$ or $3\text{ years}$ term commitments).

  • Highest overall price point among purchasing models.

• 7. Dedicated Instances:

  • Instances running on physical hardware designated exclusively for a single customer account.

  • May share physical hardware with other instances operating within the same AWS account.

  • Does not provide granular control over placement location on physical hardware host machines (hardware target can shift across instance Stop/Start cycles).

  • Pricing includes standard instance usage plus a fixed regional fee of \\$2/\text{hour}.

• 8. Capacity Reservations:

  • Reserves physical On-Demand compute capacity in a targeted Availability Zone for any duration.

  • Ensures guaranteed capacity availability without continuous long-term financial commitments (can be activated or canceled at any time).

  • Does not supply billing discounts directly (billed at standard On-Demand rates regardless of whether an instance is running in the reserved slot).

  • Can be combined with Regional Reserved Instances or Savings Plans to secure both capacity guarantees and discounted billing.

• Comparison Table — Dedicated Instances vs. Dedicated Hosts:

• Cost Comparison Benchmark Example (m4.large in us-east-1 Region):

| Pricing Tier | Hourly Cost () | Relative Discount |\n| :--- | :---: | :---: |\n| On-Demand | \$0.100 | Baseline |\n| Spot Instance (Market Spot Rate) | \$0.038 - \$0.039$| Up to$61\% discount |\n| Reserved Instance (1\text{ year}$) |$\$0.058 - \$0.062$| Up to$42\% discount |\n| Reserved Instance (3\text{ years}$) |$\$0.037 - \$0.043$| Up to$63\% discount |\n| EC2 Savings Plan (1\text{ year}$) |$\$0.058 - \$0.062$| Up to$42\% discount |\n| Convertible Reserved Instance (1\text{ year}$) |$\$0.066 - \$0.071$| Up to$34\% discount |\n| Dedicated Host (On-Demand) | Standard On-Demand Host Rate | Baseline Host Rate |\n| Dedicated Host Reservation | Discounted Host Rate | Up to 70\% discount |\n| Capacity Reservations | \$0.100$$ | Standard On-Demand Rate |

Shared Responsibility Model for Amazon EC2

• AWS Responsibility (Security OF the Cloud):

  • Global physical infrastructure security, datacenter facilities, and perimeter security.

  • Isolation of hardware virtual machines on underlying physical host infrastructure.

  • Maintenance and replacement of failing physical host hardware.

  • Compliance validation and audit certification of physical infrastructure.

• Customer Responsibility (Security IN the Cloud):

  • Configuration of firewall rules (Security Group inbound/outbound setup).

  • Guest OS patch updates, kernel updates, and software stack maintenance.

  • Management of third-party software installations and administrative utilities.

  • Identity and Access Management (IAM) role assignments to instances and account user permission management.

  • Data protection, client-side encryption, and disk volume security configuration.