EC2 · Elastic Compute Cloud

Outcome

• Launch to ProductionLaunch, Access, Security Groups, IMDS
  • Launch an instance with correct AMI, instance type, and security group
  • Explain the difference between stop/start and terminate
  • SSH in and explain what goes wrong with wrong username vs wrong key vs blocked port
  • Query IMDS with IMDSv2 and explain why the token step exists
  • Explain the difference between a silent drop (SG block) and connection refused (closed port)
• Launch to ProductionUser Data + IAM Instance Profile + S3 Access
  • Write a user data script and explain when it runs and as whom
  • Distinguish Task Execution Role (ECS) from Instance Profile (EC2), same concept, different wrapper
  • Call S3 from inside an instance with zero hardcoded credentials
  • Explain the credential provider chain and where IMDS fits in it
  • Know where to look when user data silently fails
• Launch to ProductionStorage: EBS + EFS
  • Attach, format, and mount an EBS volume
  • Explain why EBS is AZ-scoped and what that means for migrations
  • Detach an EBS volume and reattach to a different instance
  • Create an EFS file system with mount targets and mount it on two instances
  • Explain when to use EBS vs EFS vs S3 from memory
• Launch to ProductionAMI Creation + Immutable Infrastructure
  • Create an AMI from a running instance
  • Launch an instance from the AMI and confirm it comes up pre-configured
  • Explain how user data composes with an AMI (base vs runtime layer)
  • Explain the immutable infrastructure pattern and why you don't modify running instances
• Launch to ProductionLaunch Templates + Auto Scaling Groups + ALB
  • Write a launch template and explain each field
  • Create an ASG with min/max/desired and wire it to an ALB
  • Manually terminate an instance and observe ASG self-healing
  • Trigger an instance refresh and explain how it maps to an ECS rolling deployment
  • Explain why health-check-type ELB is better than the default EC2 health check
• Launch to ProductionModern Access: SSM Session Manager + EC2 Instance Connect
  • Start an SSM session with zero open ports
  • Explain the three problems SSM solves over traditional SSH
  • Explain what AmazonSSMManagedInstanceCore enables and what breaks without it
  • Explain the difference between SSM Session Manager and EC2 Instance Connect
  • Know when to use each in practice
• Launch to ProductionBastion Hosts & Private Resource Access
  • Explain why bastions exist and when you need one
  • Draw the relay path: laptop → SSM → bastion → private resource
  • Configure security group rules using source-SG references (CLIENT_SG pattern)
  • Explain why the bastion is not in the production data path
  • Debug a silent connection timeout using the 5-layer checklist
  • Launch and connect to a bastion via SSM in another lab