Amazon EC2 Basics

• Definition: Web service providing resizable compute capacity (virtual servers called "instances").
• AMIs: Preconfigured templates for instances (OS, software).
• Supported OS: Amazon Linux, Ubuntu, Windows Server, MacOS, RHEL, SUSE, Fedora, Debian, CentOS, Gentoo, Oracle Linux, FreeBSD.
• ECUs: EC2 Compute Units, measure integer processing power.
• Control: Full OS-level control (root/admin access).
• Key Pairs: Public (AWS stored) & Private (user stored) for secure connection.
  • Windows AMIs: Private key for password retrieval.
  • Linux AMIs: Private key for SSH.
• Metadata & User Data:
  • User Data: Script supplied at instance launch (max 16KB), run once at startup. Not encrypted.
  • Instance Metadata: Data about the instance itself. Not encrypted.
  • Access: Both available at http://169.254.169.254/latest/meta-data/ and http://169.254.169.254/latest/user-data (link-local address, accessible only from instance).
  • Tool: Instance Metadata Query tool simplifies querying.

EC2 Instance Types

• Optimized for different use cases (CPU, memory, storage, networking).
• Categories:
  • General Purpose: Balance of resources (e.g., T, M series).
  • Compute Optimized: High-performance processors (e.g., C series).
  • Memory Optimized: Large in-memory data sets (e.g., R, X, Z series, High Memory).
  • Accelerated Computing: Hardware accelerators/co-processors (e.g., P, G, F, VT series).
  • Storage Optimized: Low latency, high I/O performance NVMe SSDs (e.g., I, D, H series).

Launching EC2 Instances

• Choose an AMI.
• Auto-assign Public IP (default uses subnet setting).
• Add to Placement Group (optional).
• Assign IAM Role (more secure than storing credentials).
• Enable Termination Protection (prevents accidental termination).
• Monitoring: Basic (5-min, default) or Detailed (1-min, chargeable).
• Tenancy: Shared or Dedicated.
• T2/T3 Unlimited: Allows bursting past CPU baseline (chargeable).
• Add User Data script.
• Join to a directory (Windows only).
• Enable Elastic GPU (Windows only).
• Storage: Add volumes, choose type, encrypt non-root volumes (root can be encrypted at launch).
• Tags: Optional, for management.
• Security Group: Select existing or create new.
• Key Pair: Required for SSH access (or use AmazonEC2RoleforSSM for Systems Manager).
• EFS: Can mount a shared filesystem to multiple EC2 instances.

Amazon Machine Images (AMIs)

• Provides info to launch an instance:
  • Template for root volume (OS, apps).
  • Launch permissions.
  • Block device mapping.
• Regional: Can only launch from region stored, but can be copied to other regions.
• Volume Types:
  • EBS: Persistent storage, created from S3 snapshots.
  • Instance Store: Ephemeral (non-persistent), data lost on shutdown, created from S3 templates.

Billing and Provisioning Models

On-Demand

• Pay-as-you-go, no upfront commitment.
• Low cost, flexible, ideal for unpredictable workloads, dev/test.

Spot Instances

• Up to 90% discount on unused EC2 capacity.
• Ideal for stateless, fault-tolerant, flexible apps (big data, containers, CI/CD, web servers, HPC, test/dev).
• Pricing: Determined by long-term supply/demand trends (no bidding required in new model).
• Interruption: 2-minute notice when instances are about to be reclaimed. Not interrupted by higher bids.
• Optimization: Diversify across multiple capacity pools (instance family, size, AZ, region).
• Spot Fleet: Use RequestSpotFleet API for large-scale requests.
• Can stop/hibernate instead of terminating on interruption.

Reserved Instances (RIs)

• Purchase usage in advance (1 or 3 years) for significant discounts.
• Provides capacity reservation if used in a specific AZ (Zonal RI).
• AWS Billing automatically applies discounted rates.
• Types: Standard, Convertible, Scheduled.
  • Standard: 1 or 3 years, charged whether on/off.
  • Scheduled: Reserved for specific recurring periods (1 year term).
  • Convertible: Allows changing instance family, OS, tenancy, payment options (vs. Standard which only allows AZ/size change within same type for Linux).
• Ideal for steady-state workloads, predictable usage, and applications needing reserved capacity.
• Upfront payments reduce hourly rate.
• Can switch AZ within same region; change instance size within same instance type (Linux only).
• Billed whether running or not.
• Can be sold on AWS Marketplace.
• Can be used in Auto Scaling Groups and Placement Groups.
• Shared across accounts with Consolidated Billing.

Dedicated Hosts

• Physical servers dedicated to your use.
• Control over instance deployment on host.
• Available On-Demand or with Dedicated Host Reservation.
• Useful for server-bound software licenses (per-core, per-socket, per-VM).
• Each host runs only one EC2 instance size/type.
• Good for regulatory compliance, licensing, predictable performance, complete isolation.
• Most expensive option; billed per host.

Dedicated Instances

• Virtualized instances on hardware dedicated to you.
• Uses physically dedicated EC2 servers but without host-level visibility/controls of Dedicated Hosts.
• Billed per instance (additional $2/hour/region).
• May share hardware with other non-dedicated instances in same account.
• Available as On-Demand, RIs, Spot.

Billing Notes:

• Instances billed when in running state; stop/terminate to avoid charges.
• Linux instances billed by the second; others by the hour.
• Data transfer between instances in different regions is charged.
• Regional Data Transfer rates apply if instances are in different AZs OR if Public/Elastic IPs are used (charged once).

Networking

• Default Limits (per region/specified):
  • EC2-Classic/VPC Elastic IPs: 5 each
  • VPCs: 5
  • Subnets per VPC: 200
  • Security Groups per VPC: 500
  • Rules per VPC Security Group: 50
  • VPC Security Groups per ENI: 5
  • Network Interfaces: 350
  • Network ACLs per VPC: 200, Rules per NACL: 20
  • Route Tables per VPC: 200, Entries per RT: 50
  • Active VPC peering connections: 50, Outstanding requests: 25
  • Unaccepted VPC peering connection expiry: 168 hours.

IP Addresses

• Public IP: Auto-assigned in public subnets, lost on stop/start. No charge. Cannot be moved.
• Private IP: Auto-assigned to all instances, retained on stop/start.
• Elastic IP (EIP): Static public IP. Retained on stop. Can be remapped between instances/ENIs.
  • Limit: 5 per region (soft limit).
  • Charge: When not used (associated with a running instance).
  • Regional only. Can be tagged.
  • Secondary IPs useful for HA (multiple websites, standby instances).
  • Can associate a private IPv4 with an EIP.
  • IPs remain attached to ENI when detached/reassigned.
• BYOIP (Bring Your Own IP): Bring publicly routable IPv4/IPv6 ranges from on-premises to AWS. You own the range, AWS advertises it. Not available in all regions/resources.
• Exam Tip: Stop/start EC2 to move to different physical host if status checks fail or for maintenance.
• Modifiable when stopped: Instance type, user data, kernel, RAM disk.

Elastic Network Interfaces (ENIs)

• Logical networking component in a VPC, representing a virtual network card.
• Attributes: Primary/secondary private IPv4s, EIPs, public IPv4, IPv6s, security groups, MAC address, source/destination check flag, description.
• Cannot increase bandwidth by teaming multiple ENIs.
• eth0 is primary, cannot be moved/detached.
• Can add additional ENIs (number depends on instance type).
• Bound to an AZ; can specify subnet/AZ.
• Attachment:
  • Hot attached: to running instances.
  • Warm-attached: to stopped instances.
  • Cold-attached: when instance is launched.
• If 2nd ENI added, AWS won't assign public IP to eth0 (need EIP).
• Default interfaces terminate with instance; manually added ones don't by default (can change behavior).

Enhanced Networking (ENA)

• Higher bandwidth, PPS, lower inter-instance latency.
• Enabled using Elastic Network Adapter (ENA).
• Use if PPS rate is ceilinged (VIF driver limit).
• Uses SR-IOV (direct access to network adapters).
• Requires HVM AMI with drivers; available for certain instance types; VPC only.

Elastic Fabric Adapter (EFA)

• ENA with added capabilities; supports OS bypass.
• Allows applications to access network interface without OS involvement for each message.
• Enhances performance of inter-instance communications at scale.
• Use Cases: HPC (Message Passing Interface - MPI), Machine Learning (NVIDIA NCCL).
• Offers on-premises HPC cluster performance with cloud elasticity.
• Optional EC2 networking feature, no additional cost.

ENI vs ENA vs EFA

• ENI: Basic adapter, no high-performance needs, all instance types.
• ENA: Higher bandwidth/lower latency, limited HVM instance types.
• EFA: HPC, MPI/ML, tightly coupled apps, all instance types.

Placement Groups

• Logical grouping of instances.
• Types:
  • Cluster: Low-latency, high-throughput group in a single AZ. Recommended for apps with high inter-instance traffic.
  • Spread: Instances spread across distinct underlying hardware. Reduces simultaneous failure risk. Max 7 instances per group per AZ. Can span multiple AZs.
  • Partition: Divides group into logical segments (partitions) with distinct hardware racks (own network/power). Isolates hardware failure impact. For large distributed/replicated workloads (HDFS, HBase, Cassandra). Not supported for Dedicated Hosts.
• Performance: Best with private IPs (10/25 Gbps); public IPs limit to 5 Gbps.
• Recommended to use homogenous instance types.
• Can use RIs at instance level, but cannot reserve capacity for the group itself.
• Name must be unique per account/region.
• Cannot merge PGs; instance in one PG at a time.
• On-Demand Capacity Reservation & Zonal RIs can be used by instances in a PG, but don't explicitly reserve PG capacity.
• Instances with host tenancy cannot be launched in PGs.

IAM Roles

• More secure than storing access keys on instances.
• Allow EC2 to interact with other AWS services (S3, DynamoDB).
• Easier to manage, more secure.
• Can be attached/modified/replaced at launch or anytime via CLI/SDK/console.
• Only one IAM role per EC2 instance at a time.
• Universal (can be used in any region).

Bastion/Jump Hosts

• EC2 instances configured to access VPC instances for management.
• Use SSH or RDP protocols.
• Require specific security group permissions.
• Can use auto-assigned public IPs or EIPs.
• Restrict access via security group IP/CIDR rules.
• Use Auto Scaling Groups for HA (set min to 1 for replacement).
• Best practice: Deploy Linux bastion hosts in two AZs, use ASG, and EIPs.
• Alternative: AWS Systems Manager Session Manager (more secure, no SSH keys needed).

Monitoring EC2

• EC2 status checks performed every minute (Pass/Fail).
• Overall status: OK (all pass) or Impaired (one or more fail).

EC2 Status Checks

• System Status Checks (StatusCheckFailed_System): Problems requiring AWS involvement (network loss, power loss, physical host issues).
• Instance Status Checks (StatusCheckFailed_Instance): Problems requiring your involvement (failed system checks, incorrect config, exhausted memory, corrupted filesystem, incompatible kernel).
• Cannot be disabled/deleted.
• Can create CloudWatch alarms to monitor and perform actions:
  • Recover instance (only for StatusCheckFailed_System, specific types).
  • Stop instance (EBS-backed only).
  • Terminate instance (if termination protection disabled).
  • Reboot instance (best practice to use EC2 reboot vs. OS reboot).
• CloudWatch Monitoring Frequency: Standard (5 mins), Detailed (1 min, chargeable).

Unified CloudWatch Agent

• Collects more system-level metrics from EC2 (in-guest metrics) and on-premises servers.
• Retrieves custom metrics via StatsD (Linux/Windows) and collectd (Linux only).
• Collects logs from EC2 and on-premises servers (Linux/Windows).
• Install manually or integrate with SSM.

Logging and Auditing (CloudTrail)

• Amazon EC2 & EBS integrated with AWS CloudTrail.
• CloudTrail records all API calls (console, code) for EC2/EBS as events.
• Create a trail for continuous delivery of events to S3 (indefinite storage).
• If no trail, view recent 90 days in CloudTrail Event history.
• Helps determine who, what, when, where (IP), and how requests were made.

Tags & Resource Groups

• Tags: Metadata (key/optional value) assigned to AWS resources.
• Used for management, identification, organization, search, filtering.
• Strategies: Cost allocation, security (IAM policies), automation.
• Enforce tagging via AWS Config rules or custom scripts.
• Most resources support up to 50 tags.
• Resource Groups: Mappings of AWS assets defined by tags.
• Create custom consoles to consolidate metrics, alarms, config details based on tags.

High Availability Approaches For Compute

• Up-to-date AMIs for rapid failover.
• Copy AMIs to other regions for safety/DR.
• Prefer horizontally scalable architectures (spread risk).
• Reserved Instances: Only way to guarantee resource availability.
• Auto Scaling & Elastic Load Balancing: Automated recovery (maintain min instances).
• Amazon Route 53 health checks: "Self-healing" traffic redirection.

Migration

VM Import/Export

• Tool for migrating VMware, Microsoft, XEN VMs to/from AWS.
• Supports Windows and Linux.
• VMware ESX VMDKs (OVA for export), Citrix XEN VHD, Microsoft Hyper-V VHD.
• API/CLI only (not console).
• Stop VM before generating images.
• AWS VM connector plugin for vCenter: Migrates VMs to S3, converts to EC2 AMI, tracks progress in vCenter.

AWS Server Migration Service (SMS)

• Agent-less service for migrating thousands of on-premises workloads to AWS.
• Automates, schedules, tracks incremental replications of live server volumes.
• Migrates VMware vSphere or Microsoft Hyper-V/SCVMM VMs to AWS.
• Replicates VMs to AWS, syncs volumes, creates periodic AMIs.
• Minimizes cutover downtime.
• Supports Windows and Linux.
• Uses Server Migration Connector (virtual appliance) in on-premises environment.

Management Tools

• AWS Systems Manager (for managing instances).
• AWS OpsWorks (manage instances using Chef/Puppet).
• AWS Config (record configuration items, track changes).