Amazon EC2

What it is

Amazon Elastic Compute Cloud (Amazon EC2) provides virtual servers, called instances, in the AWS Cloud. You choose the processor, memory, storage, networking, and operating system, launch as many instances as you need, and pay only while they run. You control the instance completely, from the operating system up, which also means you are responsible for patching it, securing it, and keeping it available.

Almost every architecture question on the exam involves EC2 somewhere: as a web or application tier behind a load balancer, as workers reading from a queue, or as the compute that another service, such as Elastic Beanstalk, AWS Batch, or Amazon EMR, runs for you.

Instance types

An instance type sets the hardware. Its name shows the family, generation, options, and size: in c7gn.xlarge, c is the family (compute optimized), 7 the generation, g means AWS Graviton (Arm) processors, n means extra network bandwidth, and xlarge is the size.

Category	Families (examples)	Choose for
General purpose	M, T (burstable)	Balanced workloads: web servers, small databases, development
Compute optimized	C	CPU-heavy work: batch processing, media encoding, gaming servers, scientific modeling
Memory optimized	R, X, U (high memory)	Large data in memory: in-memory databases and caches, real-time analytics
Storage optimized	I, D	High, low-LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry local disk I/O: NoSQLDatabases that store data in models other than relational tables, such as key-value, document, wide-column, or graph, usually to scale out easily or to handle data whose shape varies. Amazon DynamoDB is a NoSQL database.Glossary entry databases, Data warehouseA database designed for analytics, holding cleaned, structured data from many sources, so that reports and queries across years of history run fast. Amazon Redshift is the AWS data warehouse.Glossary entry, distributed file systems
Accelerated computing	P, G (GPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entry), Trn, Inf	ML (Machine learning)Software that learns patterns from example data to make predictions or decisions, instead of following rules written by hand. A model is first trained on data, then used to make predictions on new data, which is called inference.Glossary entry training and inference, graphics, video
HPC (High performance computing)Using many powerful computers together on large problems, such as simulations, genomics, or weather forecasting, often with fast networking between them. On AWS it uses EC2 instances with Elastic Fabric Adapter, AWS Batch, and AWS ParallelCluster.Glossary entry	Hpc	Tightly coupled HPC simulations

T instances are burstable: they earn CPU credits while below their baseline and spend them in bursts, which suits workloads that are usually quiet. In standard mode, CPU drops back to the baseline when the credits run out; in unlimited mode, the default for T3, T3a, T4g, and newer T instances, the instance keeps bursting and you pay for the extra credits. A steady high CPU load suits a fixed-performance M or C instance instead. Graviton instances (with g in the name) usually give better price-performance for software that runs on Arm.

Launching instances

An AMI (Amazon Machine Image)A template for launching EC2 instances: the operating system, software, and settings to copy onto the new instance's volumes, plus who may launch it. AMIs come from AWS, AWS Marketplace, or the community, or you create your own from an instance.Glossary entry (AMI) is the template for the root volume: operating system, software, and settings. AMIs are Regional: to launch in another AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry, copy the AMI there. You can share AMIs with other accounts. To share an AMI whose snapshots are encrypted, use a customer managed KMS key and allow the target accounts to use that key; AMIs encrypted with the AWS managed aws/ebs key can't be shared. A "golden AMI" with your software already installed makes instances start faster than installing everything at boot.
User data runs commands or cloud-init directives when an instance first boots, for example to install packages or pull the latest code. It runs as root, is limited to 16 KB, and runs only on the first boot by default. Don't put secrets in it; anyone who can view the instance's attributes or metadata can read it.
A launch template saves all the launch settings (AMI, instance type, key pair, Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry, user data, and more) in versions, and is what EC2 Auto Scaling uses.

Purchasing options

Option	How it works	Choose when
On-Demand	Pay by the second (minimum 60 seconds) for Linux and Windows, with no commitment	Short, unpredictable, or new workloads
Savings Plans	Commit to dollars per hour for 1 or 3 years, for up to 72% off	Steady usage, with flexibility over instance types
RI (Reserved Instance)A billing discount for committing to an instance type in a Region or Availability Zone for one or three years. It is not an instance: running instances that match are billed at the lower rate. AWS now recommends Savings Plans instead.Glossary entry	Commit to an instance configuration for 1 or 3 years; zonal RIs also reserve capacity	Steady usage of a known configuration
Spot Instances	Spare capacity at a steep discount; EC2 can reclaim it with a two-minute warning	Fault toleranceThe ability of a system to keep working without interruption when a component fails, because enough redundant capacity is already running. It goes further than high availability, which may allow a short failover.Glossary entry, flexible work: batch, data analysis, CI/CD (Continuous integration and continuous delivery)Practices in which every code change is built and tested automatically (continuous integration) and kept ready to release, often deploying it automatically through a pipeline (continuous delivery or deployment).Glossary entry, StatelessKeeping no memory of earlier requests, so that each one is handled on its own. Any copy of a stateless web server can handle any request, which makes scaling easy; a stateless firewall, such as a network ACL, needs a rule for return traffic too.Glossary entry web servers
Dedicated Hosts	A whole physical server for you, with visibility of sockets and cores	Bring-your-own-license software licensed per socket, core, or VM (Virtual machine)A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.Glossary entry, or compliance needs
Dedicated Instances	Instances on hardware that no other customer uses	Single-tenant hardware without host-level control
On-Demand Capacity Reservations	Reserve capacity in one AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry, for any duration, at On-Demand rates	Capacity must be guaranteed, for example for a launch event or DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry
Capacity Blocks for ML	Reserve GPU instances for a future period	Short machine learning training runs

Two points the exam likes to test:

Savings Plans and regional RIs give a discount but no capacity guarantee. Combine them with a Capacity Reservation when you need both.
Compute Savings Plans apply to EC2 in any instance family, size, OS, and Region, and also to AWS Fargate and AWS Lambda. EC2 Instance Savings Plans give a bigger discount but are tied to one instance family in one Region. Choose Compute Savings Plans when the workload will change families, Regions, or move to containers or serverless.
Spot Instances suit work that can be interrupted. Use many instance types and Availability Zones, the price-capacity-optimized allocation strategy, and react to the rebalance recommendation and the two-minute interruption notice. Interrupted instances can be terminated, stopped, or hibernated. A maximum Spot price doesn't prevent interruption: EC2 reclaims capacity whenever it needs it back, and setting a maximum price only adds another reason to interrupt. Savings Plans do not apply to Spot.

Placement groups

Strategy	Placement	Choose for
Cluster	Packed close together in one Availability Zone	Lowest latency and highest throughput between instances, such as HPC
Partition	Divided into partitions on separate racks, up to 7 partitions per Availability Zone	Large distributed systems that are aware of their topology, such as HDFS, HBase, or Cassandra
Spread	Each instance on distinct hardware, up to 7 running instances per Availability Zone per group	A small number of critical instances that must not fail together

For cluster placement groups, launch all instances in one request with the same instance type to avoid capacity errors.

Storage and networking

Amazon EBS volumes are network-attached and persist independently of the instance. They are the usual root and data volumes. EBS is covered with the storage services.
By default, the root EBS volume is deleted when the instance terminates (its DeleteOnTermination attribute is true), while data volumes are usually kept. Set DeleteOnTermination to false to keep the root volume, and turn on termination protection to refuse terminate requests from the console, CLI, or API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry. Termination protection doesn't stop Auto Scaling from terminating instances.
Instance store is temporary disk physically attached to the host, with very high I/O and no extra charge. The data survives a reboot but is lost when the instance stops, hibernates, or terminates, or the disk fails. Use it for caches, buffers, and scratch data, or for data replicated across instances.
A public IPv4 address changes when an instance stops and starts. An Elastic IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address is a static public IPv4 address that you can remap to another instance. AWS charges for all public IPv4 addresses, including Elastic IPs, whether in use or idle. The default quota is five Elastic IPs per Region.
An ENI (Elastic network interface)A virtual network card in a VPC subnet, with private IP addresses, security groups, and a MAC address. EC2 instances, Lambda functions connected to a VPC, and interface endpoints all connect through network interfaces.Glossary entry (ENI) is a virtual network card that keeps its private IP addresses, MAC address, and security groups. A secondary ENI can be detached and attached to another instance in the same Availability Zone, which is a simple FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry for software tied to a fixed private IP or MAC address. The primary interface can't be detached.
Enhanced networking (ENA) gives higher bandwidth and lower latency on current instance types. An Elastic Fabric Adapter (EFA) adds OS-bypass networking for HPC and machine learning applications that use MPI or NCCL; EFA traffic cannot cross Availability Zones.

Security, resilience, performance, and cost

Security

Security groups are StatefulKeeping track of earlier requests or connections. A stateful firewall, such as a security group, remembers allowed connections and lets their return traffic back in automatically.Glossary entry firewalls around each instance, allowing only the ports you need. See VPC security layers.
Give applications on an instance AWS permissions through an IAM role attached as an instance profile. The application then receives temporary credentials that rotate automatically, so no access keys are stored on the instance. See IAM roles and temporary credentials.
The Instance Metadata Service (IMDS), at 169.254.169.254, tells an instance about itself and provides its role credentials. IMDSv2 requires a session token obtained with a PUT request, which protects against server-side request forgery (SSRF) and open proxies. Require IMDSv2 on your instances.
Connect without opening SSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entry or RDP ports, Bastion hostA hardened server in a public subnet that administrators connect to first, and from there to instances in private subnets. Session Manager in AWS Systems Manager can replace it without any open inbound ports.Glossary entry, or SSH keys by using AWS Systems Manager Session Manager.
EBS encryption by default is a per-Region setting that encrypts every new volume and snapshot.

Resilience

A single instance runs in one Availability Zone. For HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry, run instances in several Availability Zones behind a load balancer, with an Auto Scaling group that replaces failed instances.
Status checks run every minute. A failed system status check means a problem with the AWS host, which AWS fixes; stopping and starting an EBS-backed instance usually moves it to a new host. A failed instance status check means a problem inside the instance, such as exhausted memory or a corrupted file system, that you fix.
Automatic instance recovery moves an instance to new hardware when its system status check fails. Simplified automatic recovery is on by default for supported instances; a CloudWatch alarm recover action is the configurable alternative. The recovered instance keeps its instance ID, private, public, and Elastic IP addresses, metadata, and EBS volumes, but loses what was in memory.
Hibernation saves the instance's RAM to its encrypted EBS root volume, and restores it on start, so long-starting applications resume where they were. You pay only for storage while it is hibernated.
Back up instances with EBS snapshots, AMIs, or AWS Backup.

Performance

Choose the instance family for the bottleneck: CPU (C), memory (R or X), local disk I/O (I), or GPU (P or G).
Use cluster placement groups and EFA for tightly coupled HPC, and enhanced networking everywhere.
Scale horizontally with Auto Scaling rather than relying on one large instance.

Cost

Match the purchase option to the usage: Savings Plans or RIs for the steady baseline, On-Demand for the variable part, and Spot for interruptible work.
Right-size instances using AWS Compute Optimizer, and stop or terminate idle ones; stopped instances incur no instance charge, but their EBS volumes and Elastic IPs are still charged.
Release unused Elastic IPs and avoid unnecessary public IPv4 addresses.
Consider Graviton instances for better price-performance.

Monitoring

Amazon CloudWatch receives instance metrics such as CPUUtilization, NetworkIn, NetworkOut, and status checks. Basic monitoring sends most metrics every 5 minutes at no charge; detailed monitoring sends them every 1 minute, for a fee.
Memory and disk space are not visible from outside the instance; install the CloudWatch agent to collect them.
Alarm on StatusCheckFailed, and use AWS CloudTrail to see who launched, stopped, or changed instances.

EC2 or another compute service?

If the requirement is	Choose
Full control of the operating system and software	Amazon EC2
Deploy web application code without managing servers	AWS Elastic Beanstalk
Run code in response to events, with no servers at all	AWS Lambda
Run containers without managing servers	Amazon ECS or EKS on AWS Fargate
Run large numbers of batch jobs	AWS Batch

Reverse mindmap: when the question points here

Is it Amazon EC2?

Choose the instance
- CPU-bound batch or media encoding leads to Compute optimized (C)
- Large in-memory database or cache leads to Memory optimized (R or X)
- Very high local disk I/O for NoSQL leads to Storage optimized (I) with instance store
- Machine learning training leads to Accelerated computing (P or Trn)
- Steady high CPU drains a T instance's credits leads to Fixed-performance M or C instance
Choose how to pay
- Interruptible batch at the lowest cost leads to Spot Instances
- Steady usage for three years leads to Savings Plans or Reserved Instances
- Discount that follows EC2 changes and moves to Fargate or Lambda leads to Compute Savings Plan
- Per-socket or per-core licenses leads to Dedicated Hosts
- Capacity guaranteed in one Availability Zone leads to On-Demand Capacity Reservation
Place and connect it
- Lowest latency between HPC nodes leads to Cluster placement group and EFA
- Critical instances on separate hardware leads to Spread placement group
- Static public IP to remap after failure leads to Elastic IP address
- Standby must take over a private IP and MAC address leads to Move a secondary ENI
Secure and recover it
- Application on the instance needs S3 access leads to IAM role in an instance profile
- Protect metadata and credentials from SSRF leads to Require IMDSv2
- Connect without opening SSH ports leads to Systems Manager Session Manager
- Instance fails a system status check leads to Automatic instance recovery
- Keep root volume data after termination leads to DeleteOnTermination false
- Prevent accidental terminations leads to Termination protection
- Share an AMI with encrypted snapshots leads to Customer managed KMS key shared with the accounts
- Monitor memory usage leads to CloudWatch agent

Key takeaways

Choose the instance family for the workload's bottleneck, and the purchase option for its usage pattern.
Spot gives the biggest discount but can be reclaimed with a two-minute warning; Savings Plans and RIs discount steady usage; Capacity Reservations guarantee capacity.
Cluster placement groups give the lowest latency in one Availability Zone; spread groups separate up to 7 critical instances per Availability Zone; partition groups suit distributed databases.
Instance store is fast but temporary; EBS persists, but the root volume is deleted on termination by default.
Use IAM roles, require IMDSv2, and run across Availability Zones with Auto Scaling for availability.