Amazon EC2AuthorCloudBrum editorial teamLast reviewed21 Oct 2026Reading time~12 minLevelBeginner to advanced

• Wide choice of instance typesGeneral purpose, compute, memory and storage optimised, plus GPU and other accelerated types.
• AMIsLaunch from AWS, Marketplace or your own machine images.
• Flexible storageAmazon EBS block volumes for persistence, instance store for fast temporary data.
• Auto Scaling & load balancingAdd or remove instances automatically behind Elastic Load Balancing.
• Nitro System & GravitonModern virtualisation, plus Arm-based Graviton processors for price-performance.
• Several purchase optionsOn-Demand, Savings Plans, Reserved Instances and Spot.
• Network & access controlVPC, security groups, IAM roles for instances, optional dedicated hardware.
• Granular billingPer-second billing (60-second minimum) for most Linux instances.

Instance

A virtual server running in AWS. You pay while it runs.

AMI (Amazon Machine Image)

A template with the OS and software used to launch instances.

Instance type

The hardware profile (vCPU, memory, network, storage), e.g. t3.micro, m7g.large.

Region & Availability Zone

A Region is a geographic area; an AZ is one or more isolated data centres inside it.

VPC & subnet

Your private network and the IP ranges inside it where instances live.

Security group

A stateful virtual firewall attached to an instance’s network interface.

EBS volume

Network-attached block storage that persists independently of the instance.

Key pair & IAM role

A key pair enables SSH login; an instance profile gives the instance AWS permissions without stored keys.

User data

A script that runs on first boot to configure the instance. Never put secrets in it.

Instance metadata (IMDS)

A local endpoint an instance uses to read its own details and temporary credentials.

Launch an instance in the AWS Console

1. Open EC2 and choose the RegionSign in to the AWS Console, search for EC2, and pick the Region closest to your users in the top-right selector.
2. Choose “Launch instance” and name itAdd a clear Name tag plus tags such as Env and Owner.
3. Pick an AMIFor example Amazon Linux 2023. Prefer a current, maintained image.
4. Select an instance typeStart small (e.g. t3.micro) and resize later based on metrics.
5. Set up loginCreate or choose a key pair, or skip it and use Session Manager (recommended) with an IAM instance profile.
6. Configure network settingsChoose the VPC and subnet, decide on a public IP, and create a security group. Allow SSH/RDP only from your own IP range, or none at all if using Session Manager.
7. Configure storageUse a gp3 volume and tick Encrypted.
8. Open “Advanced details”Attach the IAM instance profile, set Metadata version to V2 only (IMDSv2), and add user data if needed.
9. Review and launch, then connectWait for the status checks to pass, then connect with Session Manager or EC2 Instance Connect.

• Right-size from data. Use CloudWatch metrics and AWS Compute Optimizer rather than guessing.
• Use current-generation instances built on the Nitro System; consider Graviton (Arm) if your software supports it.
• Match storage to the workload. gp3 lets you set IOPS and throughput independently; use io2 for the most demanding databases; instance store NVMe for scratch data.
• Choose EBS-optimised, network-enhanced types for I/O or network-heavy applications.
• Use placement groups (cluster) for low-latency, high-throughput node-to-node traffic.
• Watch burst credits on T-family instances; move steady, busy workloads to fixed-performance types.
• Scale horizontally with Auto Scaling groups behind a load balancer, and cache content with CloudFront.
• Place workloads near users by choosing the right Region and AZ layout.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Amazon EC2.

• Commit for steady workloads. Savings Plans or Reserved Instances can cut cost substantially versus On-Demand (AWS advertises savings of up to about 72%).
• Use Spot for fault-tolerant work such as batch, CI and stateless workers (AWS advertises up to about 90% off On-Demand).
• Right-size. Downsize underused instances using Compute Optimizer recommendations.
• Switch off non-production outside working hours with Instance Scheduler or simple automation.
• Try Graviton where possible for better price-performance.
• Clean up. Delete unattached EBS volumes, old snapshots and unused Elastic IPs; public IPv4 addresses are billed hourly.
• Prefer gp3 over gp2 for lower cost per GB and tunable performance.
• Watch data transfer. Cross-AZ and internet egress add up; keep chatty services together.
• Tag everything and set Budgets and Cost Anomaly Detection alerts.

• Use IAM instance profiles, never long-lived access keys on the instance.
• Prefer Systems Manager Session Manager over open SSH/RDP ports.
• Require IMDSv2 and set the metadata hop limit to 1.
• Apply least-privilege security groups; reference other security groups instead of wide CIDR ranges.
• Put application servers in private subnets behind a load balancer or NAT.
• Turn on EBS encryption by default for the account and Region.
• Patch with Patch Manager; scan with Amazon Inspector.
• Enable CloudTrail, VPC Flow Logs and GuardDuty; ship OS logs to CloudWatch.
• Store secrets in Secrets Manager or Parameter Store, not in user data.
• Use hardened, approved AMIs only, rebuilt regularly.

For audits, use AWS CloudTrail for who-did-what, AWS Backup for retention policies, and AWS Artifact to download compliance reports. EC2 is in scope for many programmes (for example SOC, ISO 27001, PCI DSS and HIPAA eligibility), but compliance is shared: you remain responsible for how you configure and operate your instances.

• Right-size and switch off idle instances. The greenest server is the one that isn’t running.
• Use efficient hardware. Graviton instances deliver the same work with less energy.
• Pick lower-carbon Regions when latency and data rules allow.
• Autoscale to match demand instead of running at peak all day.
• Use Spot for flexible jobs: it makes use of spare capacity.
• Consider managed or serverless services for spiky workloads; they share infrastructure efficiently.
• Measure it. The AWS Customer Carbon Footprint Tool in the Billing console estimates your emissions.

Purchase options

What you actually pay for

• Instance running time (by type, OS, Region and purchase option)
• EBS volumes, provisioned IOPS/throughput, and snapshots
• Data transfer out to the internet and across AZs/Regions
• Public IPv4 addresses, load balancers and NAT gateways
• Software licences such as Windows Server or RHEL, where applicable

Launch a small, encrypted instance with IMDSv2 required. Replace the placeholder IDs with your own.

# Launch one t3.micro instance
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type t3.micro \
  --subnet-id subnet-0123456789abcdef0 \
  --security-group-ids sg-0123456789abcdef0 \
  --iam-instance-profile Name=MyInstanceProfile \
  --metadata-options HttpTokens=required,HttpPutResponseHopLimit=1 \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=20,VolumeType=gp3,Encrypted=true}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=demo},{Key=Env,Value=dev}]'

# List running instances
aws ec2 describe-instances \
  --filters Name=instance-state-name,Values=running \
  --query 'Reservations[].Instances[].[InstanceId,InstanceType,PrivateIpAddress]' \
  --output table

resource "aws_instance" "demo" {
  ami                    = "ami-0123456789abcdef0"
  instance_type          = "t3.micro"
  subnet_id              = "subnet-0123456789abcdef0"
  vpc_security_group_ids = ["sg-0123456789abcdef0"]
  iam_instance_profile   = "MyInstanceProfile"

  metadata_options {
    http_tokens                 = "required"   # IMDSv2 only
    http_put_response_hop_limit = 1
  }

  root_block_device {
    volume_type = "gp3"
    volume_size = 20
    encrypted   = true
  }

  tags = {
    Name = "demo"
    Env  = "dev"
  }
}

import boto3

ec2 = boto3.client("ec2", region_name="us-east-1")

resp = ec2.run_instances(
    ImageId="ami-0123456789abcdef0",
    InstanceType="t3.micro",
    MinCount=1,
    MaxCount=1,
    SubnetId="subnet-0123456789abcdef0",
    SecurityGroupIds=["sg-0123456789abcdef0"],
    MetadataOptions={"HttpTokens": "required", "HttpPutResponseHopLimit": 1},
    TagSpecifications=[{
        "ResourceType": "instance",
        "Tags": [{"Key": "Name", "Value": "demo"}],
    }],
)
print(resp["Instances"][0]["InstanceId"])

// dotnet add package AWSSDK.EC2
using Amazon;
using Amazon.EC2;
using Amazon.EC2.Model;

var ec2 = new AmazonEC2Client(RegionEndpoint.USEast1);

var response = await ec2.RunInstancesAsync(new RunInstancesRequest
{
    ImageId = "ami-0123456789abcdef0",
    InstanceType = InstanceType.T3Micro,
    MinCount = 1,
    MaxCount = 1,
    SubnetId = "subnet-0123456789abcdef0",
    SecurityGroupIds = new List<string> { "sg-0123456789abcdef0" },
    MetadataOptions = new InstanceMetadataOptionsRequest
    {
        HttpTokens = HttpTokensState.Required,   // IMDSv2 only
        HttpPutResponseHopLimit = 1
    },
    TagSpecifications = new List<TagSpecification>
    {
        new TagSpecification
        {
            ResourceType = ResourceType.Instance,
            Tags = new List<Tag> { new Tag("Name", "demo") }
        }
    }
});

Console.WriteLine(response.Reservation.Instances[0].InstanceId);

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

Not sure EC2 is the right level? Compare with AWS Lambda (serverless functions), Amazon ECS and Amazon EKS (containers).