AWS EC2 Compute: Reference Cheatsheet
AWS EC2 Compute: Reference Cheatsheet
Everything the architect exam asks about EC2 on one sheet: AMIs, instance types, purchase options and tenancy, user data and metadata, status checks and monitoring, storage, security and connecting, cost optimisation with RIs and Savings Plans, Elastic Load Balancing, Auto Scaling and placement groups. Eight diagrams, and every point checked against EC2 as of October 2026. The tickable companion is bubim-awscompute-run.
Amazon Machine Images
An AMI is the template an instance launches from: root volume snapshot, launch permissions and block device mapping. Launch one, install and customise, then save it as your own AMI; every instance launched from it comes up identical, which is what Auto Scaling needs. They are sometimes called Amazon Machine instances; the I stands for Image.
| Source | What you get | Watch out for |
|---|---|---|
| AWS-provided | Amazon Linux 2023, Windows Server, Ubuntu, RHEL, SUSE and others; Deep Learning AMIs with TensorFlow and PyTorch preinstalled | look up the latest ID through the public SSM parameters, never hard-code it |
| AWS Marketplace | vendor AMIs with tuned settings and built-in tools | software charges on top of EC2; licence terms |
| Community AMIs | images shared publicly by anyone | unknown provenance; verify the owner before trusting one |
| Your own (golden image) | your hardening and apps baked in | AMIs are Regional: copy them to other Regions; rebuild regularly with EC2 Image Builder |
Instance types
An instance type fixes vCPU count, CPU make and clock speed, memory, instance storage, network bandwidth, architecture (x86 or ARM) and CPU features such as AVX and turbo. Families group the types by what they are good at; within a family each size step doubles the resources and the price.
| m7gd.2xlarge | Part | Meaning |
|---|---|---|
| m | family | general purpose |
| 7 | generation | higher is newer and usually cheaper per unit of work |
| g d | attributes | g Graviton (ARM), a AMD, i Intel, d local NVMe instance store, n extra network, e extra memory, z high clock, flex burst-capable general purpose |
| 2xlarge | size | 8 vCPU here; nano, micro, small, medium, large, xlarge, 2xlarge and up, metal |
| Family | Letters | Typical use |
|---|---|---|
| Burstable | T | small, mostly idle workloads such as a static site or dev box; CPU credits |
| General purpose | M, T, Mac | web and app servers, test and dev, balanced workloads |
| Compute optimized | C, Hpc | high-performance web, batch, encoding, HPC |
| Memory optimized | R, X, U, z | databases, caches, SAP HANA, SharePoint |
| Storage optimized | I, Im, Is, D, H | NVMe SSD with very high IOPS: NoSQL, search, data warehousing |
| Accelerated computing | P, G, Trn, Inf, F | GPU training and inference, graphics, Trainium and Inferentia chips, FPGA (F2 since December 2024) |
Purchase options
The same instance, priced five ways. Older material lists six; one of them, Scheduled RIs, is gone.
| Option | How it works | Use for |
|---|---|---|
| On-Demand | launch any time, pay per second (60-second minimum) for Linux and Windows, stop or terminate when done | short, irregular, unpredictable work; test and dev |
| Savings Plans | commit to a $/hour spend for 1 or 3 years; Compute SP up to 66% off, EC2 Instance SP up to 72% | steady compute, with flexibility (next section) |
| Reserved Instances | discount for a 1- or 3-year commitment to an instance type; all, partial or no upfront | steady state that will not change shape |
| Spot Instances | spare capacity, up to 90% off; no bidding since 2017, price moves slowly with supply; 2-minute interruption notice and an earlier rebalance recommendation | interruptible work: batch, CI, stateless web behind a balancer, big instances cheaply |
| On-Demand Capacity Reservations | reserves capacity in one AZ, billed whether used or not; no discount by itself, combine with a Savings Plan or regional RI; can start at a future date | events and DR where capacity must exist |
| Capacity Blocks for ML | GPU capacity booked for a fixed window | training runs |
| Dedicated Hosts and Instances | tenancy options (next sections) | licensing and compliance |
fig 1 · longer term and more upfront buy a deeper discount; standard beats convertible by about ten points
| RI attribute | Choices | Effect |
|---|---|---|
| Class | Standard, Convertible | Standard: deepest discount, can be sold on the RI Marketplace. Convertible: exchange for another family, OS or tenancy of equal or greater value, cannot be sold |
| Term | 1 or 3 years | 3 years roughly 20 points cheaper |
| Payment | all, partial, no upfront | all upfront is cheapest, no upfront the least discount |
| Scope | Regional or zonal | regional: discount floats across AZs and sizes in the family (Linux, default tenancy); zonal: also reserves capacity in one AZ |
| Scheduled RIs | recurring daily, weekly or monthly windows | retired no longer offered; use Capacity Reservations plus Savings Plans |
Tenancy
Tenancy is about the physical server underneath the instance.
| Tenancy | Means | Use for |
|---|---|---|
| Shared (default) | any available host, shared with other customers, isolated by the Nitro hypervisor | almost everything |
| Dedicated Instance | hardware used only by your account; you do not see or pick the host | compliance rules that forbid shared hardware |
| Dedicated Host | a whole physical server you allocate, with visibility of sockets and cores, host affinity and auto-placement | bring-your-own-licence per socket or core (Windows Server, SQL Server, Oracle), strict compliance |
Changing tenancy A stopped instance can move between dedicated and host tenancy; default tenancy cannot be changed to either after launch.
User data and instance metadata
User data is a script or cloud-init document that runs as root on the first boot, for example to install and start Apache. Metadata is what the instance can learn about itself from the link-local address 169.254.169.254. Both are readable from inside the instance, so neither should hold secrets.
user data: install Apache and show which instance answered
#!/bin/bash dnf install -y httpd TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 300") ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) echo "<h1>$ID</h1>" > /var/www/html/index.html systemctl enable --now httpd
IMDSv2 from a shell on the instance
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/ curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-ipv4 curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/user-data curl -s -w "\n" -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key ec2-metadata --instance-id --availability-zone # helper preinstalled on Amazon Linux
| Path under /latest/meta-data/ | Returns |
|---|---|
| instance-id, instance-type, ami-id | identity of the instance |
| local-ipv4, public-ipv4 | addresses (there is no ipaddress path) |
| placement/availability-zone, placement/region | where it runs |
| iam/security-credentials/ROLE | temporary role credentials used by the SDKs |
| public-keys/0/openssh-key | the key pair public key |
| spot/instance-action | appears when a Spot interruption is scheduled |
IMDSv2 Every request needs a session token obtained with a PUT, which blocks the SSRF tricks that worked against IMDSv1. Amazon Linux 2023 AMIs require it, the account default can enforce it, and containers on the instance need a hop limit of 2.
Status checks and monitoring
EC2 runs its status checks every minute. All pass: the instance is ok. Any fails: impaired. Who fixes it depends on which check failed.
| Check | Covers | Who fixes it | Metric |
|---|---|---|---|
| System status | the host: power, network reachability, hardware or software on the physical server | AWS; you can speed it up by stopping and starting an EBS-backed instance onto a new host | StatusCheckFailed_System |
| Instance status | your OS: bad network or boot config, exhausted memory, corrupted file system, wrong kernel | you: reboot, fix the configuration | StatusCheckFailed_Instance |
| Attached EBS status | reachability of attached EBS volumes (Nitro instances, since 2024) | AWS, or you replace the volume or move the instance | StatusCheckFailed_AttachedEBS |
| CloudWatch item | Detail |
|---|---|
| Basic monitoring | free, metrics every 5 minutes |
| Detailed monitoring | metrics every minute, billed per metric |
| Alarms | for example CPU above 50%; actions notify through SNS, trigger Auto Scaling, or stop, terminate, reboot or recover the instance |
| Automatic recovery | on by default for supported types: a failed system check moves the instance to new hardware, keeping ID, IPs and EBS |
| Memory and disk usage | not visible from outside; install the CloudWatch agent |
Storage options
| Aspect | EBS volume (persistent) | Instance store (ephemeral) |
|---|---|---|
| What it is | network block device, separate from the instance | NVMe or SSD disks physically on the host |
| Survives reboot | yes | yes |
| Survives stop, hibernate, terminate | yes unless the root volume is deleted on termination (default for the root) | no data is lost, also on host failure |
| Detach and reattach | yes, within the same AZ | no |
| Backup | snapshots to S3, copy across Regions | your own copies, or replicate at the app layer |
| Types | gp3 (default general purpose), io2 Block Express, st1, sc1 | only on types with a d or storage-optimized family |
| Use it for | boot volumes, databases, anything you must keep | caches, scratch space, replicated data such as Cassandra or Kafka |
Security groups, key pairs, roles
Under the shared responsibility model AWS secures the hardware and hypervisor; the OS, its patches, its users and its firewall rules are yours.
| Control | Facts |
|---|---|
| Security group | stateful firewall on the instance’s network interface; allow rules only, by source (CIDR, prefix list or another security group), protocol and port; replies flow back automatically |
| Defaults | a new security group allows no inbound and all outbound traffic; the launch wizard offers SSH from 0.0.0.0/0, an open-to-all default; narrow it to your IP or use Session Manager |
| Key pair | RSA or ED25519; AWS keeps the public key, you download the private key once as .pem or .ppk; on Linux it authenticates SSH, on Windows it decrypts the Administrator password (RSA only) |
| Key reuse | one key pair can serve many instances; once in, create named users with their own keys and stop sharing the launch key |
| IAM role | one role per instance, through an instance profile; attach or replace it on a running instance, effective within seconds, valid in every Region |
| Patching | your job: Systems Manager Patch Manager, or rebuild from a fresh AMI |
Connecting to instances
The classic ways in are SSH from WSL and PuTTY on Windows. Both still work; Windows 10 and 11 ship OpenSSH, the console can hand out a .ppk directly, and two AWS options remove the need for port 22 altogether.
| Method | Needs | Notes |
|---|---|---|
| SSH with the key pair | port 22 open to your IP, public IP or a bastion | chmod 400 key.pem; ssh -i key.pem ec2-user@IP |
| PuTTY on Windows | a .ppk key (download it as .ppk, or convert with PuTTYgen) | Connection, SSH, Auth, Credentials: private key file |
| EC2 Instance Connect | port 22 from the service range, Instance Connect package (preinstalled on Amazon Linux and Ubuntu) | pushes a one-time public key valid for 60 seconds; browser or CLI |
| EC2 Instance Connect Endpoint | an endpoint in the VPC | SSH or RDP into private instances without public IPs or a bastion |
| Session Manager | SSM agent and the AmazonSSMManagedInstanceCore role policy | no inbound ports, no keys, access through IAM, sessions logged |
| AMI | Default user |
|---|---|
| Amazon Linux, RHEL, SUSE, FreeBSD | ec2-user |
| Ubuntu | ubuntu |
| Debian | admin |
| Fedora, CentOS | fedora, centos |
| Bitnami images | bitnami |
| Windows | Administrator (RDP, password decrypted with the key) |
Optimising compute cost
Buying RIs in exactly the right size is hard: needs change and the market moves. Sizes double at each step, so buy in the smallest common unit and let size flexibility combine them. Three years is tempting; the RI Marketplace is the exit for Standard RIs you no longer need.
| Aspect | Compute Savings Plan | EC2 Instance Savings Plan |
|---|---|---|
| Commitment | a consistent $/hour of usage for 1 or 3 years; all, partial or no upfront | |
| Covers | EC2 in any family, size, OS, tenancy and Region, plus Fargate and Lambda | one instance family in one Region, any size, OS and tenancy |
| Discount | up to 66%, about the convertible RI rate | up to 72%, about the standard RI rate |
| Resale | cannot be sold or cancelled | |
Common mix-up The second plan is the EC2 Instance Savings Plan, not an ECS plan; and the Compute plan covers Fargate as well as EC2 and Lambda.
fig 2 · RI portfolio management: a mix of terms, classes and Savings Plans, so changing needs never strand the whole commitment
| Classic approach | Tool today |
|---|---|
| Monitor constantly to keep the savings | Cost Explorer coverage and utilization reports for RIs and Savings Plans, Budgets alerts on both |
| Buy incrementally | Cost Explorer purchase recommendations, re-run monthly, buy small tranches |
| Mix RI options | Savings Plans for the flexible core, Standard RIs where you may want to resell |
| Look beyond EC2 | RIs for RDS, ElastiCache, OpenSearch Service (formerly Elasticsearch Service), Redshift; Database Savings Plans since December 2025 |
| Export to a spreadsheet | Cost and Usage Report via Data Exports, queried with Athena, or the Cost Explorer CSV |
| Right-size before committing | Compute Optimizer recommendations for instances and Auto Scaling groups |
Elastic Load Balancing
A single instance fails, and it cannot absorb spikes. A load balancer manages and controls the flow of inbound requests and spreads them over many targets. It is itself a fleet of nodes run by AWS that scales with traffic, notices failed targets and routes around them.
fig 3 · the load balancer is a managed, self-scaling front door; containers register as IP or instance targets
| Type | Layer | Protocols | Pick it for |
|---|---|---|---|
| Application (ALB) | 7, request level | HTTP, HTTPS, HTTP/2, gRPC, WebSockets | web apps, microservices and containers, content-based routing, Lambda targets, WAF, user authentication |
| Network (NLB) | 4, connection level | TCP, UDP, TLS | very high throughput and low latency, static IP per AZ, client IP preserved, PrivateLink services |
| Gateway (GWLB) | 3 | IP packets over GENEVE 6081 | inserting firewalls and inspection appliances transparently |
| Classic (CLB) | 4 and 7 | TCP, SSL, HTTP, HTTPS | previous generation; migrate to ALB or NLB |
Components
| Component | Role |
|---|---|
| Listener | protocol and port the load balancer accepts, with a default action |
| Rule | condition plus action on a listener (ALB): host, path, header, method, query string or source IP to a target group, redirect or fixed response; evaluated by priority |
| Target group | the pool of targets with its own protocol, port and health check; one target can sit in several groups |
| Health check | path, interval, timeout, healthy and unhealthy thresholds, success codes; unhealthy targets get no traffic |
| Scheme | internet-facing or internal; either way the targets stay private |
| Nodes | one per enabled AZ; an AZ without a node receives no traffic; ALB needs at least two AZs; DNS returns node IPs with a 60-second TTL |
| Cross-zone load balancing | whether a node may send to targets in other AZs (fig 4) |
| Deregistration delay | connection draining before a target leaves, 300 seconds by default |
fig 4 · six targets in AZ 1, four in AZ 2, traffic split 50/50 by DNS: cross-zone decides whether the targets or the zones get equal shares
fig 5 · a target group is just the set of resources the load balancer may send a request to; listeners and rules pick the group
TLS on the load balancer
| Item | Detail |
|---|---|
| Ports | HTTP on 80, HTTPS on 443; HTTPS is HTTP inside TLS, and TLS is the successor of SSL |
| Certificates | ACM issues public X.509 certificates for free and renews them; import third-party ones into ACM, or the IAM certificate store where ACM is not available |
| Several sites | SNI: several certificates on one HTTPS listener, matched by host name |
| Security policy | the protocol and cipher set; new HTTPS listeners default to ELBSecurityPolicy-TLS13-1-2-2021-06 (TLS 1.3 and 1.2) |
| Where TLS ends | ALB terminates it; NLB can terminate (TLS listener) or pass it through (TCP listener) to the targets |
ALB setup order
| # | Step |
|---|---|
| 1 | Create the target group: target type, protocol and port, VPC, health check settings |
| 2 | Register targets, or leave that to an Auto Scaling group |
| 3 | Create the ALB: internet-facing, at least two AZs, a security group that admits 80 and 443 |
| 4 | Add the listener (HTTP 80, ideally HTTPS 443 with a redirect from 80) with the target group as default action |
| 5 | Add rules, for example traffic from a given source IP to a second target group |
Two corrections OSI stands for Open Systems Interconnection, not open services infrastructure. NLBs have supported security groups since August 2023, and their cross-zone balancing is off by default rather than something you disable.
EC2 Auto Scaling
Add instances when demand rises, remove them when it falls, and replace any that fail, without anyone configuring servers by hand. Users get steady response times; you pay for what the load needs.
fig 6 · groups, launch configurations and launch templates; the launch configuration is now legacy
| Setting | Meaning |
|---|---|
| Min, max, desired | bounds and the current target count |
| Subnets | one per AZ; the group keeps the AZs balanced |
| Health check type | EC2 status checks by default; add ELB so an app that fails its health check is replaced too |
| Health check grace period | seconds after launch before health checks count |
| Default instance warmup | seconds before a new instance’s metrics feed scaling decisions |
| Cooldown | for simple scaling only: the pause after a scaling activity before another starts (300 seconds by default); it is not when instances are checked for termination |
| Termination policy | which instance goes on scale-in: by default balance the AZs first, then the oldest launch template, then the one closest to the next billing hour |
| Notifications | SNS on launch, terminate and errors |
| Scaling policy | How it works | Example |
|---|---|---|
| Target tracking | keeps a metric at a target value, like a thermostat; Auto Scaling creates and manages the alarms | average CPU at 50%, or ALB requests per target at 1,000 |
| Step scaling | your CloudWatch alarm, adjustments by how far the metric breaches | CPU above 75% for 5 minutes: add 2, above 90%: add 4 |
| Simple scaling | one alarm, one adjustment, then the cooldown | legacy; prefer step or target tracking |
| Scheduled | sets min, max or desired at a time or on a cron schedule, in a time zone | raise the minimum before office hours |
| Predictive | forecasts daily and weekly patterns from history and scales ahead | recurring morning ramp |
| Scaling input | Detail |
|---|---|
| Adjustment types | change by a number, by a percentage of the group, or set an exact size |
| Built-in metrics | average CPU, network in and out, ALB request count per target |
| Custom metrics | published by the app to CloudWatch, for example queue depth or open database connections; usable with target tracking or step scaling. It is not tied to target tracking: a custom metric works with either policy type |
| More features | instance refresh (rolling replacement after a template change), warm pools (pre-initialised stopped instances), lifecycle hooks, mixed instances policy with Spot and On-Demand |
Load balancer and Auto Scaling together
Usually both are needed so the whole stack grows and shrinks as one: attach the Auto Scaling group to the load balancer’s target group, and the group registers every instance it launches and deregisters every one it removes.
fig 7 · the setup: load balancer for the requests, Auto Scaling for the capacity, one launch template as the model
| Piece | Configure |
|---|---|
| Security groups | ALB: 80 and 443 from the internet. Instances: 80 only from the ALB security group |
| Load balancer | listeners, target group, health check path |
| Launch template | the model for every instance: AMI, type, key pair or none, security group, instance profile, user data |
| Auto Scaling group | the template, subnets in two or more AZs, the target group, ELB health checks, a scaling policy |
Placement groups
Normally EC2 spreads your instances over different servers. A placement group changes that, either to put them close together for fast node-to-node traffic or to keep them deliberately apart. You choose the group at launch.
fig 8 · added: the three placement strategies as racks; cluster stays in one AZ, partition and spread can span AZs
| Strategy | Placement | Limits | Use for |
|---|---|---|---|
| Cluster | close together in one AZ, low latency, high bandwidth | single AZ only; no burstable T types; launch all at once with one type | HPC, tightly coupled jobs; use enhanced networking (ENA) |
| Partition | groups of instances on separate racks with their own power and network | up to 7 partitions per AZ, can span AZs, instances limited only by account quotas | HDFS, HBase, Cassandra, Kafka |
| Spread | every instance on a distinct rack | up to 7 running instances per AZ per group, can span AZs | a few critical instances that must not fail together |
Lab checks from the summary
Three tests prove the setup works. The runbook automates each one.
| Test | Expect | Proves |
|---|---|---|
| HTTP requests to the load balancer DNS name | answers from different instance IDs | listener, target group and health checks work |
| Stress the CPU on the instances | the group launches more instances within minutes, then scales in | the scaling policy and the metric work |
| Terminate an instance by force | a replacement launches and registers | self-healing through desired capacity and health checks |
Exam picks: if the question says X, answer Y
| Scenario | Answer |
|---|---|
| Steady 24×7 workload, lowest price, will not change | Standard RI or EC2 Instance Savings Plan, 3 years, all upfront |
| Steady spend but instance families and Regions will change, also Lambda and Fargate | Compute Savings Plan |
| Commitment you may need to resell | Standard RI on the RI Marketplace |
| Interruptible batch at the lowest cost | Spot |
| Capacity must exist in one AZ for an event | On-Demand Capacity Reservation (or zonal RI) |
| Per-socket licence, need to see the physical cores | Dedicated Host |
| No shared hardware, no host visibility needed | Dedicated Instance |
| Run commands on first boot | user data |
| Instance needs to learn its own IP or role credentials | instance metadata at 169.254.169.254, IMDSv2 |
| System status check failed | stop and start (new host) or let automatic recovery act |
| Data must survive stop and terminate | EBS, not instance store |
| Shell access without opening port 22 | Session Manager |
| Route by URL path or host name | ALB listener rules |
| Millions of TCP or UDP connections, static IPs | NLB |
| Insert third-party firewalls transparently | GWLB |
| Uneven targets per AZ get uneven load | enable cross-zone load balancing |
| Keep CPU near 50% automatically | target tracking scaling policy |
| Scale on queue depth or another app metric | custom CloudWatch metric with target tracking or step scaling |
| Lowest latency between nodes | cluster placement group |
| Large replicated data store across racks | partition placement group |
| A handful of critical nodes kept apart | spread placement group |
What changed since 2020
| In 2020 | Today |
|---|---|
| Scheduled RIs | no longer offered |
| Spot: bid above the current price, 2-minute warning when the price rises | no bidding since 2017; optional maximum price; interruptions come from capacity, with a 2-minute notice and an earlier rebalance recommendation |
| ECS instance savings plans | EC2 Instance Savings Plans; Compute Savings Plans also cover Fargate |
| RIs for RDS and ES | OpenSearch Service (renamed 2021); Database Savings Plans since December 2025 |
| Metadata over plain curl | IMDSv2 with a session token; required by default on Amazon Linux 2023 |
| meta-data/ipaddress | local-ipv4 and public-ipv4 |
| wget ec2-metadata | the ec2-metadata helper ships with Amazon Linux |
| Two status checks | three, with attached EBS status (2024) |
| PuTTY and PuTTYgen on Windows | OpenSSH built into Windows; .ppk download in the console; Instance Connect, Instance Connect Endpoint, Session Manager |
| Classic load balancer does both | previous generation; ALB, NLB and the newer Gateway Load Balancer |
| NLB without security groups | security groups on NLBs since August 2023 |
| Launch configuration or launch template | launch templates only: no new instance types in launch configurations since January 2023, new accounts cannot create them since October 2024 |
| FPGA family | F2 instances (December 2024) |
| Instance generation in examples | current generations such as m7i, m7g, c7g; Graviton for a lower price |
Details checked against the AWS documentation for status checks, launch configurations, placement strategies and Elastic Load Balancing.
0 comments