Amazon EC2 and Auto Scaling

Instances are priced per second (with a 60 second minimum) while they are running for most Linux instance types, and EBS volumes, public IPv4 addresses and data transfer are billed separately; the details are in Pricing model and cost drivers.

A stopped instance keeps its EBS volumes (and keeps being billed for them) but no longer incurs instance charges and loses its instance-store data and its auto-assigned public IP address. A terminated instance cannot be restarted, and by default its root volume is deleted with it. Enable termination protection (DisableApiTermination) on instances whose accidental deletion would be expensive; DisableApiStop does the same for stop.

An AMI is selected by ID, and the ID differs per Region, so scripts should not hard-code it. AWS publishes the latest Amazon-provided AMIs as Systems Manager public parameters under /aws/service/, and a launch template can reference such a parameter with the resolve:ssm: prefix so every launch uses the current image.

Amazon Linux 2023 is the default Linux distribution for new workloads. Compared with the older generation it uses dnf (there is no amazon-linux-extras), has SELinux available in permissive mode, a versioned package repository with predictable release cadence, systemd throughout, and IMDSv2 as the default for new instances. Older guides and tutorials still show Amazon Linux 2, yum and amazon-linux-extras install; Amazon Linux 2 passed the end of its support on 2026-06-30, so do not start new workloads on it and plan the move of existing ones (see Comparing AL2 and AL2023). Other options are the Windows Server, Ubuntu, Red Hat and SUSE AMIs, Bottlerocket (a container-optimised OS used by EKS and ECS), and AMIs from AWS Marketplace; a Marketplace AMI adds its own software charge.

References: aws ssm get-parameter, aws ssm get-parameters-by-path, Launching AL2023 on Amazon EC2.

An AMI of your own is created from a running instance (aws ec2 create-image) or, better, built reproducibly by a pipeline: see Image pipelines and deployment. Deregister AMIs and delete their snapshots when they are no longer needed, because the snapshots keep costing storage.

Choose the family from the workload shape, then the size from measured utilisation:

AWS Graviton processors are Arm-based (arm64) chips designed by AWS. Instance types with a g in the name, such as m7g, c7g or r8g, generally offer better price performance than comparable x86 types, and Java, Node.js, Python and .NET workloads run on them unchanged because the JVM and the runtimes ship Arm builds. Native binaries, container images and AMIs must be built for arm64 (multi-architecture images are covered in Container Registry). Because new generations appear regularly and not every Region has every type, query rather than memorise:

References: aws ec2 describe-instance-types, aws ec2 describe-instance-type-offerings, Amazon EC2 instance types.

Burstable t types earn CPU credits while idle and spend them under load. In standard mode an instance that exhausts its credits is throttled; in unlimited mode it keeps bursting and the surplus is charged. They suit development and low-traffic services, not sustained load. Attribute-based instance type selection lets a launch template or Auto Scaling group describe the vCPU and memory range instead of listing types, which widens the Spot pool (see Purchasing options).

The hands-on path is: create an instance role, a security group, then the instance, connect with Session Manager, and clean up. The instance role and profile come first because the instance needs them at launch.

A key pair is an SSH key whose public half is injected into the instance at first boot. It still works, but it needs inbound port 22 (and so a public address or a bastion host), key distribution and rotation, and it leaves no central audit trail. Older guides start every tutorial with a downloaded .pem file; the current recommendation is:

References: aws ssm start-session, AWS Systems Manager Session Manager, Session Manager plugin, aws ec2-instance-connect ssh, Connect using EC2 Instance Connect Endpoint.

In the console, select the instance, choose Connect, and use the Session Manager or EC2 Instance Connect tab. The instance appears under Systems Manager Fleet Manager only when the agent, the profile and the network path are all in place; that is the first thing to check when the Session Manager tab is greyed out.

The instance metadata service (IMDS) answers on the link-local address 169.254.169.254 and serves the instance ID, the user data and, importantly, the temporary credentials of the instance role. IMDSv1 answers a plain GET request, which is exploitable if the application has a server-side request forgery (SSRF) bug: an attacker who can make the server fetch a URL can read the role credentials. IMDSv2 requires a session token obtained with a PUT request, which SSRF-style attacks typically cannot perform. IMDSv2 is the default for instances launched from AL2023, and the launch examples above set HttpTokens=required explicitly. Older guides still show the unauthenticated curl form.

References: Configure the instance metadata service, aws ec2 modify-instance-metadata-options, aws ec2 modify-instance-metadata-defaults.

Containers on the instance need a hop limit of 2 to reach the IMDS through the extra network hop; keep it at 1 when only the host needs it. Application code never calls the IMDS directly: the AWS SDK for Java 2.x does it for you, as shown in Using the instance role from Java.

A security group is a stateful allow-list firewall evaluated at the instance network interface: there are no deny rules, return traffic of an allowed flow is allowed automatically, and rules can reference another security group instead of an address range. That last feature is the standard way to express tiers: the load balancer’s group is allowed to reach the application group, and nothing else is. A network ACL is the separate, stateless, subnet-level layer (see VPC Networking).

For the Bookshelf web tier, only the ALB is reachable from the internet, and the instances accept port 8080 only from the ALB’s group:

References: aws ec2 create-security-group, aws ec2 authorize-security-group-ingress, Control traffic to your AWS resources using security groups.

In the console: EC2, Security Groups, Create security group, choose the VPC, add the inbound rules (set the Source to a security group ID rather than a CIDR for tier-to-tier rules) and leave the default outbound rule or tighten it. A new security group denies all inbound traffic and allows all outbound traffic. Open port 22 to 0.0.0.0/0 never; if you must use SSH, restrict the source to a known address or use an Instance Connect Endpoint.

Each instance has a primary elastic network interface (ENI) in its subnet. You can attach additional ENIs in the same Availability Zone, for example to give an appliance a second address; the ENI, with its private IP and security groups, can be detached and moved to a replacement instance. An Elastic IP address is a static public IPv4 address you allocate and associate with an instance or ENI, so it survives stop and start.

Since 2024-02-01 AWS charges for every public IPv4 address, whether it is an Elastic IP associated with a running instance, an unassociated Elastic IP or an auto-assigned address, so the old advice to give each server a public address is also a cost decision. Put instances in private subnets behind a load balancer, reach them with Session Manager, and use IPv6 where clients support it; the charge applies to the load balancer’s own public addresses too (see VPC Networking and the Amazon VPC pricing page).

References: aws ec2 allocate-address, aws ec2 associate-address, aws ec2 release-address, Elastic IP addresses.

Instances use two kinds of block storage:

The default volume type is gp3 (independent IOPS and throughput settings); older guides and AMIs still use gp2, whose performance is tied to volume size. EBS volumes, snapshots, encryption, EFS and the other options are covered in Block and File Storage on AWS; Spring Boot applications that store files rather than blocks should consider the object-store approach in File Storage & Object Stores. Because an EBS volume is bound to one Availability Zone, a replacement instance in another zone cannot reattach it: keep state in managed services (RDS, S3, EFS) so instances stay disposable.

Spot capacity pools are per instance type and Availability Zone, so diversify: allow many types and sizes (attribute-based selection helps), use the price-capacity-optimized allocation strategy, and enable Capacity Rebalancing in an Auto Scaling group so AWS launches a replacement when it signals a pool is at elevated risk. A common production mix is an On-Demand baseline covered by a Savings Plan plus Spot for the spikes, set in the group’s mixed instances policy (see Auto Scaling groups). Pricing for each option is on the Amazon EC2 pricing pages; see Cost Management and Support for Cost Explorer, Savings Plans recommendations and Budgets.

EC2 publishes metrics to CloudWatch every five minutes by default, or every minute with detailed monitoring (billed). The metrics (CPUUtilization, NetworkIn, StatusCheckFailed, EBS and credit metrics) are collected outside the instance, so memory and disk usage need the CloudWatch agent (see Monitoring and Observability).

Older guides build a CloudWatch alarm with the arn:aws:automate:us-east-1:ec2:recover action to restart a failed instance on new hardware. EC2 now performs simplified automatic recovery by default for instances that support it: when the underlying host reports a system impairment, EC2 recovers the instance on healthy hardware, keeping its instance ID, private and Elastic IP addresses, volumes and metadata. This does not protect against the loss of an Availability Zone or against an application crash. For those, run at least two instances in different zones in an Auto Scaling group, as described next. The recovery behaviour can be changed per instance:

References: aws ec2 modify-instance-maintenance-options, Automatic instance recovery, Monitor your Amazon EC2 instances.

A launch template stores the AMI, instance type (or attribute-based requirements), key pair, security groups, IAM instance profile, block devices, user data, tags and metadata options, with numbered versions and a default version. Auto Scaling groups reference a template and a version (a number, $Default or $Latest), so a new version plus an instance refresh is how the fleet is updated. Launch configurations are the legacy predecessor: they are immutable, no longer receive new EC2 features and cannot be created in new accounts through the console, so use templates.

References: aws ec2 create-launch-template, aws ec2 create-launch-template-version, aws ec2 modify-launch-template, Store instance launch parameters in Amazon EC2 launch templates.

In the console: EC2, Launch Templates, Create launch template, tick Provide guidance to help me set up a template that I can use with EC2 Auto Scaling, fill in the same fields as the launch wizard (AMI, type, security group, Advanced details profile, metadata version and user data) and choose Create launch template. To change it, open the template, choose Actions then Modify template (Create new version), and set the new version as the default under Actions.

An Amazon EC2 Auto Scaling group keeps the number of instances between a minimum and a maximum size, aims at the desired capacity, replaces instances that fail health checks, and spreads instances evenly over the Availability Zones of the subnets you give it. There is no charge for Auto Scaling itself; you pay for the instances, volumes and alarms it uses.

Baking dependencies into an AMI gives faster, more predictable launches than installing everything with user data and makes a scaled-out instance identical to the tested one. HashiCorp Packer is the widely used open-source tool for this: it launches a temporary instance, runs provisioners and snapshots an AMI. EC2 Image Builder is the AWS-native alternative: a pipeline of build and test components with scheduled rebuilds when the parent image receives updates, distribution to several Regions and accounts, and no charge for the service itself (you pay for the build instances and storage). Both can run inside a CI workflow (see Developer Tools and DevOps).

AWS CodeDeploy is the deployment service for instance fleets: an appspec.yml describes lifecycle hooks (stop the service, install, start, validate) and a deployment configuration rolls the revision across an Auto Scaling group, in place or blue/green. It suits long-lived instances that are updated rather than replaced; for immutable fleets, a new AMI plus an instance refresh is simpler. If the application is a container image, move to ECS and Fargate instead of managing instances.

References: aws imagebuilder list-image-pipelines, What is EC2 Image Builder, aws deploy list-applications, What is CodeDeploy.

Application code does not manage credentials. With the AWS SDK for Java 2.x, the default credential provider chain finds the instance profile credentials through IMDSv2 and refreshes them before they expire. catalog-api reading the artifact bucket, or listing the fleet, needs no key:

References: Default credentials provider chain, Work with Amazon EC2 instances (SDK for Java 2.x). The Java SDK v1 reached end of support on 2025-12-31, so new code uses the software.amazon.awssdk packages shown here. The role needs ec2:DescribeInstances for this program, which would be added to the inline policy.

The same fleet can be declared as CloudFormation (see Infrastructure as Code for stacks and change sets): an AWS::EC2::LaunchTemplate with the SSM parameter type AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> for the AMI, an AWS::AutoScaling::AutoScalingGroup and an AWS::AutoScaling::ScalingPolicy. A condensed template:

References: AWS::AutoScaling::AutoScalingGroup, AWS::EC2::LaunchTemplate, AWS::AutoScaling::ScalingPolicy, Auto Scaling group update policies.

This page deliberately lists no prices; they differ by Region, change over time and are on the dated Amazon EC2 pricing page and in the AWS Pricing Calculator. The drivers, roughly in order of impact:

Right-size using CloudWatch and AWS Compute Optimizer, switch to Graviton where the software supports it, schedule non-production fleets to zero outside working hours, and cover the steady baseline with a Savings Plan.

References: aws service-quotas list-service-quotas, Amazon EC2 service quotas, Auto Scaling quotas.

References: aws autoscaling describe-scaling-activities, aws elbv2 describe-target-health, aws ec2 get-console-output, Troubleshoot Amazon EC2 Auto Scaling.

Delete in dependency order so nothing keeps billing: the group first (which terminates its instances), then the load balancer pieces, templates, addresses, security groups, and the role.

References: aws autoscaling delete-auto-scaling-group, aws ec2 terminate-instances, aws elbv2 delete-load-balancer, aws ec2 delete-launch-template, aws ec2 delete-security-group, aws iam delete-role, aws ec2 deregister-image.

In the console: Auto Scaling Groups then Delete; Instances then Terminate instance; Load Balancers and Target Groups then Delete; Launch Templates then Delete template; Elastic IPs then Release; Security Groups then Delete; and in IAM delete the role and its instance profile. If you created a stack instead, aws cloudformation delete-stack removes everything it created.