EC2Amazon Elastic Compute Cloud

EC2 gives you virtual machines, called instances. You choose the image it boots, an AMI; the instance type, which sets its CPU, memory, storage and network; the subnet it runs in; and where it keeps its data. After that, patching, sizing and scaling are yours.

It is the most flexible compute on AWS, and the most work. Reach for something more managed when you can, and for EC2 when you need what only a whole machine gives you.

You pick a model and what comes with it, and pay by the second while you have it. Commit to a year or three and it costs less. Take a car from the spare pool and it is cheap, but the company can take it back with two minutes' warning. Anything left in the glovebox is gone when the car goes back; your luggage in a locker stays.

The load balancer sends requests only to healthy targets. With the default settings it checks each instance every 30 seconds and takes it out of service after two failures in a row, so an instance that dies stops getting traffic within about a minute.

Up: change an instance's type for a bigger one. Out: add more instances behind a load balancer. Out is what survives a failure, and it is what Auto Scaling automates.

The numbers in this simulation are made up to show the shape, not the capacity of any real instance type.

An instance lives in one Availability Zone. Put both in the same zone and losing it is an outage; spread them and it is lost capacity.

Its instance store is erased when the instance stops, so nothing you cannot lose belongs there. An Elastic IP address can be remapped to a replacement to mask a failure.

If every target fails its health checks at once, an Application Load Balancer sends traffic to all of them anyway, rather than to none.

A role, never keys. An instance gets temporary credentials from its IAM role, through an instance profile, and they are updated automatically. An instance has one role at a time.

Require IMDSv2. The instance metadata service is where those credentials come from. IMDSv2 makes every request start with a session token, which AWS recommends as defence in depth against open firewalls, reverse proxies and SSRF.

Security groups let in only what a rule allows: a new security group allows no inbound traffic at all.

No public address just to log in. EC2 Instance Connect Endpoint connects you to an instance from the internet without the instance having a public IPv4 address.

By the second. Linux, Windows, RHEL and Ubuntu Pro instances are billed per second with a 60-second minimum; SUSE Linux Enterprise Server by the full hour.

Commit for less. Savings Plans commit to a consistent amount of spend per hour for 1 or 3 years, across instance types. Reserved Instances commit to one instance configuration for 1 or 3 years.

Spot uses spare capacity for much less, and can be interrupted with a two-minute warning.

Also on the bill: every public IPv4 address. Instance store is included in the instance's price.

Prices change, so none are printed here. Check the EC2 pricing pages on aws.amazon.com.