Amazon Elastic Compute Cloud (EC2) – AWS Security Fundamentals – SCS-C02 Study Guide

Amazon Elastic Compute Cloud (EC2)

Amazon’s EC2 allows you to create a virtual server to perform any number of tasks in the cloud, and EC2 allows a whole array of customization options. You can use many operating systems to meet your application needs, including both varieties of the Microsoft Windows operating system and multiple versions of the Linux operating system. Appropriating the correct amount of memory and processing power simply entails choosing the right instance type based on your workload’s needs.

EC2 also has three distinct pricing models: On-Demand Instances, Reserved Instances, and Spot Instances. These different models provide flexibility, stability, or discounting to meet the needs of your workload or organization.

With a basic understanding of the EC2 service, you will next see how images of these virtual machines can be used via Amazon Machine Images.

Understanding an Amazon Machine Image (AMI)

Any time you launch an EC2 instance, it must start from an Amazon Machine Image (AMI) to contain the required information to launch. These images can be the base operating systems with clean slates, or they can be AMIs that you or some other entity has created as a valid checkpoint for a working system or systems running on a single instance.

These machine images can be provided by AWS itself, which is the default way to request an image for launching a new EC2 instance. If you create an AMI, then your account controls the image from which to launch more EC2 instances, or you could share that AMI with other accounts privately by designating the accounts that have access to the image. There are even AMI images that are available from the AWS community, and those that come with specialty software and a per-hour cost on AWS Marketplace.

Use Cases for AMIs

You can create your own AMIs to use in an Autoscaling group, a grouping of EC2 instances that scale up or down based on load, or to speed up the launch of complex instances that require multiple steps to download, install, and configure software on the instance.

In more of a security context, AMIs can be an excellent tool for creating a golden image, a preconfigured base image to be used as a template for creating new instances for your development teams and for members of your organization to use. This allows you to pre-install any software updates, patches, and security/monitoring software your organization deems necessary as part of its security posture before allowing another team member to use that instance. Using one or a set of golden images can help your technical support team by reducing the time needed to configure the software and services that need to be deployed into an environment.

Another use of AMIs in a security context is backing up applications, configuration settings, and user data to restore an outage quickly, either in the current region or by sharing the AMI image with another region or another account.

To give you some hands-on experience, the next section will guide you through the process of spinning up an instance and creating an AMI to be spun up at a moment’s notice.