Day 5Compute · Lab⏱ 2h
EC2: Your First Server
By the end of today you can
Launch a Linux server in the cloud, connect to it with SSH, serve a web page from it, and terminate it safely. You already did this locally in your
nginx-lab. Now you'll do it on the internet.1. First principles: a server is just a computer you can reach
EC2 (Elastic Compute Cloud) rents you a virtual computer. Under the hood, AWS slices a powerful physical machine into many isolated virtual machines. You choose:
| Choice | Question it answers | Analogy |
|---|---|---|
| AMI | What OS/software is pre-installed? | A move-in-ready template: furnished or empty flat |
| Instance type | How much CPU/RAM? | Flat size: studio vs 4-bedroom |
| Key pair | How do I prove I'm allowed in? | The physical key (the .pem file) |
| Security group | Which network traffic is allowed in/out? | The doorman's guest list |
| Storage (EBS) | Where is my disk? | The wardrobe |
| User data | What runs automatically on first boot? | Cleaners who set up the flat before you arrive |
Instance type names decode like t3.micro: family t (burstable general purpose), generation 3, size micro. Others: m general, c compute, r memory, i storage, g/p GPU.
2. Lab: deploy your nginx page on the internet
Cost safetyChoose a free-tier eligible instance type (the console labels it), launch one instance, and terminate it at the end of today's session.
- EC2 → Launch instance. Name:
day5-web. AMI: Amazon Linux 2023. Type: free-tier eligible (t3.microort2.micro). - Key pair: create new (RSA, .pem), download. Then in your Linux terminal:
chmod 400 ~/Downloads/day5.pem. Move it to~/.ssh/. Never into Git. - Network settings → Edit: new security group allowing SSH from "My IP" (not 0.0.0.0/0!) and HTTP from anywhere.
- Advanced → IAM instance profile: pick
ec2-s3-read-rolefrom Day 3. - Advanced → User data (runs once on first boot as root):
#!/bin/bash dnf install -y nginx echo "<h1>Cloud Engineering Lab 02</h1><p>Hello from EC2 in $(hostname)</p>" > /usr/share/nginx/html/index.html systemctl enable --now nginx - Launch. When "running", copy the Public IPv4 address and open
http://THAT-IPin your browser (use http, not https). Wait ~1 minute if it doesn't load. - SSH in from your terminal:
ssh -i ~/.ssh/day5.pem ec2-user@PUBLIC_IP systemctl status nginx # same commands you used in nginx-lab curl -s localhost sudo tail /var/log/nginx/access.log # you'll see your own visit! exit - Experiment (learn by breaking): edit the security group and remove the HTTP rule. Reload the page. It hangs (a blocked port causes a timeout, not an error). Add it back.
- Cleanup: select the instance → Instance state → Terminate. Verify it shows "terminated". Delete the security group if you wish.
📸 Evidence: browser showing your page + the EC2 console:
evidence/day05-ec2-web.png. Also copy your user-data script into aws-course/labs/day05-user-data.sh in Git.3. Lifecycle you must know
| State | Compute billed? | Disk billed? |
|---|---|---|
| Running | Yes | Yes |
| Stopped | No | Yes (EBS) |
| Terminated | No | No (root volume deleted by default) |
Public IPs change on stop/start. An Elastic IP keeps one fixed (and is billed if unattached/unused, as public IPv4 addresses are charged).
4. Exam notes
Remember
- Security groups are stateful, allow-only, attach to the instance's network interface. Default: all inbound blocked, all outbound allowed.
- Use roles (instance profiles) for AWS access from EC2, never stored keys.
- User data runs once at first launch by default.
- Shared Responsibility: AWS patches the host; you patch the guest OS.