Imported from aurainfosec/cloud-review-automation-poc (skills/ec2/SKILL.md). Install upstream with npx skills add aurainfosec/cloud-review-automation-poc --skill ec2. Copyright stays with the author.

AWS EC2

Amazon Elastic Compute Cloud (EC2) provides resizable compute capacity in the cloud. Launch virtual servers, configure networking and security, and manage storage.

Table of Contents

• Core Concepts
• Common Patterns
• CLI Reference
• Best Practices
• Troubleshooting
• References

Core Concepts

Instance Types

Purchasing Options

AMI (Amazon Machine Image)

Template containing OS, software, and configuration for launching instances.

Security Groups

Virtual firewalls controlling inbound and outbound traffic.

Common Patterns

Launch an Instance

AWS CLI:

# Create key pair
aws ec2 create-key-pair \
  --key-name my-key \
  --query 'KeyMaterial' \
  --output text > my-key.pem
chmod 400 my-key.pem

# Create security group
aws ec2 create-security-group \
  --group-name web-server-sg \
  --description "Web server security group" \
  --vpc-id vpc-12345678

# Allow SSH and HTTP
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 22 \
  --cidr 10.0.0.0/8

aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

# Launch instance
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type t3.micro \
  --key-name my-key \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-12345678 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-server}]'

boto3:

import boto3

ec2 = boto3.resource('ec2')

instances = ec2.create_instances(
    ImageId='ami-0123456789abcdef0',
    InstanceType='t3.micro',
    KeyName='my-key',
    SecurityGroupIds=['sg-12345678'],
    SubnetId='subnet-12345678',
    MinCount=1,
    MaxCount=1,
    TagSpecifications=[{
        'ResourceType': 'instance',
        'Tags': [{'Key': 'Name', 'Value': 'web-server'}]
    }]
)

instance = instances[0]
instance.wait_until_running()
instance.reload()
print(f"Instance ID: {instance.id}")
print(f"Public IP: {instance.public_ip_address}")

User Data Script

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type t3.micro \
  --key-name my-key \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-12345678 \
  --user-data '#!/bin/bash
    yum update -y
    yum install -y httpd
    systemctl start httpd
    systemctl enable httpd
    echo "<h1>Hello from $(hostname)</h1>" > /var/www/html/index.html
  '

Attach IAM Role

# Create instance profile
aws iam create-instance-profile \
  --instance-profile-name web-server-profile

aws iam add-role-to-instance-profile \
  --instance-profile-name web-server-profile \
  --role-name web-server-role

# Launch with profile
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type t3.micro \
  --iam-instance-profile Name=web-server-profile \
  ...

Create AMI from Instance

aws ec2 create-image \
  --instance-id i-1234567890abcdef0 \
  --name "my-custom-ami-$(date +%Y%m%d)" \
  --description "Custom AMI with web server" \
  --no-reboot

Spot Instance Request

aws ec2 request-spot-instances \
  --instance-count 1 \
  --type "one-time" \
  --launch-specification '{
    "ImageId": "ami-0123456789abcdef0",
    "InstanceType": "c5.large",
    "KeyName": "my-key",
    "SecurityGroupIds": ["sg-12345678"],
    "SubnetId": "subnet-12345678"
  }' \
  --spot-price "0.05"

EBS Volume Management

# Create volume
aws ec2 create-volume \
  --availability-zone us-east-1a \
  --size 100 \
  --volume-type gp3 \
  --iops 3000 \
  --throughput 125 \
  --encrypted

# Attach to instance
aws ec2 attach-volume \
  --volume-id vol-12345678 \
  --instance-id i-1234567890abcdef0 \
  --device /dev/sdf

# Create snapshot
aws ec2 create-snapshot \
  --volume-id vol-12345678 \
  --description "Daily backup"

CLI Reference

Instance Management

Security Groups

AMIs

EBS Volumes

Best Practices

Security

• Use IAM roles instead of access keys on instances
• Restrict security groups — principle of least privilege
• Use private subnets for backend instances
• Enable IMDSv2 to prevent SSRF attacks
• Encrypt EBS volumes at rest

# Require IMDSv2
aws ec2 modify-instance-metadata-options \
  --instance-id i-1234567890abcdef0 \
  --http-tokens required \
  --http-endpoint enabled

Performance

• Right-size instances — monitor and adjust
• Use EBS-optimized instances
• Choose appropriate EBS volume type
• Use placement groups for low-latency networking

Cost Optimization

• Use Spot Instances for fault-tolerant workloads
• Stop/terminate unused instances
• Use Reserved Instances for steady-state workloads
• Delete unused EBS volumes and snapshots

Reliability

• Use Auto Scaling Groups for high availability
• Deploy across multiple AZs
• Use Elastic Load Balancer for traffic distribution
• Implement health checks

Troubleshooting

Cannot SSH to Instance

Checklist:

1. Security group allows SSH (port 22) from your IP
2. Instance has public IP or use bastion/SSM
3. Key pair matches instance
4. Instance is running
5. Network ACL allows traffic

# Check security group
aws ec2 describe-security-groups --group-ids sg-12345678

# Check instance state
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query "Reservations[].Instances[].{State:State.Name,PublicIP:PublicIpAddress}"

Use Session Manager instead:

aws ssm start-session --target i-1234567890abcdef0

Instance Won't Start

Causes:

• Reached instance limits
• Insufficient capacity in AZ
• EBS volume issue
• Invalid AMI

# Check instance state reason
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query "Reservations[].Instances[].StateReason"

Instance Unreachable

Debug:

# Check instance status
aws ec2 describe-instance-status \
  --instance-ids i-1234567890abcdef0

# Get console output
aws ec2 get-console-output \
  --instance-id i-1234567890abcdef0

# Get screenshot (for Windows/GUI issues)
aws ec2 get-console-screenshot \
  --instance-id i-1234567890abcdef0

High CPU/Memory

# Enable detailed monitoring
aws ec2 monitor-instances \
  --instance-ids i-1234567890abcdef0

# Check CloudWatch metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-1234567890abcdef0 \
  --start-time $(date -d '1 hour ago' -u +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 300 \
  --statistics Average

External Accessibility Probe

Use when the question is "is this instance reachable from the internet?" Tests from outside with no credentials using nmap.

Step 1 — Discover public IP:

aws ec2 describe-instances \
  --instance-ids {{instance_id}} \
  --region {{region}} \
  --query 'Reservations[0].Instances[0].{PublicIP:PublicIpAddress,State:State.Name}' \
  --output json

If PublicIpAddress is null → instance is not internet-reachable. Mark FALSE_POSITIVE without probing.

Step 2 — External probe (no credentials):

nmap -Pn -p 22,80,443,3389,8080,8443,3306,5432 {{public_ip}}

Interpreting the response:

Note: filtered is good — security group is working. closed means reachable but no service, which may still be a concern depending on context.

Step 3 — TLS/SSL validation (if HTTPS ports are open):

If nmap shows port 443 or 8443 as open, validate the TLS configuration:

testssl.sh {{public_ip}}:443

See skills/testssl/SKILL.md for full command patterns and interpretation. Check for deprecated protocols (TLS 1.0/1.1), weak ciphers, certificate issues, and known vulnerabilities.

Scoring: See agents/roles.md → Scoring Rubric. EC2-specific: nmap open port from outside → Score 5; CLI PublicIpAddress + SG allows 0.0.0.0/0 → Score 4; SG inspection without confirming public IP → Score 3.

References

• EC2 User Guide
• EC2 API Reference
• EC2 CLI Reference
• boto3 EC2