EC2: launch a Linux server

EC2 (Elastic Compute Cloud) rents you virtual machines: a real Linux server with CPUs, memory and a disk, ready in about a minute. You pick an image, a size, a network and a key, and you can hand it a script to run on first boot. After that it's a Linux box like any other, and everything from the Linux paths works on it.

The ingredients

Which Linux? The families again

Everything in this site comes in two flavours, and EC2 is no different. On AWS, the RHEL family is usually Amazon Linux 2023. It's built from Fedora and CentOS Stream, so it uses dnf, httpd and firewalld-style tools, like Rocky. The Debian family is Ubuntu, straight from Canonical. (Rocky and RHEL images exist too, from their publishers.)

aws ssm get-parameter --name \
  /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query Parameter.Value --output text

aws ssm get-parameter --name \
  /aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id \
  --query Parameter.Value --output text

AMI IDs are different in every region and change with every update, so don't copy them from blog posts. These public SSM parameters always point at the newest image.

User data: set it up on first boot

#!/bin/bash
dnf install -y httpd
echo "<h1>Hello from $(hostname -s)</h1>" > /var/www/html/index.html
systemctl enable --now httpd

#!/bin/bash
apt-get update
apt-get install -y apache2
echo "<h1>Hello from $(hostname -s)</h1>" > /var/www/html/index.html
systemctl enable --now apache2

cloud-init runs this as root, once, on the very first boot. No sudo needed, and no one is watching, so use -y. Everything it prints goes to /var/log/cloud-init-output.log: the first place to look when a new server doesn't work.

Launch!

aws ec2 create-key-pair --key-name cht-key --query KeyMaterial --output text > cht-key.pem
chmod 400 cht-key.pem                        # ssh refuses keys others could read

ID=$(aws ec2 run-instances --image-id $AMI --instance-type t3.micro \
  --key-name cht-key --subnet-id $SUB --security-group-ids $SG \
  --user-data file://web.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-1}]' \
  --query 'Instances[0].InstanceId' --output text)

aws ec2 wait instance-running --instance-ids $ID      # blocks until it's up
IP=$(aws ec2 describe-instances --instance-ids $ID \
  --query 'Reservations[0].Instances[0].PublicIpAddress' --output text)
curl http://$IP
ssh -i cht-key.pem ec2-user@$IP              # ubuntu@$IP on Ubuntu

AWS gives you the private key once. Lose it and you can't log in with that key pair ever again (you'd make a new one and a new server). describe-instances wraps instances in "Reservations" (one per launch request), hence the Reservations[].Instances[] in queries.

Stop, start, terminate

Need an address that never changes? Allocate an Elastic IP and associate it with the instance. Every public IPv4 address, elastic or not, costs about half a cent an hour, even when it isn't attached to anything.

Practice: your first cloud server 🖥️

The network from the last lesson is ready: VPC cht-vpc, subnet public-a, security group web-sg (22 from your IP, 80 from everywhere). web.sh is in your home folder, written for your family's Linux.

Quick check