Servers on EC2

So QuickCart wants servers that:

• can be rebuilt from scratch, by a machine, in minutes;
• need no open login port and no key file on anyone’s laptop;
• get AWS permissions without anyone storing a password or key on them.

An EC2 instance is a computer you rent from AWS by the second. You choose what it runs, how big it is, and which network it sits in. When you don’t need it any more, you delete it and the bill stops.

What you choose when you launch one

The AMI: the starting disk

An AMI (Amazon Machine Image) is a snapshot of a disk. Every instance starts as a copy of one. AWS publishes AMIs for common operating systems, like Amazon Linux 2023 and Ubuntu, and keeps them patched.

Teams later build their own AMIs with their software already installed. Those are often called golden images. They make new servers start faster, because there’s less to install at boot.

The instance type: how big

The name t3.micro has three parts:

Burstable means a T instance runs at a low baseline and earns credits while it’s quiet. It spends them to run faster during short busy spells. That suits a small web server. It doesn’t suit something that works flat out all day: once the credits are gone, it either slows down or charges extra, depending on its credit setting.

Start small and watch the CPU graph. Choosing the smallest type that copes is called right-sizing.

User data: setting up without logging in

User data is a script you paste in when you launch. The instance runs it once, as root, on its first boot. That’s how a plain Amazon Linux AMI becomes a QuickCart server without anyone logging in.

Its output goes to /var/log/cloud-init-output.log on the server. That’s the first place to look when a new server doesn’t behave.

User data is not secret. Anyone who can view the instance’s settings can read it. Never put a password in it; Secrets covers where passwords go.

Reboot, stop and terminate

These three sound similar. They’re very different:

Terminating is permanent. When auto scaling replaces a server, it terminates the old one and launches a new one from the AMI and user data. Anything that was only on the old disk is lost.

Getting in without SSH keys: Session Manager

The old way to reach a server is SSH: open port 22, create a key pair, and keep the private key file safe on every laptop that needs access. Keys get copied, lost and never rotated, and port 22 is scanned by bots all day.

Session Manager, part of AWS Systems Manager, gives you a shell in the browser instead:

It works because a small program on the server, the SSM agent, makes an outbound connection to AWS and waits for you. Nothing ever connects in. It needs three things:

Roles: AWS permissions without keys

QuickCart’s code on the server will need to call AWS: read a file from S3, fetch a password. The wrong way is to paste an access key into a config file. The right way is to give the server an IAM role.

You attach a role to an instance through an instance profile, a small wrapper around the role. When you create a role for EC2 in the console, it creates the instance profile for you, with the same name. From then on, the AWS SDKs and the AWS CLI on the server pick up short-lived credentials automatically, and AWS rotates them for you. Who can do what: IAM explains roles in full.

IMDSv2: protecting those credentials

The credentials come from the instance metadata service, a special address every instance can call: 169.254.169.254. It answers questions like “what’s my instance ID?” and “what are my role’s credentials?”.

Set Metadata version to V2 only (token required) on every instance. Amazon Linux 2023 already defaults to it, but saying so explicitly means it doesn’t depend on the AMI you pick.

Launch a server, fix something on it by hand, then reboot, stop, start and terminate it. Watch what happens to its ID, its public IP and its disk.

What to notice: your hand-made fix survived a reboot and a stop, so it felt safe. It only disappeared when the server was replaced — which is exactly what auto scaling does, at 3 a.m., without asking.

Pennies — one t3.micro for under an hour is about 2 cents in us-east-1, including its public IP address and disk. If your account is eligible for the free tier, it may cost nothing. Prices change, so check the EC2 pricing page if you’re unsure.

You’ll create a role for Session Manager, launch a server that sets itself up with user data, connect to it without any key, and see IMDSv2 refuse a request. About 30 minutes.

Check the region selector at the top right says N. Virginia (us-east-1).

1. Create the role for the server

   AWSIn the AWS console: IAM→Roles→Create role

   Field	Enter
   Trusted entity type	AWS service
   Service or use case	EC2, then the EC2 use case

   Choose Next. In the permissions search box, type AmazonSSMManagedInstanceCore, tick it, and choose Next.

   Field	Enter
   Role name	quickcart-ec2-ssm
   Description	Lets QuickCart servers use Session Manager

   Choose Create role.

   You should see

   quickcart-ec2-ssm in the list of roles. Behind the scenes, the console also made an instance profile with the same name. That’s what you’ll pick when you launch.

2. Create a security group with no way in

   AWSIn the AWS console: EC2→Security Groups→Create security group

   Field	Enter
   Security group name	quickcart-web-sg
   Description	QuickCart web server - no inbound access
   VPC	The default VPC
   Inbound rules	None. Leave the list empty
   Outbound rules	Leave the default: All traffic to 0.0.0.0/0

   Choose Create security group.

   You should see

   The group, with 0 inbound rules and 1 outbound rule. Nothing on the internet can start a connection to a server in this group. The server can still reach out, which Session Manager needs.

3. Launch the instance

   AWSIn the AWS console: EC2→Instances→Launch instances

   Field	Enter
   Name	quickcart-web-1
   Application and OS Images	Amazon Linux, then Amazon Linux 2023 AMI, 64-bit (x86)
   Instance type	t3.micro
   Key pair (login)	Proceed without a key pair

   Under Network settings, choose Edit:

   Field	Enter
   VPC	The default VPC
   Subnet	No preference
   Auto-assign public IP	Enable
   Firewall (security groups)	Select existing security group, then quickcart-web-sg

   Leave Configure storage at its default: 8 GiB, gp3.

   Open Advanced details:

   Field	Enter
   IAM instance profile	quickcart-ec2-ssm
   Metadata version	V2 only (token required)
   User data	The script below

   user-data.shCopy

   #!/bin/bash
   dnf install -y nginx
   echo "QuickCart web server, set up by user data" > /usr/share/nginx/html/index.html
   systemctl enable --now nginx

   Line	What it does
   #!/bin/bash	Run this script with bash. User data must start with a line like this, or it isn’t run as a script
   dnf install -y nginx	Install nginx, a small web server. dnf is Amazon Linux’s package installer; -y answers yes to its question, because nobody is there to type it
   echo "…" > /usr/share/nginx/html/index.html	Write one line of text into nginx’s home page file. > sends the text into the file instead of the screen
   systemctl enable --now nginx	Start nginx now (--now), and start it again on every boot (enable)

   Why a public IP when nothing can connect in? In the default VPC, it’s the server’s only way out to Systems Manager. In QuickCart’s real network the server sits in a private subnet and goes out through a NAT gateway or VPC endpoints instead.

   Choose Launch instance.

   You should see

   Success, with a link to the instance ID. In EC2 → Instances, the state goes from Pending to Running in under a minute. Wait until Status check shows 3/3 checks passed. That can take two or three minutes.

4. Connect with Session Manager

   AWSIn the AWS console: EC2→Instances→quickcart-web-1→Connect→Session Manager

   Choose Connect. A terminal opens in a new browser tab. No key, no port 22.

   If the Connect button is greyed out, wait a minute and reload: the agent registers itself shortly after boot.

   Check who you are:

   TerminalCopy

   whoami

   Part	What it means
   whoami	print the name of the user you’re logged in as

   You should see

   ssm-user

   Session Manager logs you in as a user called ssm-user, which can use sudo.

5. Check that user data ran

   Read the end of the log that user data writes to:

   TerminalCopy

   sudo tail -n 3 /var/log/cloud-init-output.log

   Part	What it means
   sudo	run as root; this log is only readable by root
   tail	print the end of a file
   -n 3	only the last 3 lines
   /var/log/cloud-init-output.log	where the output of your user data script goes

   You should see

   A few lines from the end of the setup, finishing with one that starts Cloud-init v. and says finished at, with the date and how many seconds the boot took. Your version numbers and times will differ.

   Now ask nginx for its home page, from the server itself:

   TerminalCopy

   curl localhost

   Part	What it means
   curl	make a web request and print the answer
   localhost	this same machine

   You should see

   QuickCart web server, set up by user data

   Nobody logged in to install nginx. The user data did it.

6. See IMDSv2 refuse a request without a token

   Ask the metadata service for the instance’s ID the old IMDSv1 way, with no token:

   TerminalCopy

   curl -s -o /dev/null -w "%{http_code}\n" http://169.254.169.254/latest/meta-data/instance-id

   Part	What it means
   curl	make a web request
   -s	silent: don’t show a progress bar
   -o /dev/null	throw the answer’s body away
   -w "%{http_code}\n"	print only the HTTP status code, then a new line
   http://169.254.169.254/latest/meta-data/instance-id	the metadata service’s address, and the question: “what’s my instance ID?”

   You should see

   401

   401 means Unauthorized. That’s IMDSv2 doing its job: no token, no answer. Now do it properly. First, get a token:

   TerminalCopy

   curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 300"

   Part	What it means
   curl -X PUT	send a PUT request, not the usual GET
   http://169.254.169.254/latest/api/token	the address that hands out tokens
   -H "X-aws-ec2-metadata-token-ttl-seconds: 300"	a header asking for a token that lasts 300 seconds

   You should see

   A long string of letters and numbers. It has no new line at the end, so your next prompt starts straight after it on the same line. That string is the token: select and copy it, without the prompt.

   Then ask again, sending the token. Replace TOKEN with the string you copied:

   TerminalCopy

   curl -H "X-aws-ec2-metadata-token: TOKEN" http://169.254.169.254/latest/meta-data/instance-id

   Part	What it means
   -H "X-aws-ec2-metadata-token: TOKEN"	send the token in a header
   http://169.254.169.254/latest/meta-data/instance-id	the same question as before

   You should see

   Your instance ID, starting i-, the same one the console shows. The AWS SDKs and CLI do this token dance for you automatically.

7. Use the role, with no keys anywhere

   The AWS CLI is already installed on Amazon Linux 2023. Ask AWS who this server is:

   TerminalCopy

   aws sts get-caller-identity

   Part	What it means
   aws sts	the AWS service that deals with identities and credentials
   get-caller-identity	“who am I?” It needs no special permission

   You should see

   A short JSON answer. The Arn line contains assumed-role/quickcart-ec2-ssm/ followed by the instance ID. The server is acting as the role you gave it. You never typed a key: the CLI fetched short-lived credentials from the metadata service, using a token.

   Close the Session Manager tab when you’re done.

8. Stop and start it, and watch the IP change

   AWSIn the AWS console: EC2→Instances→quickcart-web-1→Details

   Write down the Public IPv4 address. Then choose Instance state → Stop instance, and confirm with Stop. When the state reads Stopped, choose Instance state → Start instance.

   You should see

   The same instance ID, but a different public IPv4 address. Connect with Session Manager again and run curl localhost: the page is still there, because the disk was kept.

   That changing address is why nothing should ever point straight at a server. The next lesson, Load balancers, puts one fixed address in front.

9. Clean-up step: Clean up

   AWSIn the AWS console: EC2→Instances→quickcart-web-1→Instance state→Terminate instance

   Newer consoles label it Terminate (delete) instance. Confirm it. The instance goes to Shutting-down, then Terminated, and its disk is deleted with it.

   Then delete the security group:

   AWSIn the AWS console: EC2→Security Groups→quickcart-web-sg→Actions→Delete security groups

   If it refuses because the group is still in use, wait until the instance shows Terminated and try again.

   Keep the quickcart-ec2-ssm role. IAM roles are free, and the next two lessons use it. If you aren’t carrying on, delete it in IAM → Roles.

   You should see

   The instance listed as Terminated (it disappears from the list after about an hour) and no quickcart-web-sg in the security groups. Nothing is left running.