Compute: EC2, Lightsail and Choosing Where Code Runs
EC2 essentials
An EC2 instance is a virtual server. When you launch one you choose:
| Choice | Notes |
|---|---|
| AMI | the OS image, for example Ubuntu 24.04 LTS |
| Instance type | CPU and memory: t4g.small (2 vCPU, 2 GB, ARM), m7i.large... |
| Key pair | your SSH public key |
| Network | VPC, subnet, public IP or not |
| Security group | the instance firewall |
| Storage | EBS volume size and type (gp3 is the sensible default) |
| IAM role | permissions for software on the instance |
The t family is burstable: cheap, with CPU credits for short peaks. A server busy all the time on a t instance runs out of credits and slows to a crawl; move it to an m or c type.
ARM (Graviton, types ending in g) is typically around 20% cheaper for the same performance, and Python, Node and PostgreSQL run on it without changes.
Security groups
Security groups are stateful firewalls attached to instances. Rules allow traffic; everything else is denied.
| Rule | Source |
|---|---|
| SSH 22 | your IP only (203.0.113.7/32), or use Session Manager and open nothing |
| HTTP 80, HTTPS 443 | 0.0.0.0/0 (or only the load balancer's security group) |
| PostgreSQL 5432 | only the app servers' security group, never the internet |
Referencing another security group as the source ("allow from app-sg") keeps rules correct as servers are added and removed.
Connecting without opening SSH
Systems Manager Session Manager gives you a shell through the AWS console or CLI with no inbound port open at all, and logs every session. With it, port 22 can stay closed entirely.
User data: setup at first boot
#!/bin/bash
apt-get update && apt-get -y upgrade
apt-get -y install nginx
systemctl enable --now nginx
Better still, bake the setup into the image or use Ansible (Automation & Scripting track), so every server is identical.
Where should code run?
| Option | Best for |
|---|---|
| Lightsail | simple fixed-price VPS, learning, small sites |
| EC2 | full control, long-running servers |
| ECS on Fargate | containers without managing servers |
| App Runner / Elastic Beanstalk | PaaS-style web apps on AWS |
| Lambda | event-driven and spiky workloads |
| Render, Railway, Fly.io | the simplest path for most small web apps |
Pick the highest level of abstraction that meets your needs. Running servers is a job in itself.
Check yourself
- Why can a
t-family instance suddenly become slow? - How do you let only app servers reach the database?
- What does Session Manager let you close?
Ihr Fortschritt wird nur in diesem Browser gespeichert.
Zur Prüfung einreichen (10 Punkte)