Amazon EC2 Overview: Instances, Networking, Storage, and Pricing – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

Amazon Elastic Compute Cloud (Amazon EC2) provides resizable compute capacity as virtual servers in AWS. The key architecture decisions involve selecting the right instance family, placing instances correctly in a VPC, choosing persistent or ephemeral storage, and controlling cost through lifecycle and purchasing decisions.

EC2 uses a shared-responsibility model: AWS operates the physical infrastructure and hypervisor, while the customer manages the guest operating system, applications, configuration, patching, and security inside the instance.

Key Concepts

EC2 instances and host infrastructure

An EC2 instance is a virtual machine with a selected combination of virtual CPUs, memory, networking capability, and storage options. Common operating systems include Linux and Windows. EC2 Mac instances run on dedicated Mac hardware rather than ordinary virtualized servers.

AWS manages the physical host servers and data centers. Customers are responsible for:

Selecting and configuring the instance.
Installing and maintaining the operating system.
Applying security patches.
Installing and updating applications.
Configuring host-based security controls.
Managing data and backups.

Instances can be started, stopped, rebooted, or terminated through the AWS Management Console, AWS CLI, SDKs, or automation systems.

Stopped: Compute charges generally stop, but attached EBS volumes, Elastic IP addresses, and other applicable resources continue to incur charges. Instance-store data is lost.
Running: Instance usage charges apply according to the instance type and purchasing option.
Terminated: The instance is deleted. EBS root volumes configured for deletion on termination are deleted; volumes configured to persist remain available.

Instance families and sizes

An instance family is optimized for a particular resource profile. The correct choice depends on the workload rather than simply selecting the largest available instance.

Family category	Relative strength	Typical workloads
General purpose	Balanced CPU, memory, and networking	Web servers, application servers, development environments
Compute optimized	More CPU relative to memory	Batch processing, high-performance web servers, scientific computation
Memory optimized	More memory relative to CPU	In-memory databases, caching, real-time analytics
Storage optimized	High local storage performance or capacity	Distributed file systems, data processing, high-throughput local storage
Accelerated computing	GPUs, FPGAs, or specialized accelerators	Machine learning, graphics, scientific workloads

An instance type such as m5.large can be interpreted as:

m: Instance family.
5: Generation.
large: Size within the family.

The exact CPU count, memory, network performance, storage support, and price depend on the specific generation and size. AWS instance specifications and prices change over time, so verify current values in AWS documentation when designing a solution.

VPC, Availability Zones, and subnets

EC2 instances are launched into subnets within a VPC. A subnet belongs to exactly one Availability Zone, while a VPC spans the Availability Zones in a Region.

A subnet being called “public” does not automatically make an instance reachable from the internet. Public connectivity generally requires all of the following:

A route from the subnet route table to an Internet Gateway.
A public IPv4 address or Elastic IP address on the instance, or a public-facing load balancer or other intermediary.
Security group rules allowing the traffic.
Network ACL rules that do not block the traffic.
An operating system and application configured to accept the connection.

Instances in private subnets normally use private IP addresses only. They can still initiate outbound internet connections through a NAT Gateway or NAT instance when required, without accepting unsolicited inbound internet connections through that path. Private connectivity to on-premises networks can use services such as AWS Site-to-Site VPN or AWS Direct Connect.

Elastic network interfaces

An Elastic Network Interface (ENI) is a virtual network adapter attached to an instance. An instance has a primary ENI and can support additional ENIs when the instance type and configuration allow it.

An ENI can have attributes such as:

A primary private IPv4 address.
Additional private IPv4 addresses.
An IPv6 address.
A security group association.
A MAC address.
A public IPv4 address association or Elastic IP association.

Additional ENIs can support network separation, appliance architectures, or multiple security-group and routing configurations. ENIs attached to a single instance must be in the same Availability Zone, although they may be placed in different subnets within that Availability Zone.

Enhanced networking uses the Elastic Network Adapter (ENA) on supported instance types to provide higher bandwidth and lower latency than basic networking. The Elastic Fabric Adapter (EFA) is designed for supported high-performance computing, tightly coupled machine learning, and MPI workloads. EFA is not available for every instance type and should be selected only when the workload and instance family support it.

EC2 IP addresses

#### Private IPv4 addresses

Every ENI has a private IP address. The private address normally remains associated with the ENI when an instance is stopped and started, provided the ENI is retained. Private addresses are used for communication within a VPC and connected networks.

#### Public IPv4 addresses

A public IPv4 address is mapped by AWS to the instance’s private IP address. The guest operating system generally sees only the private address on its network interface. A public IPv4 address assigned to an instance is not persistent across a stop and start operation; it can change.

Public IPv4 addresses are now chargeable, so avoid assigning them when they are not required.

#### Elastic IP addresses

An Elastic IP address is a static public IPv4 address allocated to the account. It can be reassociated with another ENI or instance, which is useful when a stable endpoint is required. Elastic IP addresses incur charges, including when allocated but not associated, so they should not be used as a default replacement for load balancing or DNS-based failover.

For highly available architectures, prefer a load balancer, Amazon Route 53, or another managed endpoint rather than relying on a single instance and Elastic IP address.

EBS volumes

Amazon Elastic Block Store (Amazon EBS) provides persistent block storage for EC2. Although EBS is network-attached, the operating system presents an attached volume as a block device or local drive rather than as a shared file system.

Important characteristics include:

An EBS volume exists in one Availability Zone.
An EC2 instance and its EBS volume must be in the same Availability Zone for attachment.
EBS is designed for persistence beyond an instance stop, subject to volume and snapshot configuration.
EBS volumes are replicated within their Availability Zone for protection from component failure.
EBS is not automatically replicated across Availability Zones. Use snapshots, replication, or a multi-AZ application design for AZ-level resilience.
Charges are generally based on provisioned volume capacity and selected performance, not merely the amount of data stored.

Common volume types include:

Volume type	Main characteristic	Typical use
`gp3`	General-purpose SSD with independently configurable performance	Most workloads, boot volumes, application servers, and many databases
`gp2`	Older general-purpose SSD with performance linked to volume size	Existing workloads and general-purpose use
`io1` / `io2`	Provisioned IOPS SSD for demanding, latency-sensitive workloads	High-performance databases and applications with sustained I/O requirements
`st1`	Throughput-optimized HDD	Large, frequently accessed sequential data such as logs and big-data processing
`sc1`	Cold HDD with lower cost and lower performance	Infrequently accessed, throughput-oriented data
`standard` magnetic	Previous-generation magnetic option	Legacy workloads; generally not preferred for new designs

EBS Multi-Attach is a specialized capability available for supported io1 and io2 volumes. It allows a volume to be attached to multiple EC2 instances in the same Availability Zone. It does not turn EBS into a general-purpose shared file system; the application and file system must support the required concurrent-access semantics. Use Amazon EFS for shared Linux file storage or an appropriate Amazon FSx service for Windows and other specialized file-system requirements.

Instance store

Instance store provides physically attached, ephemeral storage on the EC2 host. It can deliver very high performance, but data is lost when the instance is stopped, terminated, or when the underlying host fails.

Appropriate uses include:

Temporary processing space.
Caches.
Scratch files.
Replicated data where another copy exists.
Intermediate data that can be recreated.

Do not use instance store as the only location for persistent business data. Use EBS, Amazon S3, or a managed file system depending on the access pattern.

Exam-Relevant Takeaways

EC2 provides compute; the customer manages the guest operating system and applications.
Choose an instance family based on the workload’s CPU, memory, storage, network, or accelerator requirements.
A subnet belongs to one Availability Zone. For high availability, distribute instances across multiple Availability Zones.
A public subnet requires an Internet Gateway route, but an instance also needs an appropriate public address and permissive security controls.
Every instance has a private IP address through an ENI. A public IPv4 address is an external mapping and is not normally visible inside the guest OS.
A standard public IPv4 address can change after stop/start. Use an Elastic IP only when a stable IPv4 address is genuinely required.
EBS is persistent block storage and must be located in the same Availability Zone as the instance.
EBS is not a cross-AZ storage service by default. Snapshots and application-level replication are needed for cross-AZ recovery.
Instance store is ephemeral and should contain only disposable or replicated data.
EBS billing is based primarily on provisioned capacity and selected performance, so unused allocated space still costs money.
EBS Multi-Attach is not equivalent to EFS or a shared network file system.
Stopping an instance can reduce compute charges, but attached resources such as EBS volumes may continue to incur charges.

Architecture Decision Guide

Requirement	Recommended direction	Important qualification
Balanced application server	General-purpose EC2 family	Validate CPU, memory, network, and burst requirements
CPU-intensive batch or compute workload	Compute-optimized family	Confirm the workload scales efficiently with additional vCPUs
Large in-memory dataset	Memory-optimized family	Consider managed databases or caches where appropriate
High-performance database storage	`io2` or another supported provisioned-IOPS option	Size for both IOPS and throughput; verify database requirements
Low-cost sequential processing of large data	`st1`	HDD volumes are not intended for high random I/O
Temporary high-speed scratch data	Instance store	Data must be reproducible or replicated
Shared Linux file system	Amazon EFS	EBS Multi-Attach is not a general shared file system
Shared Windows file system	Amazon FSx for Windows File Server	Select the file service based on protocol and application needs
Stable public IPv4 for a specific resource	Elastic IP	Prefer managed load balancing or DNS for HA endpoints
Internet-facing EC2 application	Public load balancer in public subnets; instances commonly private	Avoid exposing individual instances unnecessarily
Private instance requiring outbound internet access	NAT Gateway in a public subnet	NAT does not provide unsolicited inbound access
Multi-AZ resilience	Replicate instances and application data across AZs	A single EBS volume cannot be attached across AZs

Common Exam Traps

“Public subnet means public instance.” A route to an Internet Gateway is necessary but not sufficient. The instance needs public addressing and appropriate security rules.
“Stopping an instance stops all charges.” EBS, Elastic IP, and other attached resources may continue to generate charges.
“EBS is automatically multi-AZ.” EBS replication is within an AZ. Cross-AZ resilience requires snapshots, replication, or a resilient application architecture.
“Instance store is faster EBS.” Performance is not the only distinction. Instance store is ephemeral and unsuitable as the sole copy of important data.
“A public IP is visible in the guest OS.” AWS maps the public address externally; the operating system generally sees the private ENI address.
“Elastic IPs are free and unlimited.” Public IPv4 addresses are chargeable, and Elastic IP use is subject to pricing and quota considerations.
“EBS Multi-Attach provides shared storage for any application.” It has supported volume types, AZ, instance, and file-system/application constraints.
“Any ENI can be attached in any AZ.” ENIs and instances are AZ-specific.
“The largest instance is the safest choice.” Oversizing increases cost and may not solve a bottleneck such as storage throughput, network bandwidth, or application scaling.
“Terminating an instance always deletes every volume.” Deletion depends on each volume’s DeleteOnTermination setting.

Real-World Engineer Notes

Design EC2 fleets as disposable when possible. Store durable data in EBS, S3, databases, or managed file services rather than relying on an individual instance.
Use Auto Scaling groups and load balancers to replace failed instances instead of manually repairing a single server.
Treat instance type selection as an iterative process. Monitor CPU, memory, disk queue, EBS I/O, network throughput, and application latency before resizing.
Separate boot and data volumes when lifecycle, backup, or performance requirements differ.
Schedule non-production instances to stop outside working hours, but also review EBS capacity, snapshots, public IPv4 addresses, and other continuing costs.
Use security groups as the primary instance-level network control and avoid assigning public IP addresses to instances that do not need direct internet reachability.
For multi-AZ recovery, use EBS snapshots or AWS Backup, but also test restoration time and application consistency. A backup that has never been restored is an assumption, not a recovery strategy.
Use EFA only for applications designed to exploit its supported low-latency communication model; it is not a general-purpose replacement for ENA.

Quick Reference Summary

Compute: EC2 instances are customer-managed virtual servers; AWS manages the physical hosts.
Placement: Instances run in subnets, and each subnet belongs to one Availability Zone.
Networking: ENIs provide private connectivity. Public access requires routing, addressing, and security controls.
Addresses: Private IPs are fundamental; ordinary public IPs can change; Elastic IPs are static but chargeable.
Persistent storage: EBS is AZ-scoped persistent block storage.
Ephemeral storage: Instance store is fast local storage whose data can disappear with instance or host lifecycle events.
Shared files: Use EFS or FSx rather than assuming EBS Multi-Attach is a shared file system.
Cost: Running instances incur compute charges; provisioned EBS capacity and other attached resources can continue charging when instances are stopped.
Resilience: Spread compute across AZs and replicate durable data across AZs or Regions as required.

Flashcards

What does an EC2 instance represent?

A virtual server with selected CPU, memory, networking, and storage characteristics.

Who patches the guest operating system on a standard EC2 instance?

The customer, as part of the EC2 shared-responsibility model.

What is the relationship between a subnet and an Availability Zone?

Each subnet belongs to exactly one Availability Zone.

What network interface connects an EC2 instance to a VPC?

An Elastic Network Interface (ENI).

Does launching an instance in a public subnet automatically make it internet-accessible?

No. Routing, public addressing, security groups, network ACLs, and host configuration must also permit access.

What happens to an ordinary public IPv4 address after an instance stop/start?

It can be released and replaced with a different public IPv4 address.

When should an Elastic IP be used?

When a resource requires a stable public IPv4 address that can be reassociated, although managed endpoints are often preferable for high availability.

Where must an EBS volume be located relative to its EC2 instance?

In the same Availability Zone.

Is EBS automatically replicated across Availability Zones?

No. Its built-in replication is within the Availability Zone.

Which EBS options are designed for provisioned high IOPS?

io1 and io2.

What is the primary risk of instance store?

It is ephemeral; data can be lost when the instance stops, terminates, or the host fails.

Is EBS Multi-Attach the same as a shared file system?

No. It permits supported multiple-instance attachments under constraints but remains block storage.

Which instance family is suited to CPU-heavy workloads?

Compute optimized.

Which instance family is suited to large in-memory datasets?

Memory optimized.

Practice Questions

Question 1

A company launches an EC2 instance in a subnet whose route table sends 0.0.0.0/0 to an Internet Gateway. The instance cannot be reached from the internet. Which additional configuration is most likely required?

A. Attach an EBS volume in another Availability Zone
B. Assign a public IPv4 address or Elastic IP and allow the traffic in security controls
C. Replace the Internet Gateway with a NAT Gateway
D. Enable EBS Multi-Attach

Correct answer: B

A public subnet route alone does not assign a public address or permit traffic. The instance needs a public IPv4 address or Elastic IP, along with suitable security group, network ACL, and host firewall rules. A NAT Gateway supports outbound connections from private resources, not unsolicited inbound connections.

Question 2

A database runs on an EC2 instance and requires persistent storage with high, consistent IOPS. Which option is most appropriate?

A. Instance store
B. sc1 cold HDD
C. io2 EBS volume
D. An unencrypted public S3 bucket mounted as a block device

Correct answer: C

io2 is a persistent EBS SSD option designed for demanding I/O workloads and provisioned IOPS. Instance store is ephemeral, while sc1 is intended for infrequently accessed throughput-oriented data.

Question 3

An application uses two EC2 instances in different Availability Zones. Both instances must access the same persistent file hierarchy. Which solution best fits this requirement?

A. Attach one EBS volume to both instances across the AZs
B. Use instance store on both instances
C. Use Amazon EFS
D. Assign the same Elastic IP address to both instances

Correct answer: C

Amazon EFS provides shared file storage for supported Linux workloads across Availability Zones. EBS volumes are AZ-scoped, and instance store is ephemeral. An Elastic IP is a network address, not storage.

Question 4

A development environment runs only during business hours. The team wants to reduce cost overnight while retaining the server’s data. What should they do?

A. Stop the EC2 instance and retain its EBS volumes
B. Terminate the instance and rely on instance store
C. Stop the instance and delete all EBS volumes
D. Leave the instance running because stopping does not reduce compute charges

Correct answer: A

Stopping an instance generally stops its compute usage charges while retaining attached EBS data. The EBS volumes continue to incur storage charges, so the team should also right-size provisioned capacity. Instance-store data would not be retained.

Question 5

A workload performs tightly coupled MPI calculations and requires very low-latency inter-instance communication. Which networking capability should the architect evaluate on supported EC2 instance types?

A. Elastic IP
B. Elastic Fabric Adapter (EFA)
C. NAT Gateway
D. Amazon EFS

Correct answer: B

EFA is designed for supported high-performance computing, MPI, and similar tightly coupled workloads. ENA provides enhanced general networking, but EFA is the specialized option for low-latency HPC communication.