Launching Linux and Windows EC2 Instances – SAP-C02 Study Guide

Purpose of This Lesson

Launching an Amazon EC2 instance requires more than selecting an operating system. You must choose an appropriate hardware profile, define the software image, configure authentication, and control network access with security groups.

This lesson covers the basic launch workflow for both Linux and Windows instances and highlights the differences between SSH and RDP connectivity.

Key Concepts

EC2 instance types

An EC2 instance type defines the virtual hardware profile available to the instance, including:

• vCPU capacity
• Memory
• Network performance
• EBS bandwidth
• Specialized capabilities, depending on the family
• Pricing

The t2.micro instance type is a small, general-purpose burstable instance often used in introductory labs. However, it is an older generation, and free-tier eligibility depends on the AWS account, region, and current AWS Free Tier terms. Do not assume that every account or region provides unlimited free usage.

For production workloads, select an instance family and size based on measured CPU, memory, network, storage, and workload requirements rather than simply choosing the smallest eligible type.

Amazon Machine Images (AMIs)

An AMI is a launch template for an EC2 instance. It typically defines:

• Operating system
• Preinstalled software
• Default configuration
• Root storage layout
• Architecture, such as x86 or Arm
• Launch permissions and region availability

Common AMI sources include:

• Quick Start AMIs: AWS-maintained or commonly used operating system images
• My AMIs: Custom AMIs owned by your account
• AWS Marketplace AMIs: Commercial products that may include software licensing charges
• Community AMIs: Images shared by other AWS users; review their publisher, contents, and security carefully

An AMI is not the same thing as a running instance. It is used to create one or more instances with a consistent baseline.

EBS snapshots and custom AMIs

Amazon EBS snapshots are point-in-time backups of EBS volumes. A custom AMI can be created from an existing EC2 instance and its associated EBS-backed storage. That AMI can then be used to launch standardized instances.

A common image-building workflow is:

1. Launch a trusted base AMI.
2. Install patches, agents, applications, and configuration.
3. Remove instance-specific data or credentials.
4. Create a custom AMI.
5. Launch new instances from the approved image.

For repeatable production builds, consider automation with EC2 Image Builder, infrastructure as code, and a controlled image pipeline rather than manually modifying a server.

Key pairs

EC2 key pairs provide public-key authentication for instance access:

• The public key is placed on the instance.
• The private key is downloaded when the key pair is created.
• The private key must be protected and must not be committed to source control or broadly shared.

For Linux, the private key is commonly used for SSH access. For Windows, the key pair is required to decrypt or retrieve the initial Administrator password through the EC2 console or API.

Losing the private key can prevent the normal access method from working. AWS does not provide a replacement for the lost private key associated with an already running instance.

Security groups

A security group is a stateful, instance-level virtual firewall. It controls inbound and outbound traffic using rules based on protocols, ports, and source or destination addresses.

Typical management ports are:

• SSH: TCP port 22 for Linux
• RDP: TCP port 3389 for Windows

Security groups are stateful: when an inbound connection is allowed, the response traffic is automatically allowed, provided the relevant security group behavior and network configuration permit it.

New security groups deny inbound traffic by default. Rules should grant access only from the required sources. Opening SSH or RDP to 0.0.0.0/0 permits the entire IPv4 internet to attempt connections and should generally be limited to temporary labs or replaced with safer access patterns such as Systems Manager Session Manager, a bastion host, VPN, or a restricted corporate CIDR range.

Networking and addressing

At launch, an instance is placed into a subnet in a specific Availability Zone and associated with a VPC. The instance may receive:

• A private IPv4 address for VPC communication
• A public IPv4 address, if subnet and launch settings allow it
• Public and private DNS names, depending on addressing configuration

A public IP address can change when an instance is stopped and started. Use an Elastic IP address only when a stable public IPv4 address is genuinely required; otherwise, prefer DNS, load balancers, or private connectivity.

Exam-Relevant Takeaways

• The instance type determines virtual hardware capacity and strongly influences price.
• The AMI determines the operating system, software baseline, architecture, and root-volume configuration used at launch.
• An AMI can be used to launch multiple consistent instances.
• EBS snapshots provide point-in-time volume backups and support image-based recovery and replication workflows.
• Linux administration commonly uses SSH on TCP 22.
• Windows administration commonly uses RDP on TCP 3389.
• A Windows instance requires an EC2 key pair to obtain its initial Administrator password through the standard console workflow.
• Security groups are stateful and deny unsolicited inbound traffic unless an inbound rule allows it.
• A security group rule using 0.0.0.0/0 allows all IPv4 sources and is usually too permissive for production administration.
• Marketplace AMIs may add software or licensing charges beyond the EC2 infrastructure cost.
• The console’s running-instance filter can hide stopped or pending instances; use the appropriate state filter when troubleshooting visibility.
• Free-tier eligibility is account- and offer-dependent. Always verify current pricing and regional availability.

Architecture Decision Guide

Requirement	Appropriate choice	Important consideration
Small, burstable development server	T-family instance	Confirm generation, workload suitability, credits, and current pricing
Standardized application server fleet	Custom AMI or automated image pipeline	Keep images patched and remove secrets before publishing
Linux administration	SSH over TCP 22, or Systems Manager Session Manager	Restrict sources; avoid exposing SSH broadly
Windows administration	RDP over TCP 3389, or Systems Manager where supported	Restrict RDP to trusted networks or use private access
Commercial appliance or packaged software	AWS Marketplace AMI	Review license, support, and hourly software charges
Need for consistent recovery	EBS snapshots and/or custom AMIs	Validate restore procedures and application consistency
Stable public endpoint	Elastic IP only when necessary, or a DNS/load-balancer design	Public IPv4 addresses have cost and exposure implications
No direct inbound administration required	Systems Manager Session Manager	Requires suitable IAM permissions, SSM Agent, and network reachability

Common Exam Traps

• Confusing an AMI with a snapshot: A snapshot is a point-in-time backup of an EBS volume. An AMI is a launchable image definition that can reference one or more snapshots and includes launch metadata.
• Using the wrong management port: SSH uses TCP 22; RDP uses TCP 3389. Opening only port 22 does not enable Windows Remote Desktop.
• Assuming security groups are network ACLs: Security groups are stateful and attached to network interfaces or instances. Network ACLs operate at the subnet boundary and are stateless.
• Opening administrative ports globally: 0.0.0.0/0 is not a secure default for SSH or RDP in production.
• Forgetting the Windows key pair: Without the assigned key pair, the normal process for decrypting the initial Windows password is unavailable.
• Treating Marketplace images as free: The AMI may be free while the included application has separate license charges.
• Assuming public IP permanence: A standard public IPv4 address may change after stop/start. Use DNS or an Elastic IP when a stable address is required.
• Choosing an instance solely because it is free tier eligible: Free-tier status does not prove that the instance has adequate performance, and the applicable offer may vary by account and date.

Real-World Engineer Notes

• Prefer private subnets for instances that do not need direct internet ingress.
• Use Systems Manager Session Manager for administrative access where possible. It avoids inbound SSH/RDP exposure and provides centralized access control and audit integration.
• If SSH or RDP is required, allow access from a VPN, bastion security group, or tightly controlled corporate CIDR rather than the entire internet.
• Apply least-privilege IAM permissions to the engineers and automation that launch instances.
• Encrypt EBS volumes and snapshots, especially when images contain business data or regulated information.
• Establish image ownership, patching, vulnerability scanning, versioning, and retirement processes for custom AMIs.
• Do not bake passwords, long-lived credentials, private keys, or API secrets into an AMI.
• For repeatable environments, define the instance, subnet, security group, IAM role, and storage settings with CloudFormation, Terraform, or another infrastructure-as-code tool.
• A security group named web-access does not automatically make an application reachable. The application must listen on the required port, the subnet route table must provide the needed path, and network controls must permit the traffic.

Quick Reference Summary

• Instance type: Virtual hardware and pricing profile.
• AMI: Operating system and software template used to launch instances.
• EBS snapshot: Point-in-time backup of an EBS volume.
• Custom AMI: Reusable image created from a prepared instance and its storage configuration.
• Linux access: Usually SSH on TCP 22.
• Windows access: Usually RDP on TCP 3389.
• Key pair: Public/private key authentication; also needed to retrieve the initial Windows password.
• Security group: Stateful instance-level firewall.
• Default inbound posture: Deny until an inbound rule allows the traffic.
• Production default: Keep administrative access private and narrowly scoped.

Flashcards

1. Q: What does an EC2 instance type define?

A: The virtual hardware profile, including compute, memory, networking characteristics, and pricing.

1. Q: What is the purpose of an AMI?

A: It provides the operating system, software baseline, storage layout, and metadata used to launch EC2 instances.

1. Q: What is an EBS snapshot?

A: A point-in-time backup of an EBS volume.

1. Q: Why create a custom AMI?

A: To capture a standardized, preconfigured server baseline that can be used to launch consistent instances.

1. Q: Which port is normally used by SSH?

A: TCP port 22.

1. Q: Which port is normally used by RDP?

A: TCP port 3389.

1. Q: Why is a key pair important for a Windows EC2 instance?

A: The private key is used to decrypt or retrieve the initial Administrator password.

1. Q: What is the default inbound behavior of a new security group?

A: Inbound traffic is denied until an inbound rule allows it.

1. Q: Are security groups stateful or stateless?

A: Stateful; response traffic for an allowed connection is automatically permitted.

1. Q: What does 0.0.0.0/0 represent?

A: Any IPv4 source address.

1. Q: What additional costs may an AWS Marketplace AMI introduce?

A: Charges for the software or appliance license in addition to EC2 and related AWS infrastructure costs.

1. Q: Why might a public IPv4 address change?

A: A standard public IP can be released when an instance is stopped and started; an Elastic IP or DNS-based design is needed for stable addressing.

Practice Questions

Question 1

A company launches a Windows Server EC2 instance. The security group allows inbound TCP port 22 from the administrator’s office, but the administrator cannot connect with Remote Desktop. What is the most likely correction?

A. Add an inbound rule for TCP port 3389 from the administrator’s office
B. Replace the AMI with a Linux AMI
C. Add an outbound rule for TCP port 22
D. Create an EBS snapshot

Correct answer: A

Explanation: Windows Remote Desktop uses RDP over TCP port 3389. TCP port 22 is normally used for SSH and does not enable RDP.

Question 2

A solutions architect needs to deploy 50 identical application servers with the same operating system, agents, packages, and configuration. Which approach best improves consistency?

A. Configure each instance manually after launch
B. Create and approve a custom AMI, then launch instances from it
C. Open all security group ports and copy files between instances
D. Use a different Marketplace AMI for every instance

Correct answer: B

Explanation: A custom AMI captures a standardized baseline and can be reused for multiple launches. In a mature environment, image creation should be automated and governed through an image pipeline.

Question 3

A security review finds that an EC2 security group allows SSH from 0.0.0.0/0. The instances are used by employees connected to a corporate VPN. What is the best improvement?

A. Remove all inbound rules and rely on outbound rules
B. Restrict TCP 22 to the corporate VPN CIDR or use Session Manager
C. Change SSH to UDP 22
D. Replace the AMI with an AWS Marketplace AMI

Correct answer: B

Explanation: Administrative access should be limited to trusted sources. A corporate VPN CIDR provides narrower access, while Systems Manager Session Manager can eliminate the need for inbound SSH in suitable designs.

Question 4

An engineer selects an AWS Marketplace AMI for a firewall appliance because the EC2 console shows that the underlying instance type is eligible for a free-tier offer. What should the engineer verify before estimating cost?

A. Whether the AMI’s software license has separate charges
B. Whether the security group is stateful
C. Whether RDP uses port 22
D. Whether EBS snapshots are stored in RAM

Correct answer: A

Explanation: Marketplace products can add software licensing or subscription charges. Instance-level free-tier eligibility does not necessarily make the complete solution free.

Question 5

An operations team stops and later starts an EC2 instance. A customer-facing integration fails because it connects directly to the instance’s former public IPv4 address. What design change addresses the stable endpoint requirement?

A. Create another security group
B. Use an Elastic IP or, preferably where appropriate, a DNS/load-balancer endpoint
C. Replace the key pair
D. Create a community AMI

Correct answer: B

Explanation: A standard public IPv4 address may change after stop/start. An Elastic IP provides a stable public IPv4 address, while DNS or a load balancer is often a better abstraction for application endpoints.