Amazon EC2 for Dummies — Virtual Servers on the Cloud
By: Furqan Butt
Tags: Amazon Web Services, AWS, Cloud Services, Cloud Computing, Ec2

For more information on Instance Types see the EC2 documentation.

3- Storage

Amazon EC2 offers flexible, cost-effective, and easy-to-use data storage options to be used with instances each having a unique combination of performance and durability. Each option can be used independently or in combination. These storage options are divided into 4 categories:

1- Amazon Elastic Block Store (EBS):

EBS is a durable block-level storage option for persistent storage. It is recommended for data requiring granular and frequent updates such as a database. The data persists on an EBS volume even after the instance has been stopped or terminated, unlike instance store volumes. It’s a network-attached volume so can be attached or detached at will from an instance. More than one EBS volumes can be attached to an instance at a time. The EBS encryption feature allows the encryption of data. For backups, EBS provides the EBS snapshot feature which stores the snapshot on Amazon S3 and can be used to create an EBS volume from it and attached to a new instance.

EBA volumes are created in a specific availability zone(AZ) and automatically replicated within the same AZ and are available for all instances in that particular availability zone. Amazon EBS provides the following volume types: General Purpose SSD, Provisioned IOPS SSD, Throughput Optimized HDD, and Cold HDD each type is either IOPS optimized or throughput optimized. EBS volumes provide the capability to dynamically increase size, modify the provisioned IOPS capacity, and change volume type on live production volumes. You continue to pay for the volume used as long as the data persists.

2- Amazon EC2 instance store:

It’s a temporary block-level storage option and is available on disks physically attached to the host computer, unlike EBS volumes that are network-attached. The data on instance store volumes only persist for the lifetime of the instance and can’t be detached and attached to other instances like EBS. Data persists in case the instance reboots but stoping or terminating the instance results in permanent loss of data since every block of storage in the instance store is reset. It is ideal for data that needs to be stored temporarily such as cache, buffer or frequently changing data.

The size of the instance store available and the type of hardware used for the instance store volumes are determined by the instance type. Instance store volumes are included in the cost of an instance’s usage cost. AMI’s created from instances having instance store as storage volumes don’t preserve data present on these volumes and are not present on instances launched from that AMI. Also changing instance type won’t have the same previous instance store volume attached to it and all data will be lost.

3- Amazon Elastic File System (Amazon EFS):

Amazon EFS is a scalable file storage and can be used to create a file system and mount to EC2 instances. It is used as a common data source for workloads and applications running on multiple instances.

4- Amazon Simple Storage Service (Amazon S3):

Amazon S3 is object storage that provides access to reliable, fast, and inexpensive data storage infrastructure. It allows you to store and retrieve any amount of data, at any time, from within Amazon EC2 or anywhere on the web. Amazon EC2 uses Amazon S3 for storing AMIs and snapshots of data volumes.

To learn more about storage visit EC2 documentation.

4- Networking

By default, all EC2 instances are launched in a default VPC which is a Virtual Private Cloud that enables you to logically separate a section of AWS cloud to launch your resources in a virtual network defined as per your needs. It consists of IPv4/IPv6 addresses, internet gateways, route tables, NAT gateways, public, and private subnets and helps you in designing your network and controlling access to your resources over the internet. You can place resources such as databases in a private subnet to deny any access to them over the internet or place others like web servers in public subnets for global access.

Amazon EC2 and Amazon VPC use the IPv4 addressing protocol by default and this behavior can’t be disabled. An IPv4 CIDR block must be specified when creating a VPC. A public IPv4 address is automatically assigned to an instance when launched in default VPC. These public IP addresses are not associated with a specific AWS account and when disassociated from an instance, they are released back into the public IPv4 address pool, and cannot be reused. For this purpose, AWS offers Elastic IP addresses (EIP). It is a public IPv4 address that you can allocate to your account until you choose to release it. A DNS Server is also provided by Amazon that resolves Amazon-provided IPv4 DNS hostnames to IPv4 addresses.

AWS also provides Elastic Network Interface(ENI) which is a logical networking component in a VPC that represents a virtual network card and enables the communication between different components. We can create our own network interface which can be attached to an instance, detached from an instance, and attached it to another instance as we require. Every instance in a VPC has a default network interface, called the primary network interface which cannot be detached.

To learn more about networking visit EC2 documentation.

5- Security

For building enterprise-level applications providing security is a must and AWS provides state of the art security features to prevent any threat to customer’s application. AWS follows the shared responsibility model that describes the security as a responsibility between both AWS and the customers.

Security of the cloud — The protection of the infrastructure that runs AWS services in the AWS Cloud falls under AWS’s responsibility. AWS also provides services that you can use securely. Third-party auditors regularly test and verify the effectiveness of AWS security as part of the AWS Compliance Programs.

— The protection of the infrastructure that runs AWS services in the AWS Cloud falls under AWS’s responsibility. AWS also provides services that you can use securely. Third-party auditors regularly test and verify the effectiveness of AWS security as part of the AWS Compliance Programs. Security in the cloud — Customer responsibility is determined by the AWS service that they use. Customers are responsible for other factors including the sensitivity of data, the company’s requirements, and applicable laws and regulations. For example, securely keeping the private key used for connection to EC2 instances is under Customer responsibilities.

Security is an utmost priority at AWS and there are a lot of security features provided by AWS that can help manage EC2 and other services security needs that include:

Infrasture security — that includes network isolation via VPCs and subnets, physical host isolation by virtually isolating EC2 instances on the same host, network control via security groups acts as a firewall and lets you define IP ranges to accept traffic from, NAT gateways to allow instances in private subnets to reach global internet, AWS Systems Manager Session Manager to access your instances remotely instead, VPC Flow Logs to monitor the traffic and EC2 Instance Connect for connection to your instances using Secure Shell (SSH) without the need to share and manage SSH keys.

— that includes via VPCs and subnets, by virtually isolating EC2 instances on the same host, via acts as a firewall and lets you define IP ranges to accept traffic from, to allow instances in private subnets to reach global internet, to access your instances remotely instead, to monitor the traffic and for connection to your instances using Secure Shell (SSH) without the need to share and manage SSH keys. Interface VPC endpoint — enables you to privately access Amazon EC2 APIs by restricting all network traffic between your VPC and Amazon EC2 to the Amazon network and eliminate any need for internet gateways, NAT devices, or virtual private gateways.

— enables you to privately access Amazon EC2 APIs by restricting all network traffic between your VPC and Amazon EC2 to the Amazon network and eliminate any need for internet gateways, NAT devices, or virtual private gateways. Resilience — The AWS global infrastructure is built around AWS Regions and Availability Zones. Regions include multiple (at least 2) Availability Zones that are physically separated and isolated connected via low-latency, high-throughput, and highly redundant networking. With Availability Zones, you can design and operate applications and databases that automatically failover between zones without interruption.

— The AWS global infrastructure is built around AWS Regions and Availability Zones. Regions include multiple (at least 2) Availability Zones that are physically separated and isolated connected via low-latency, high-throughput, and highly redundant networking. With Availability Zones, you can design and operate applications and databases that automatically failover between zones without interruption. Data protection — Data hosted on AWS’s infrastructure is controlled and maintained by AWS, including the security configuration controls for handling customer content and personal data. However, customers are responsible for any personal data that they put in the AWS Cloud. For that AWS provides encryption at rest for EBS volumes and snapshots and encryption in transit by providing a secure communication channel for remote access to instances. Secure and private connectivity between EC2 instances of all types is provided by AWS. In addition, some instances type automatically encrypt data-in-transit between instances.

— Data hosted on AWS’s infrastructure is controlled and maintained by AWS, including the security configuration controls for handling customer content and personal data. However, customers are responsible for any personal data that they put in the AWS Cloud. For that AWS provides for EBS volumes and snapshots and by providing a secure communication channel for remote access to instances. Secure and private connectivity between EC2 instances of all types is provided by AWS. In addition, some instances type automatically encrypt data-in-transit between instances. IAM — For data protection purposes, AWS recommends that you protect AWS account credentials and set up individual user accounts with AWS Identity and Access Management (IAM) so that each user is given only the permissions necessary to fulfill their job duties. Also, define roles and policies for services to access only the necessary features of a service.

— For data protection purposes, AWS recommends that you protect AWS account credentials and set up individual user accounts with AWS Identity and Access Management (IAM) so that each user is given only the permissions necessary to fulfill their job duties. Also, define roles and policies for services to access only the necessary features of a service. Key Pairs — A key pair, consisting of a private key and a public key, is a set of security credentials that you use to prove your identity when connecting to an instance. The public key is stored on EC2, and you store the private key. Private key is used to securely access your instances.

To learn more about security see EC2 documentation.