Chapter 14: EC2 Operations — Elastic IP, AMI, Snapshots and Vertical Scaling

14.2 AMI (Amazon Machine Image)

By Ravindra Bagale · Last updated: 25 September 2026

In short: An AMI is a template used to launch instances.

What is an AMI?

An AMI is a template used to launch instances. It is made of:

In simple words, an AMI is like a "photocopy master" of a fully set-up computer — every instance launched from it starts as an exact copy. Technically, launching from an AMI creates new EBS volumes from its snapshots according to the block device mapping.

Create an AMI from a configured instance

Suppose your web-1 from Chapter 7 or 9 is working perfectly. Let's make a reusable image of it.

Step 1 — Clean up (optional but good): remove temporary files and secrets you don't want copied, e.g. rm -f ~/.bash_history.

Step 2 — Create image: EC2 → Instances → select web-1 → Actions → Image and templates → Create image.

• Image name: web-nginx-v1, description: Nginx + mysite, tested.
• No reboot — leave unticked (recommended) — see the table below.
• Instance volumes: review sizes/types; add tags → Create image.

Step 3 — Wait: EC2 → Images → AMIs → status changes from pending to available (a few minutes). Under Snapshots you will see the snapshot(s) created for it.

Launch a new instance from your AMI and verify

1. EC2 → AMIs → select web-nginx-v1 → Launch instance from AMI.
2. Choose instance type, the same key pair and the web-sg security group → Launch instance.
3. When it is running, open http://<NEW_PUBLIC_IP> — your site should appear without installing anything.

# on the new instance
sudo service nginx status          # or httpd / apache2
curl -I http://localhost
ls /var/www/mysite

Copy an AMI to another region

AMIs are regional. To launch the same server in another region (for disaster recovery or users abroad): select the AMI → Actions → Copy AMI → destination region (e.g. ap-south-2 Hyderabad) → name → (optional) encryption → Copy AMI. Then switch the console to the destination region and wait for it to become available.

aws ec2 copy-image --source-region ap-south-1 --source-image-id ami-0123456789abcdef0 \
  --region ap-south-2 --name "web-nginx-v1-hyd"

Share an AMI with another AWS account (brief)

Select the AMI → Actions → Edit AMI permissions → keep Private → Add account ID → enter the 12-digit account ID → Save changes. The other account finds it under AMIs → Private images. If the AMI's snapshots are encrypted with a customer managed KMS key, that key must also be shared; AMIs encrypted with the default aws/ebs key cannot be shared this way. Never make an AMI public if it contains your code, keys or passwords.

Deregister an AMI and delete its snapshots

Deregistering an AMI does not delete its snapshots — and snapshots keep costing money.

1. EC2 → AMIs → select the AMI → Actions → Deregister AMI (newer consoles offer a Delete associated snapshots option — the UI may vary) → confirm.
2. EC2 → Snapshots → find snapshots whose description says Created by CreateImage(i-...) for ami-... → Actions → Delete snapshot.

aws ec2 deregister-image --image-id ami-0123456789abcdef0
aws ec2 delete-snapshot --snapshot-id snap-0123456789abcdef0

The golden AMI idea

A golden AMI is a standard, pre-hardened, fully patched image with your common software (web server, agents, monitoring, security settings) already installed. Teams launch every new server from it instead of configuring each one by hand, so all servers are identical and launch fast. Rebuild the golden AMI regularly with the latest patches (tools like EC2 Image Builder automate this) and version it: golden-web-v1, v2, ...