Launch EC2 and connect with SSH

What EC2 provides

An AMI supplies the operating-system image. An instance type defines CPU, memory and other capabilities. EBS provides persistent block storage. A key pair helps authenticate an SSH user, while a security group controls allowed network traffic. An IAM instance profile supplies AWS permissions to software on the server; it is different from the SSH key.

Launch steps

1. Open EC2 in your chosen Region and choose Launch instance. Name the instance academy-al2023.
2. Select the official Amazon Linux 2023 AMI. Use x86_64 for the course unless you deliberately adapt binaries for ARM.
3. Choose a small instance appropriate to the lab and review its price. Create/download a PEM key pair securely.
4. Select a VPC public subnet with a route to an internet gateway. Enable a public IPv4 for this introductory SSH lab.
5. Create a security group allowing TCP 22 only from your current public IP /32. Allow 80/443 only when running the web labs. Keep 3306 private.
6. Use encrypted gp3 root storage, require IMDSv2 where configurable, review settings and launch.
7. Repeat with an official Ubuntu Server 24.04 LTS AMI for the Ubuntu branch. Do not copy Amazon Linux package commands unchanged into Ubuntu.

Connect from your laptop

Replace the example addresses with the instance's public IPv4 or DNS name. These documentation addresses are not real lab servers.

chmod 400 academy.pem
ssh -i academy.pem ec2-user@203.0.113.10
# Ubuntu uses a different default account:
ssh -i academy.pem ubuntu@203.0.113.11

On Windows, use OpenSSH and restrict the key file's NTFS permissions to your user if SSH reports an unprotected key. Never upload the private key to a web server.

First commands and expected results

cat /etc/os-release
whoami
hostnamectl
ip -4 addr
lsblk

Expect ec2-user on Amazon Linux or ubuntu on Ubuntu. The interface normally shows the private IPv4, not AWS's mapped public IPv4.

Fix common failures

Timeout: inspect instance state, public IP, subnet route, security group, NACL and local network. Permission denied (publickey): inspect username and matching key. Host-key warnings after a replacement instance require verification through a trusted channel before removing the old entry. Do not disable host-key checking globally.

Practice and cleanup

Stop and start the lab, observe address changes, reconnect, then terminate instances you no longer need. Confirm root-volume deletion settings first. Session Manager is introduced later for private administration without inbound SSH.

Official reference

Connect to Linux with SSH

Interview and revision check

Why is an IAM role not a replacement for your SSH key?

The role authorizes AWS API calls by the workload. The SSH key authenticates a Linux account through the SSH server.