Launching an EC2 Instance

This tutorial covers the process to launch an EC2 instance (VM) using the aws cli

The steps below provide examples of several aws commands for interacting with EC2 and collecting the information needed to launch instances.

AWS Documentation on using the Amazon Web Console to perform these steps is available here, this guide covers the steps to do so via the command line.

Collecting Required Details

We will collect the following details, learning more about the powerful aws command line as we go.

Once you have gone through these steps ones, launching any number of instances is easily achieved.

Each step is show below, ending with the full command to launch the instance and then connect to it.

Amazon Machine Image (AMI) Id

Command to filter on Amazon Linux, Ubuntu, Suse, and Red Hat images and return the Id of the current version:

aws ec2 describe-images --owners amazon --filters 'Name=name,Values=amzn2-ami-hvm-2.0.????????-x86_64-gp2' 'Name=state,Values=available' --output json --profile cades-ops-admin | jq -r '.Images | sort_by(.CreationDate) | last(.[]).ImageId'
ami-009d6802948d06e52

To view details about the returned image (which should be the most recent)

aws ec2 describe-images --image-ids ami-009d6802948d06e52

Ref: aws docs

Instance Type

Full specs on CPU, Memory, etc. for each type can be found here

An abbreviated list of instance types can be obtained with:

aws pricing get-attribute-values --service-code AmazonEC2 --attribute-name instanceType --region  us-east-1

Ref: https://github.com/aws/aws-cli/issues/1279

Create Keypair

You must have access to a keypair (.pem file) to access your instance via ssh after launching.

aws ec2 describe-key-pairs --profile default #or specify
{
    "KeyPairs": []
}

You may create a new keypair with

aws ec2 create-key-pair --key-name awstutorial --output text > ~/.ssh/awstutorial.pem
chmod 600 ~/.ssh/awstutorial.pem

Save the generate keypair in a safe location. The local $HOME./ssh directory may provide minimal protective permissions, though you may consider a mountable encrypted directory solution.

VPC Subnet

Subnets are created withing each AWS region, from which IPs are assigned.

You must choose a subnet matching the region you are launching in.

aws ec2 describe-subnets

Display a summary list of subnets for a specific --region

aws ec2 describe-subnets --region us-east-1 | jq '.Subnets[].AvailabilityZone, .Subnets[].State, .Subnets[].VpcId, .Subnets[].CidrBlock'

Security Group

Security groups are sets of firewall rules within AWS which you control.

The default security group normally has tcp/22 inbound, to allow ssh. You may modify this, or create additional groups to attach as appropriate.

Describe all defined security groups:

aws ec2 describe-security-groups

Filter on a specific group:

aws ec2 describe-security-groups --group-name default
or
aws ec2 describe-security-groups --group-ids sg-71fda600

Launch Your Instance

Now that we've chosen the desired Amazon Machine Image (OS), the size of the VM, and know to which security groups and subet to attach upon creation you may launch with:

aws ec2 run-instances --image-id ami-009d6802948d06e52 --count 1 --instance-type t2.micro --key-name cades-ops --security-group-ids sg-71fda600 --subnet-id subnet-091af86d

Output will show various details of the instance, including the InstanceId

The public IP address is not immediately displayed, as the IP is still being provisioned. After a moment, describe the instance to discover it's PublicIpAddress:

aws ec2 describe-instances --instance-ids i-07d1912eb6f402d36

or

aws ec2 describe-instances --instance-ids i-07d1912eb6f402d36 | jq '.Reservations[].Instances[].PublicIpAddress, .Reservations[].Instances[].PublicDnsName, .Reservations[].Instances[].State'
"35.170.65.50"
"ec2-35-170-65-50.compute-1.amazonaws.com"
{
  "Code": 16,
  "Name": "running"
}

SSH Into Instance

Outbound SSH from ORNL to the external world is blocked, however you can install and use corkscrew which allows connecting through the ORNL SSH proxy.

Once corkscrew is installed, you may connect by providing the .pem file (keypair, created above) and specifying the IP address or PublicDnsName of the instances

You may add the proxy command to ~/.ssh/config host profiles, as well as the location of your .pem file.

📝 Note: The user to connect as is determined by the AMI used to launch the instance and may be ec2-user, root, ubuntu, or something else.

ssh -o 'ProxyCommand corkscrew snowman.ornl.gov 3128 %h %p' -i ~/.ssh/awstutorial.pem ec2-user@35.170.65.50

or

ssh -o 'ProxyCommand corkscrew snowman.ornl.gov 3128 %h %p' -i ~/.ssh/awstutorial.pem ec2-user@ec2-35-170-65-50.compute-1.amazonaws.com
       __|  __|_  )
       _|  (     /   Amazon Linux AMI
      ___|\___|___|

https://aws.amazon.com/amazon-linux-ami/2017.03-release-notes/
22 package(s) needed for security, out of 54 available
Run "sudo yum update" to apply all updates.
Amazon Linux version 2018.03 is available.

Troubleshooting SSH Connections

Stopping and Terminating Deleting Instance

Behavior when terminating (deleting) instances is covered here

A few important points:

aws ec2 stop-instances --instance-ids i-07d1912eb6f402d36
aws ec2 terminate-instances --instance-ids i-07d1912eb6f402d36