EC2
Last updated
Last updated
It is Elastic Compute Cloud.
But What is Elasticity? - It is the ability for the infrastructure supporting a use case to grow and contract based on how much it is used at a point in time.
The name has elastic simply because of ability to resize capacities of vCPUs or RAM or SSD. The use cases are limitless.
One can launch EC2 on basis of the factors such as Instance Types [Predefined bundle of vCPU (processor), RAM (memory), SSD (storage) Network Bandwidth etc with varying options of General Purpose OR Compute or Memory or Storage optimized etc.), AMI, Purchase Options and Root Device type.
What is AMI? - Its Amazon Machine Image. Its kind of a like a template of a OS with different flavors of add-ons. AMI when instantiated, usually requires of Root Volume Template, Launch Permissions, Block Device Mapping etc.
In AWS EC2, there are different instance types, such as t3.medium or m5.large (t starting or m starting is general compute - the difference is that t is burstable and m is non burstable, i.e., for predictive workload, m type can be cheaper as the flexibility of t type may cost more), c5d.24xlarge (c starting is compute optimized), p3.16xlarge (p starting is accelerated compute optimized), i3.16xlarge (i starting is storage optimized), r4.large (r starting is memory optimized)
There are different types of Instances - On-Demand, Reserved, Spot, Savings Plan, Spot and Dedicated.
On-Demand as name suggests can be spun up and closed at any time. There are no contracts and mostly used for experimental POC purpose.
Reserved - Cheaper when compared to On-Demand Instances, because of commitment to use a Virtual Machine over a defined period (1 year or 3 year). There are multiple offering class, as mentioned below
Note that the pricing for the above are based on the following configuration options:
Platform - OS such as Linux or Windows
Tenancy - Underlying hardware can be dedicated to AWS Account or Default (Shared among multiple instances, even though they cannot communicate with each other)
Offering Class -
Instance Type - These are as defined above in bold. In Convertible, instance types may be changeable.
Term - It can be 1 year or 3 year
Payment Option - Payment terms can be All Upfront, Partial Upfront or No Upfront
Availability Zone - If this is selected during configuration of RI, it can be termed as Reserved RI, if all availability zones within an entire region is selected for discounts to be applied otherwise discount can be applied in a single availability zone, to reserved capacity.
Note that if suppose an AWS user is signing up for a Reserved Instance for a 3 year plan and then the user does not require that Reserved Instance, let's say after 2 year, then the user can have the option to sell Reserved Instances on Amazon Reserved Instance Marketplace, where there are also opportunities to buy instances for terms shorter than one year.
Savings Plan is rather commitment to pay per hour that can be utilized for any of the compute services that matches the criteria given at the time of purchasing the plan, rather than reserved instances, where you pay for commitment to use a instance for a standard 1 or 3 year plan.
Spot is like of stock market. If the price offered by you to AWS is higher than the spot price, your instance is up. If the spot price goes higher than what you were paying per hour, your instance is terminated. The price difference can be verified from the AWS pricing calculator:
These are meant for those applications which can be easily operated by starting and stopping them i.e. something which don't have a real time usage and are used to carry out independent work.
Dedicated host is like full physical server for the customer/user in AWS data center. This is the most expensive option. Note the difference between dedicated instance and dedicated host may sound a bit complex, but is not. Dedicated instances means the various instances created by a single customer (AWS User Account) onto the same underlying hardware; that hardware can be the same or different depending upon how many dedicated hardware we have opted for in AWS. Dedicated Host, on the other hand ensures that hardware will always be the same for a particular instances that the user will launch. This is usually helpful for running softwares which binds with hardware device id.
To Launch an instance on-demand with default settings, one can follow the steps as shown below:
Now, there are three ways to go ahead (One is Auto Assign Public IP, One is Assign Elastic IP and last is not to assign an public IPv4).
From below, steps to further configure an AWS instance merges from the above three NIC variants shown above
Here, IAM Instance Profile can be used to provide role based access to EC2 instance.
The EC2 instance profile assumes an role that has access policy to S3 buckets. So, by the virtue of presence of applications on the EC2 instances, they are able to generate temporary credentials to access S3. Here, the EC2 has that trust relationship in form of service role, this means that if tomorrow instead of XYZ application, ABC application gets deployed on that EC2 instance, they will still be able to access the S3 bucket as they are associated with the EC2 rather than long-term credentials which can be hardcoded in the application. This also means, if more than one application is hosted on EC2, every app would be able to access the s3 bucket.
Basically, the applications access the s3 bucket using IMDS (Instance Metadata Service) endpoint on a link-local address of 169.254.169.254 to get short term credentials at runtime and access s3 using that.
The IMDS service can be used to fetch the following metadata. It is the way by which AWS makes configuration data available to EC2
Public IP Address
UserData
Security Groups
Instance details
IAM Access Credentials for the EC2 instance
The url is http://169.254.169.254/latest/meta-data
AWS IMDSv1 (Instance Metadata Service Version 1) and IMDSv2 (Instance Metadata Service Version 2) are services provided by Amazon Web Services (AWS) that allow EC2 instances to retrieve metadata about themselves and interact with the instance’s local configuration. While both services serve similar purposes, they have significant differences in terms of security and functionality.
IMDSv1 was the original metadata service provided by AWS. It allowed EC2 instances to access metadata by making HTTP requests to a predefined local IP address (http://169.254.169.254). While it was useful for retrieving instance information and user data, it had some security concerns, as it didn’t offer strong protection against potential attacks.
IMDSv2, introduced to address these security concerns, enhances the metadata service significantly. IMDSv2 provides a more secure and robust way to access instance metadata. It uses a session-based approach, requiring an instance to authenticate and use a short-lived token to access metadata. This mitigates risks related to potential exploitation of the metadata service by unauthorized entities, making it more resilient against various attacks.
For the instance’s hostname:
curl http://169.254.169.254/latest/meta-data/hostname
For the instance’s AMI ID:
curl http://169.254.169.254/latest/meta-data/ami-id
For the instance type:
curl http://169.254.169.254/latest/meta-data/instance-type
For getting the public IPv4 address assigned to the instance:
curl http://169.254.169.254/latest/meta-data/public-ipv4
For getting security groups associated with the instance:
curl http://169.254.169.254/latest/meta-data/security-groups
For getting the EC2 Instance Profile credentials of the IAM role (if a role is attached to the instance):
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name
Note:
a) Placement Group allows to specify how instances are placed on underlying hardware. There are three types, namely cluster, partition and spread.
Cluster helps to keep the two instances very near to each other within an availability zone with having a far better instance to instance communication for low latency and high throughput.
Spread offers hardware isolation, i.e., each instance in run on separate hardware.
Partition is a hybrid of above two, i.e., suppose there are 8 instances then there would be group of 4-4 instances within a partition. So, instance to instance communication within the same partition is very fast; at the same time, they are isolated with the other set of partition on hardware level. These are also called as nodes
b) The On Demand Capacity Reservation is different from Reserved instances. This was introduced during Covid crisis. Because of huge shift to cloud, many new users were launching EC2 instances, and old users were getting error of type "No capacity on host to run the instances". Hence, AWS came up with the idea to pre-book a slot for on-demand instances at no extra cost, but providing users a way to get guaranteed capacity to run shorter term workloads which can be turned on and off at any given time.
Note: Whenever selecting AMI (Amazon Machine Image) from Community or AWS Marketplace, one can find that Amazon supports two types of images. One is HVM (Hardware Virtual Machine) and other is PV (ParaVirtual). To learn the difference, kindly check out the below data sourced from the AWS Docs:
Let's now see about reserved instances launch:
Post this, launch the instance of the exact same configuration just like an on demand instance and it would eventually be shown into the reserved instances section, solidifying that reserved instance discounts are being applied on the turned on instance
Practical usage for AMI: Suppose a user created an EC2 instance, configured everything that is required in the system such as settings and softwares. Now, the user wishes to create copies of this EC2 instance with the previous OS and instance settings as golden copy, then it can be done by creating image or snapshot of the machine, which can be replicated with new instances.
Rest of the steps to launch the instance is similar
Note that an EC2 can have different stages such as AMI -> Pending -> Running -> Stopping -> Stopped -> Shutting Down -> Terminated.
When an instance is in Hibernation mode (Stopped Stage), the contents of its RAM are quickly flushed into the EBS, so that next time the instance is made up, the RAM can be repopulated with the same data, making the transition feel seamless.
Steps are as follows:
Step 1: Stop the instance.
Step 2: Note down the Security Groups attached to the instance
Step 3: If an elastic IP is attached to it, make note of it as well as the network interface.
Step 4: Create an AMI of the same as shown above.
Step 5: Terminate the instance. This will detach the the network interface from the instance.
Step 7: Create a new network interface in the required subnet or availability zone with new private IPv4 address as per the subnetwork and associate the elastic IP with this interface.
Step 8: Create an instance from that AMI. While doing that, in the wizard, attach the new network interface which has association of previous elastic IP and relevant security group.
Suppose there is a video streaming application with fluctuating workloads, data gathered from Cloud Watch and is as shown below:
This typical week shows demand of the application by its consumers with release of final trailer on Thursday and movie on Friday and general viewing habits peaking in the Weekend.
If the video streaming platform wants to optimize costs of the application, it needs to scale the application underlying EC2 instances with demand rather than keeping the high cost instances up all the time. This can be done with the help of Auto Scaling Groups.
Auto Scaling allows to add or remove EC2 instances on demand based on conditions specified to maintain performance and optimize costs. This results in automated scalability. There are two types of scalability:
Scaling Out: Increase in EC2 instances by launching them.
Scaling In: Decrease in EC2 instances by terminating them.
The steps to achieve Auto Scaling happens in three stages:
Auto Scaling Launch Configuration
Auto Scaling Group
Auto Scaling Policy
Note that the best way of Auto Scaling is Dynamic one. Let us take an example: There are two instances, supported by Elastic Load Balancing. As ELB sees a surge in demand in number of requests hitting it, a CloudWatch alarm is triggered. This results in auto scaling event to be executed, which can be to scale out to meet the rising demand.
Note that it also supports MAC OS instanceshttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-mac-instances.html
Step 6: Under the network interface, disassociate address and select the elastic IP.
