Launch Your First EC2 Instance with AWS CLI

What is EC2?

Amazon EC2 (Elastic Compute Cloud) is AWS’s virtual machine service. When you launch an instance, you are renting a slice of a physical server in an AWS data centre. You get a full operating system, CPU, RAM, and storage, and you pay by the hour while it is running.

A few terms you will see throughout this guide:

• AMI (Amazon Machine Image): the OS template your instance boots from. Think of it as a pre-made disk snapshot. AMI IDs are region-specific. See the AMIs guide.
• Instance type: determines how much CPU and RAM you get. t3.micro is a small, low-cost option for learning. See EC2 instance types explained.
• Security group: a firewall rule set that controls which traffic can reach your instance. See security groups explained.
• Subnet: a partition of a VPC network. Whether the subnet is public or private determines whether the instance gets a routable IP. See subnets in AWS.
• Key pair: a public/private key for SSH access. AWS stores the public key on the instance; you download the private key once and keep it safe.

How launching an EC2 instance works

Before you run any commands, here is the dependency chain. Each step in this guide maps to one of these:

1. AMI: pick an OS image. The ID is region-specific.
2. Instance type: choose the size (CPU and RAM).
3. Network: the instance launches into a VPC and subnet. Most accounts have a default VPC with public subnets already configured.
4. Security group: controls what traffic is allowed in and out.
5. Access method: either a key pair for SSH, or Session Manager (no key pair needed).
6. Launch: AWS provisions the hardware, boots the OS, and assigns an IP address.
7. Connect: SSH in (or use Session Manager) once the instance is running.

Nothing in the launch command is magic. You are assembling these pieces and telling AWS exactly what you want.

When to use EC2

EC2 is a strong choice when you need:

• A persistent server that runs continuously
• Full control over the OS, installed packages, or system configuration
• Long-running processes (more than 15 minutes)
• Applications that are difficult to containerise or have unusual system-level requirements
• A learning environment where you want direct shell access to a Linux machine

EC2 is not the best fit for every workload. If your use case is event-driven and short-lived, Lambda or containers are likely cheaper and simpler to operate. See choosing between EC2, Lambda, and containers if you are unsure which to use.

CLI vs Console

Both the AWS CLI and the AWS Management Console can launch EC2 instances. This guide uses the CLI because:

• Commands are reproducible and scriptable
• You see exactly which parameters you are setting
• You can save the commands and repeat them in different environments

The Console is easier for one-off exploration but hides the underlying API calls. Learning the CLI first means the Console will make more sense when you use it later.

Before you start

You will need:

• An AWS account. The AWS account setup guide covers this.
• The AWS CLI installed and configured with credentials. See the AWS CLI guide.
• An IAM user or role with permissions to create EC2 resources: at minimum ec2:RunInstances, ec2:CreateKeyPair, ec2:CreateSecurityGroup, and related actions. Review the IAM overview if you are unsure.
• A terminal (macOS Terminal, Linux bash, or Windows WSL).

aws configure set region us-east-1

Replace us-east-1 with your preferred region. All commands on this page assume a single consistent region.

Step 1: Find an AMI ID

An AMI is the operating system image your instance boots from. AMI IDs are region-specific: the same OS has a different ID in us-east-1 versus eu-west-1. Do not hardcode IDs from other tutorials. They expire or belong to a different region.

Look up the latest Amazon Linux 2023 AMI ID in your configured region:

aws ssm get-parameter \
  --name "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64" \
  --query "Parameter.Value" \
  --output text

This returns an ID like ami-0abc1234567890def. Copy it for the launch command in Step 5.

For Ubuntu 22.04 LTS, filter by Canonical’s official owner ID to avoid unofficial images:

aws ec2 describe-images \
  --owners 099720109477 \
  --filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*" \
  --query "sort_by(Images, &CreationDate)[-1].ImageId" \
  --output text

The owner ID 099720109477 is Canonical’s AWS account. Always filter by a trusted owner when searching public AMIs.

Step 2: Create a key pair

A key pair is how you SSH into the instance. AWS stores the public key on the instance; you download and keep the private key. If you plan to use Session Manager for access instead of SSH, you can skip this step entirely.

aws ec2 create-key-pair \
  --key-name my-first-key \
  --query "KeyMaterial" \
  --output text > my-first-key.pem

Then restrict permissions on the file. SSH refuses to use a private key that other users can read:

chmod 400 my-first-key.pem

Step 3: Create a security group

A security group is a stateful firewall attached to your instance. By default it blocks all inbound traffic. You need to explicitly allow SSH (port 22) from your IP before you can connect.

First, find your default VPC ID:

aws ec2 describe-vpcs \
  --filters "Name=isDefault,Values=true" \
  --query "Vpcs[0].VpcId" \
  --output text

Create a security group inside that VPC. Replace vpc-0abc12345def67890 with your VPC ID:

aws ec2 create-security-group \
  --group-name my-first-sg \
  --description "Security group for my first EC2 instance" \
  --vpc-id vpc-0abc12345def67890

The output includes a security group ID like sg-0abc12345def67890. Now add an SSH inbound rule restricted to your IP. Find your current public IP first:

curl -s https://checkip.amazonaws.com

Then add the rule, replacing YOUR_IP with the address printed above:

aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc12345def67890 \
  --protocol tcp \
  --port 22 \
  --cidr YOUR_IP/32

Step 4: Find a subnet ID

Instances launch into a subnet inside a VPC. For this guide, you want a public subnet so the instance receives a routable IP address. Find public subnets in your default VPC:

aws ec2 describe-subnets \
  --filters "Name=vpc-id,Values=vpc-0abc12345def67890" \
  --query "Subnets[?MapPublicIpOnLaunch==\`true\`].[SubnetId,AvailabilityZone]" \
  --output table

Pick any subnet ID from the output, for example subnet-0abc12345def67890. If no results appear, your VPC may not have public subnets configured. See default vs custom VPCs.

Step 5: Launch the instance

Replace the placeholder values below with the AMI ID from Step 1, the security group ID from Step 3, and the subnet ID from Step 4:

aws ec2 run-instances \
  --image-id ami-0abc1234567890def \
  --instance-type t3.micro \
  --key-name my-first-key \
  --security-group-ids sg-0abc12345def67890 \
  --subnet-id subnet-0abc12345def67890 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=my-first-instance}]' \
  --count 1

The output is a JSON object. Find the InstanceId field. It looks like i-0abc12345def67890. Copy it.

Wait for the instance to reach the running state. This usually takes 30 to 90 seconds:

aws ec2 wait instance-running --instance-ids i-0abc12345def67890

Once the command returns, get the public IP address:

aws ec2 describe-instances \
  --instance-ids i-0abc12345def67890 \
  --query "Reservations[0].Instances[0].PublicIpAddress" \
  --output text

Step 6: Connect via SSH

The default SSH username depends on the AMI you used:

• Amazon Linux 2023: ec2-user
• Ubuntu: ubuntu
• RHEL / CentOS: ec2-user or root
• Windows: connect via RDP, not SSH

# Amazon Linux 2023
ssh -i my-first-key.pem ec2-user@YOUR_PUBLIC_IP

# Ubuntu
ssh -i my-first-key.pem ubuntu@YOUR_PUBLIC_IP

Replace YOUR_PUBLIC_IP with the address from Step 5.

Once inside, confirm the instance is working:

# Check OS version
cat /etc/os-release

# Check available disk space
df -h

# Update packages (Amazon Linux)
sudo dnf update -y

For detailed SSH troubleshooting and key management, see the SSH access to EC2 guide.

Optional: Run a startup script with user data

You can pass a shell script via the —user-data flag. AWS runs it automatically on first boot, before you connect. This is useful for installing software without logging in manually.

aws ec2 run-instances \
  --image-id ami-0abc1234567890def \
  --instance-type t3.micro \
  --key-name my-first-key \
  --security-group-ids sg-0abc12345def67890 \
  --subnet-id subnet-0abc12345def67890 \
  --associate-public-ip-address \
  --user-data '#!/bin/bash
dnf install -y nginx
systemctl enable nginx
systemctl start nginx'

To expose Nginx on port 80, add a second inbound rule to your security group allowing TCP port 80. The user data scripts guide covers how to write, debug, and view logs from startup scripts.

Costs and cleanup

EC2 billing starts the moment an instance enters the running state. The attached EBS volume accrues storage charges separately. This continues even when the instance is stopped.

Stop (pause compute billing)

Stops the instance. The EBS root volume is preserved and you can start it again later. Compute billing pauses, but EBS storage billing continues.

aws ec2 stop-instances --instance-ids i-0abc12345def67890
aws ec2 wait instance-stopped --instance-ids i-0abc12345def67890

Terminate (permanent deletion)

Permanently deletes the instance and the root EBS volume by default. This cannot be undone.

aws ec2 terminate-instances --instance-ids i-0abc12345def67890

Also clean up the other resources you created. They continue to exist and may incur charges even after the instance is gone:

# Delete the key pair record from AWS (does not delete your local .pem file)
aws ec2 delete-key-pair --key-name my-first-key

# Delete the security group (only works after the instance is terminated)
aws ec2 delete-security-group --group-id sg-0abc12345def67890

The AWS Free Tier guide explains what usage may be covered for your account. The how billing works guide covers setting up a billing alarm so unexpected charges alert you before they grow.

Better access options

SSH with a key pair is straightforward, but it requires an open inbound port and careful key management. Two alternatives are worth knowing about.

EC2 Instance Connect

AWS pushes a temporary public key to the instance for a short window. You do not need to manage a key pair yourself. This works from the Console or CLI, but still requires port 22 to be open in the security group.

AWS Systems Manager Session Manager

Session Manager gives you an interactive shell through the SSM Agent running on the instance. No inbound ports need to be open. The agent connects outbound to the SSM service, which makes it possible to reach instances in private subnets without a bastion host or VPN.

To use Session Manager, the instance needs the SSM Agent installed (included in Amazon Linux 2023 and recent Ubuntu AMIs by default) and an IAM instance profile with the AmazonSSMManagedInstanceCore policy attached. The Session Manager guide covers the setup steps.