10 EC2 Concepts I’m Revising for the AWS Solutions Architect Associate Exam
Revising for the AWS Solutions Architect Associate exam? Here are 10 EC2 concepts worth knowing, from instance types and security groups to placement groups, hibernation and a step-by-step troubleshooting checklist.
Preparing for the AWS Certified Solutions Architect – Associate exam? EC2 is one of the most important AWS services to understand, not just for the exam but also for real-world cloud troubleshooting.
Whether you’re choosing an instance type, configuring security groups, or figuring out why your application isn’t accessible, understanding the fundamentals makes a big difference.
In this article, I’ve put together 10 practical EC2 concepts worth revising, along with common ports, SSH commands, and troubleshooting tips.
Let’s dive in! ☁️
Key Amazon EC2 concepts and troubleshooting tips for the AWS Certified Solutions Architect – Associate exam.
1. Choosing the Right EC2 Instance Type
EC2 instance types determine the compute, memory, storage, and networking resources available to your workload. Choosing the right family helps balance performance and cost.
| Instance family | Best suited for | Example use case |
|---|---|---|
| General purpose (M) | Balanced CPU and memory | Application servers, web servers |
| Burstable (T) | Variable CPU utilization | Small websites, development environments |
| Compute optimized (C) | CPU-intensive workloads | Batch processing, high-performance computing |
| Memory optimized (R, X) | Memory-intensive workloads | In-memory databases, analytics |
| Storage optimized (I, D) | High storage I/O or local storage needs | Data-intensive workloads |
| Accelerated computing (P, G, Inf, Trn) | GPUs and specialized accelerators | Machine learning, graphics, AI workloads |
Quick takeaway: Choose an instance based on your workload, not just its size or price. Burstable T-family instances are particularly useful when CPU demand varies over time.
Related exam topic: purchasing options. Instance type is only half the cost decision. On-Demand suits short or unpredictable workloads, Reserved Instances and Savings Plans reduce cost for steady long-term usage, and Spot Instances offer large discounts for workloads that can tolerate interruption.
Official reference: Amazon EC2 Instance Types
2. Security Groups: Your First Troubleshooting Check
A security group acts as a virtual firewall for resources associated with it, controlling allowed inbound and outbound traffic.
Here are the key points to remember:
- Inbound traffic: Denied by default when a new security group has no inbound rules.
- Outbound traffic: Allowed by default through the initial outbound rule, but this can be modified.
- Stateful: Response traffic for an allowed connection is automatically permitted.
- Allow rules only: Security groups cannot contain explicit deny rules.
- Reusable: One security group can be associated with multiple instances, and an instance can have multiple security groups.
- VPC-specific: A security group belongs to a particular VPC. It isn’t globally reusable across arbitrary VPCs or Regions.
When multiple security groups are attached to a network interface, their allow rules are combined.
Security group vs. network ACL: A security group works at the instance (network interface) level and is stateful. A network ACL works at the subnet level, is stateless (return traffic needs its own rule), and supports both allow and deny rules. This comparison shows up often in the exam.
Timeout vs. Connection Refused
These two errors can provide useful clues when troubleshooting an EC2-hosted application.
Connection timed out
Possible causes include:
- Incorrect security group rules.
- Network ACLs blocking traffic.
- Missing or incorrect routes.
- No reachable public IP address.
- An unresponsive server.
Start by checking the security group, but remember that a timeout does not automatically mean the security group is the problem.
Connection refused
This often indicates that the destination is reachable, but no service is listening on the requested port, or a firewall is actively rejecting the connection.
Check whether the application is running, listening on the correct port, and allowed through the operating system firewall.
These are useful troubleshooting patterns, not absolute rules.
Example: Public web server
A typical configuration might allow:
- SSH (TCP 22): Only your trusted IP address.
- HTTP (TCP 80): Public access if required.
- HTTPS (TCP 443): Public access if required.
Avoid opening SSH to
0.0.0.0/0 in production.Official reference: Security Group Rules
3. Essential Network Ports for the AWS Exam
You don’t need to memorize every port immediately. Start with these commonly used ones:
| Service | Default port |
|---|---|
| SSH | 22 |
| FTP control | 21 |
| DNS | 53 |
| HTTP | 80 |
| HTTPS | 443 |
| RDP | 3389 |
| MySQL / MariaDB | 3306 |
| PostgreSQL | 5432 |
| Redis | 6379 |
Quick memory trick: SSH = 22, HTTP = 80, HTTPS = 443, and RDP = 3389.
DNS commonly uses UDP 53, but TCP 53 is also important. These are default ports; applications can use different ones.
When configuring security groups, allow only the ports your application needs. For example, database ports should generally be accessible only from authorized application servers, not directly from the public internet.
4. Connecting to a Linux EC2 Instance Using SSH
SSH lets you securely connect to a Linux EC2 instance using a private key.
Before connecting, ensure that the instance is running, you have the correct private key, port 22 is allowed from your IP, and the instance has a reachable network path.
Step 1: Set key permissions
On Linux, macOS, or a compatible Git Bash environment:
bash
1
chmod 400 my-key.pemStep 2: Connect to your instance
For Amazon Linux:
bash
1
ssh -i "my-key.pem" ec2-user@YOUR_PUBLIC_IPFor Ubuntu:
bash
1
ssh -i "my-key.pem" ubuntu@YOUR_PUBLIC_IPReplace the key filename and IP address with your actual values. The default username depends on the AMI.
Remember: An instance in a private subnet generally requires an access method such as a bastion host, VPN, or AWS Systems Manager Session Manager instead of direct public SSH access.
Official guide: Connect to a Linux EC2 Instance
5. Private IP vs. Public IP vs. Elastic IP
These three concepts are easy to confuse, especially during exam preparation.
Private IPv4 address
- Used for communication within a VPC and connected private networks.
- Not directly reachable from the public internet.
- Normally retained when an EBS-backed instance is stopped and started.
Public IPv4 address
- Provides internet-facing addressing when the necessary networking configuration is in place.
- An automatically assigned public IPv4 address is released when the instance is stopped or hibernated.
- A new public IPv4 address is generally assigned on restart if public IPv4 addressing is enabled.
Elastic IP address
- A static public IPv4 address allocated to your AWS account.
- Can be associated with a private IPv4 address and reassociated when needed, subject to AWS constraints.
- Useful when you need a stable public IPv4 address across instance stop/start operations.
Cost note: AWS charges for public IPv4 addresses, including Elastic IPs and auto-assigned public IPs, so check current AWS pricing and release addresses you no longer need.
Exam takeaway: A public IP does not automatically make an instance accessible. Routing, security groups, and a functioning service must also be in place.
Official reference: IP Addressing for EC2 Instances
6. EC2 Placement Groups
Placement groups influence how EC2 instances are placed on the underlying infrastructure. There are three main strategies.
Cluster placement group
Places instances close together within a single Availability Zone.
Use case: Workloads that require low network latency and high throughput between instances, such as tightly coupled high-performance computing applications.
Spread placement group
Places instances on distinct underlying hardware to reduce the risk of correlated failures.
Use case: A small number of critical instances that should be isolated from one another.
For rack-level spread placement groups, the limit is seven running instances per Availability Zone. A host-level spread option also exists, but it is available only on AWS Outposts.
Partition placement group
Divides instances into logical partitions, with separate underlying racks for different partitions.
Use case: Distributed workloads such as Kafka, Cassandra, and Hadoop, where separating groups of instances can reduce the impact of hardware failures.
A partition placement group can span multiple Availability Zones in a Region, with a maximum of seven partitions per Availability Zone.
Quick revision:
- Cluster = performance.
- Spread = isolation of individual instances.
- Partition = isolation of groups of instances.
Official reference: Placement Groups for EC2 Instances
7. Elastic Network Interfaces (ENIs)
An Elastic Network Interface (ENI) is a logical network card in a VPC.
An ENI can have:
- A primary private IPv4 address and secondary private IPv4 addresses.
- Public IPv4 or IPv6 addresses, where configured.
- Security group associations.
- A MAC address and other network attributes.
Every EC2 instance has a primary network interface, which cannot be detached from that instance. Additional network interfaces can be attached, subject to instance-type and Availability Zone constraints.
Why are ENIs useful?
Imagine you need to move a network identity from one instance to another during recovery. An ENI can help because many of its network attributes remain associated with the interface when it is detached and reattached. The catch: both instances must be in the same Availability Zone.
Exam takeaway: ENIs are useful for network management and recovery scenarios, but attachment constraints still apply.
Official reference: Elastic Network Interfaces
8. EC2 Hibernation: More Than Just Stopping an Instance
Stopping an instance shuts it down. Hibernation goes a step further by saving the contents of RAM to the encrypted EBS root volume.
When the instance starts again, the operating system can restore the saved memory state and resume previously running processes.
Key points to remember
- Hibernation must be enabled at launch.
- The instance must meet AWS’s supported instance-type, AMI, storage, and other prerequisites.
- The EBS root volume must have enough capacity to accommodate the RAM contents and other required data.
- The root volume must be encrypted.
- Data on instance store volumes is lost when the instance is hibernated.
- EBS storage charges continue while the instance is stopped.
- An automatically assigned public IPv4 address is generally released, while an associated Elastic IP is retained.
When is hibernation useful?
It can help workloads that take a long time to initialize and benefit from resuming their previous in-memory state.
Official reference: Hibernate an EC2 Instance
9. A Practical EC2 Troubleshooting Checklist
Suppose your EC2 instance is running, but your application is inaccessible. What should you check?
Work through these steps rather than randomly changing configurations:
- Instance health: Is the instance running, and have its status checks passed?
- IP address: Are you connecting to the correct public or private address?
- Routing: Does the subnet have the appropriate route and, where needed, an internet gateway?
- Security groups: Are the required inbound and outbound rules configured?
- Network ACLs: Are the relevant inbound and outbound rules permitting traffic?
- Application: Is the service running and listening on the expected port?
- Operating system: Is a host firewall blocking the connection?
- Logs: Do the application or system logs show any errors?
One important distinction: EC2 instance health and application health are not the same thing.
An instance can be running and pass its status checks while the application hosted on it is unavailable.
10. Final Revision: What I Would Memorize
Before the AWS Solutions Architect – Associate exam, revise these key points:
- Choose instance families based on workload requirements, and match the purchasing option to how steady the usage is.
- Security groups are stateful and contain allow rules only. Network ACLs are stateless and support allow and deny rules.
- New security groups start with no inbound rules and a default outbound allow rule.
- Security groups can be associated with multiple resources within their supported VPC scope.
- Elastic IPs provide stable public IPv4 addressing.
- Cluster, spread, and partition placement groups serve different purposes.
- ENIs are logical network interfaces that can be detached and reattached, within the same Availability Zone.
- Hibernation saves RAM to the encrypted EBS root volume and requires prior configuration.
- A timeout is a troubleshooting clue, not proof of a security group problem.
- A running EC2 instance does not guarantee that the application is working.
Let’s Discuss! 💬
I’m preparing for the AWS Certified Solutions Architect – Associate exam and exploring how these concepts apply to real-world cloud scenarios.
Here’s a question for the AWS community:
If your EC2 instance is running but your web application is inaccessible, what would you check first: security groups, route tables, network ACLs, or the application itself? And why?
I’d love to hear your troubleshooting approach and learn from your experiences!
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article