How to Create an AWS EC2 Instance: Step-by-Step for Developers

AWS EC2 Setup the Way Ops Teams Actually Do It

ClickOps in the AWS console gets you a server in ten minutes and a security incident in ten weeks. Infrastructure as repeatable CLI commands—or Terraform later—starts with the right VPC, IAM, and instance profile from day one.

Launch a Production-Ready Instance

Assume AWS CLI v2 configured with a least-privilege IAM user or SSO profile. Pick region close to users—ap-south-1 for South Asia, us-east-1 for cheapest baseline testing.

# Create key pair (store .pem securely, chmod 400)
aws ec2 create-key-pair --key-name prod-web-key --query 'KeyMaterial' --output text > prod-web-key.pem

# Launch Ubuntu 22.04 t3.small in default VPC (replace subnet/sg IDs)
aws ec2 run-instances \
  --image-id ami-0c7217cdde317cfec \
  --instance-type t3.small \
  --key-name prod-web-key \
  --security-group-ids sg-0abc123def456 \
  --subnet-id subnet-0abc123 \
  --iam-instance-profile Name=ec2-ssm-role \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3","DeleteOnTermination":true}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-01},{Key=Environment,Value=production}]'

Security Group Baseline

# Allow SSH only from your office IP (better: use SSM Session Manager, no SSH)
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123def456 \
  --protocol tcp --port 22 --cidr 203.0.113.10/32

# HTTP/HTTPS from ALB security group only
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123def456 \
  --protocol tcp --port 443 --source-group sg-alb123

Post-Launch Hardening

• Enable IMDSv2: HttpTokens=required on instance metadata
• Attach CloudWatch agent for disk and memory metrics
• Auto-assign Elastic IP only if needed; behind ALB usually unnecessary
• Snapshot EBS volumes nightly with lifecycle policies

A t3.small ($15–20/month) handles 500 req/min Laravel apps behind nginx when opcode cache and queues are tuned. Scale vertically before jumping to Kubernetes.

Cost Optimization Without Downtime

Reserved Instances or Savings Plans cut compute 30–40% once baseline load is stable. Start on-demand for first 60 days, analyze utilization, then commit one-year partial upfront. t3 burstable credits exhaust under sustained CPU—watch CloudWatch CPUSurplusCreditBalance.

Use SSM Patch Manager for OS updates instead of SSH cron jobs. Tag everything: Environment, Owner, CostCenter. Untagged resources become orphan billing lines within months in growing accounts.

Attach instances to Target Groups behind Application Load Balancer before going live. Health checks on /health prevent routing traffic to booting instances. Rolling ASG updates beat manual stop-start during deploys.

Enable detailed monitoring only on production instances needing one-minute CloudWatch metrics—the extra cost adds up across dozens of dev boxes left running overnight. Use Instance Scheduler or stop non-prod instances outside business hours; a forgotten m5.large costs $70/month doing nothing.

Backup and Recovery

Automate AMI snapshots weekly with lifecycle policy deleting images older than 30 days except monthly anchors. Test restore to new instance quarterly—snapshots nobody restores are wishful thinking. Separate backup account or cross-region copy protects against account compromise or regional disaster.

Document elastic IP association and DNS TTL before failover drills—low TTL during migration week, raise after stable to reduce DNS query costs and cache churn globally.

Alert on disk usage before /var/log fills silently—full disks corrupt MySQL and fail writes mysteriously. Enable billing alerts for untagged instances; forgotten POC boxes often cost more annually than properly tagged production servers under FinOps review.

Networking Basics

Place app instances in private subnets; only load balancers sit in public subnets. NAT gateway costs surprise startups—consider NAT instance or IPv6-only egress patterns if traffic is light. Document VPC CIDR plan before launch; peering and VPN additions hurt when 10.0.0.0/8 is already overloaded with overlapping partner networks.

Frequently Asked Questions

t3 vs t3a instances?

t3a uses AMD CPUs, typically 10% cheaper. Benchmark your workload—crypto-heavy apps may prefer Intel t3.

Should I use Amazon Linux or Ubuntu?

Ubuntu LTS if your team knows apt and Debian tooling. Amazon Linux 2023 integrates well with AWS agents.

How do I connect without opening SSH?

Use AWS Systems Manager Session Manager with IAM instance profile—no inbound port 22 required.