- Now let's talk about the Amazon Machine Image
or the AMI.
Within EC2
when we create a virtual machine
we have to have something to begin with.
We have to have a way for that machine
to boot into some kind of an environment.
We have to have an operating system
and perhaps even applications
or other configurations already done
and so, that's what the machine image is for.
The machine image is, essentially
a bit-for-bit copy of the root volume.
It contains the operating system
and anything else that was installed.
And so, we generally have our choice of Windows,
Linux, FreeBSD...
and many different flavors of those operating systems.
At this time, we don't have access to Solaris
but we should be able to choose
and make use of those other three.
Now, we can find machine images
in a number of different places.
We have machine images that are provided by AWS
such as Amazon, Linux,
different flavors of Ubuntu, or Red Hat,
or Microsoft Windows
and then we also have trusted publishers like
Canonical, or Red Hat, or Microsoft
for other flavor, or specialized flavors
of those operating systems.
We also have community AMIs.
Community AMIs are publicly available
being provided by other AWS customers.
So...
I could shell into a machine, a virtual machine in instance
and I could install whatever I wanted.
I can install, you know, perhaps Nginx,
or, you know, certain flavors of Node.js,
or Phyton, or what have you
and configure a machine in a certain way
that might be useful for myself as a developer
and then realize, you know what?
This is useful for a lot of developers
so let's make this publicly available
as a community AMI.
Now, generally, the way I approach community AMIs
considering that they are published by who knows who
is that if I wanted to experiment with something
then I might look to the community
to see if somebody has already compiled, or installed
a particular configuration of different pieces of software
so that I have a fresh place to start.
And then once I run that prototype and check it out
and feel satisfied that yeah, that does work
I think I do want to invest more time
into that particular, you know
configuration of software
then my policy is well, I don't know who created that.
I don't know what else they may have put on that machine
and Amazon will also tell you, if you read the documentation
Amazon says that AWS will not vouch for the security
or the integrity of community based images.
So, it is our responsibility as a customer
to ensure that we are using things that are secure, right?
So, in terms of the community images
I would just leave you with the warning that
you don't really know what went into them.
They might be fine to try and experiment
a little prototype, or something, in a sandboxed environment
but when it comes to production
I would always start with a machine image
from Amazon, or another trusted provider
and then whatever software I needed
I would install and configure myself
so I know exactly what is on that instance.
And then lastly, like we mentioned earlier
we have the AWS Marketplace
where we can find those canned solutions.
So, in terms of launching an instance
we first choose the machine image
whatever that is, right?
Again, it's gonna be the operating system
and any software that's installed
any configuration that was put in place
any users or group that were put in place
within the realm of authentication
that is the operating system.
And once we choose the AMI
we then launch the instance by choosing, you know
what type instance do we want?
Do we want, you know, like a T2 small?
Do we want a C4 large?
An M5 extra large?
We choose the family and the type of instance
and once we launch that instance
we could stop there, and we could have that machine running
doing its job, using the software that was installed
as a part of the image.
We could go further and install different applications,
configure, what have you
and then go on to create our own private machine image.
When we create images of instances
those images default to being private
only accessible by the account in which they were created
but you could go on to share that image
with another account
you could share it to the public
by making it a community AMI
and any instances that are launched from that private AMI
will all, essentially, be clones of one another, right?
So, creating custom machine images
is a really good way to give yourself
a known state, right?
So, when a machine comes to life
you know exactly what is installed
and what is available on that machine.