- Now let's take a look at a demo
of launching a Linux instance.
From the AWS Management Console
we can go to EC2
and again, we want to verify the region
that we are operating in.
Whatever region is selected here
is where our instance will live.
And so we're currently in Ohio
where we created our VPC,
and you can see we currently have
no instances running.
So, let's go ahead and click here
to launch an instance.
And for Linux we have a choice.
We could choose Amazon Linux,
we could choose Red Hat or SUSE.
We have Ubuntu.
And you can see that all of these
do offer a free tier,
that they're eligible for the free tier.
And then of course we want to look
to the type of virtualization,
which we generally prefer HVM
with SSD boot volumes.
So, I'm going to go ahead and choose
the latest version of Amazon Linux 2
with SSD based root volume.
This would be based on EBS,
the Elastic Block Store.
And you can see here that this one supports
both x86 and the new Arm processors.
So, for now we're going to stick with x86.
Now, once we've chosen the machine image,
now we choose the instance type,
and you can see here that we get
this long list of all kinds
of different instances and we can choose
by general purpose, by compute optimized,
GPU, memory, storage and so on.
We can also filter out
by the current generations or all generations.
So, if we wanted to go back
and look at T1s or C3s,
then we could look at all generations.
You can also notice here that the T2 micro
is eligible for the free tier.
So again, what that means is
there is no such thing as a free tier account.
All accounts are identical.
It just means that for the first 12 months
of that account, you know,
after you sign up with your email address
and you put in your billing information,
12 months from that day
you have access to a certain set of resources
that are deemed to be a part of the free tier.
In the case of EC2, the T2 micro
is given to you for free.
So you can run one of these instances,
it'll say here, you get up to 750 hours
of micro instances each month, right?
So that means you could run one machine
all month long, all day, every day,
for the entire year
and not pay anything for that machine.
So then, of course from there we could
just go ahead, review and launch,
if we wanted to.
Otherwise we could go on
and configure more things.
So let's take a look at what comes next.
So here, I want to launch one instance.
You could launch 10 or 100 or 1000,
if that number is
within your current account limits.
There are initial soft limits around the number
of machines that we can launch.
In terms of the network we do have
to choose VPC.
And so in this case I'm going to choose
the web apps VPC that we created earlier,
and I'm going to launch this
into the applications subnet.
This is the private subnet
that we created earlier and then, of course,
I will access that
over my VPN connection.
I have a VPN connection established here
from the office into the VPC.
Now, you will see here that the subnet setting
for auto-assign public IP,
the subnet setting is to disable
and that's because, if you remember
what we did back in VPC demos,
when we created the applications-a,
it was meant to be private
and not accessible to the internet.
And so, because there is no route
between the application subnet and the internet,
then we don't really need public IPs.
We'll just go ahead and use the private IP.
We'll scroll down here.
We could attach an IAM role
if we wanted to provide some way
of gaining access to temporary credentials.
But for now, since this is just a simple demo
of launching a Linux instance,
we'll go ahead and skip that.
We could say protect against accidental termination,
and so it says here that if you turn this on,
this is sort of like a safety switch.
Before you can terminate this instance
you have to turn the protection off.
So, it just helps
prevent accidental termination.
If we were to turn on detailed CloudWatch,
then that would bring
our default monitoring intervals
from five minutes to one minute,
and we would pay an additional charge for that.
Right, so let's scroll down here.
We don't really need to worry about
any of the other stuff you'll see here
under network interfaces.
eth0 is the default network interface.
And we could add others if we wanted to,
if we wanted to have
multiple network interfaces.
Let's go ahead and go to Add Storage,
and you'll see here that this instance
does come with an 8-gig
general purpose SSD volume.
And so, it will operate at about,
I don't know, 100 IOPS or so, maybe less.
We could add an additional volume
if we wanted to store data somewhere else
other than the root volume.
We could also change the size.
If we wanted just a larger root volume,
we could specify 20 or whatever.
I'm just gonna leave that at eight.
And it says here free tier eligible customers
can get up to 30 gigs of general purpose storage.
So, even this volume is free
within that free tier period.
Going on to Tags.
It is a good idea to form
some kind of consistent tagging strategy
so that you can keep your AWS environments
organized and use those tags
to attribute cost.
It doesn't really matter
what key values we use
as long as we are consistent and we continue
to use those same keys and values, right?
So I could say, you know,
what application this is for,
and this is might be for some kind
of a web API.
You name the application.
And we might add, you know,
a cost center, right?
The ID of a cost center.
And we might add owners
and other kinds of tags.
Going on to the Security Group,
generally we create security groups.
We saw earlier in the VPC demos
that we created a security group,
and here we have the option of selecting one.
So far we only created
the load balancer and the web app.
So we could choose that one.
And you'll see here that it's only,
currently that security group
is only allowing communication
between the load balancer
and the web app instance.
Of course we could create a new one
if we wanted to, but for now let's go ahead
and use one that we created earlier.
We will need to modify the security group rules
to allow SSH from our local address.
So let's go ahead and review and launch that
and again, it's giving us a warning.
It says, you will not be able to connect
to this because it requires port 22 to be open,
and your security group doesn't have
port 22 open, and that's okay,
we're going to fix that here in just a moment.
So let's go ahead and continue.
Review this.
We're using Amazon Linux 2 on T2 micro.
We have the web app security group.
And then of course we could take a look
at storage and other things.
We have an 8-gig root volume,
and we have all of the necessary tags.
Let's go ahead and launch that.
And we'll also need to choose a key pair.
We could choose an existing one.
We could create a new key pair.
Or we could proceed without one.
If you go without one, then it says,
it wants you to acknowledge
that you will not be able to connect
to this instance unless you already know
the password built into the image.
But this image does not have one.
This particular image requires
key pair authentication.
So, I'm going to choose an existing key pair
that I have for US East 2.
Well, you know what, let's go ahead
and create a new key pair.
And we'll call this one fundamentals,
and I just want to show you what happens here.
It says here "You have to download
"the private key before you can continue.
"Store it in a secure and accessible location.
"You will not be able to download that
"again after it's created."
Right, so when you create key pairs,
you only have this one opportunity
to download that key pair.
So I'm gonna go ahead and download that
and you can see here it's asking me
to save this.
I'm gonna go ahead and save this
under my Downloads folder,
and then I'll go ahead and say
Launch Instances.
And then of course you can see
now it's telling us
that this particular instance is launching.
If we go there, you can see
that it's currently pending.
While that instance is being created
and booting, let's go to the security group.
You can see down here
we have applied the web app security group.
And if we click on that, it will take us
to a panel in which we can modify
the security group rules.
So, I'm going to sayedit this.
I will add a rule, and I'm going to allow
SSH TCP on port 22,
and the way that my current VPN works
is through network address translation.
And so, even though my local machine
would be a part of the 10.255 network,
but my address is being routed
through my VPC using network address translation.
And so, the IP address would appear
to come from the VPC itself.
So, I'm going to put in 10.0.0.0/16
and I'm going to say SSH
over the AWS client VPN.
And we'll go ahead and save that.
And so now that we've gotten port 22 open,
let's go back and see if this instance has launched.
And there it is.
You can see I have one for another use case
that is currently in a stopped state,
and then this one here is in a running state.
And so, in terms of states
we could stop the machine,
which means that it still exists
just like this other one here in the list,
but it's not running.
We're not paying an hourly charge for it.
We're still paying for the EBS volume,
the root volume, but we're not paying
the hourly CPU time fee.
Stop Hibernate means, this is something
we would have had to enable at launch,
which we did not do, but Stop Hibernate
is basically the same as Stop.
It puts it into a state
where it's not running,
we're not paying the hourly fee,
but the contents of memory are preserved
so that when you restart
that instance from a hibernate state,
then all of the consents of RAM
are put back.
So that's very useful for having applications
pick up immediately where they left off,
without having to wait for processes
to start and then data to be
pulled from disk.
So now that this one is running
we can also see that the status checks,
the hypervisor status checks,
have all returned, everything is okay.
So if we look at the status checks,
we have this system
and then we have the instance.
And so the system says
from the AWS systems point of view
everything is fine, and this one here says
as far as the hypervisor in the instance goes
everything else if fine.
Okay, so now that this one is running,
let's take a look at the description,
and you'll see that we did receive
a private IP address.
We did not receive a public
because we opted out of that.
We could assign a public IP from elastic IPs
but we don't really need to.
If this is meant to be a private application server,
inaccessible directly from the internet,
if it's meant to be behind a load balancer,
then it doesn't need a public IP,
it doesn't need to communicate
with the internet directly.
And so, with our VPN that I have here
at the office I can still connect
to that private IP.
So let's go ahead and copy that
and then I will switch over to the terminal.
So before we actually SSH,
first I want to point out
about this particular key.
You'll notice here that the fundamentals.pem key
that we downloaded,
for Linux instances this key will be used
to provide authentication
against the operating system.
So we will use it during our SSH shell
into the machine.
For Windows, this key will be used,
the public part that Amazon has
will be used to encrypt
the Windows administrator password,
and this private part that we have
will be used to decrypt
the Windows administrator password.
And so, you'll notice here that for Linux
that the permissions are way too lenient.
Right, we're giving essentially everyone
read, write and execute.
We don't want that.
And so before SSH will allow us
to use that key,
we need to do a chmod on that
and go chmod 400,
which will then remove those.
We're doing a list again.
You'll see now that only the richard user
is allowed to read that key.
That is the level of permissions
that SSH prefers for SSH keys.
Otherwise, we would get an error.
If we tried to SSH with these kinds
of permissions up here we would get an error
in using that key.
And so now that we have made the permissions
much more restrictive, now we can SSH.
We should be able to say ssh -i
./fundamentals,
fundamentals, and then for Amazon Linux
the user would be ec2-user@,
and then we'll paste the IP address,
and we'll go ahead and try to connect.
And there we go.
It says, again, now we're connecting
to a private IP address,
in my case over the VPN.
In your case, if you don't have a VPN,
then you may need to use
either public IP addresses to gain access
to publicly available instances,
or use a bastion host.
And so, now it says, "Are you sure?"
Yes, and there we go.
Now we have a shell
into Amazon Linux 2 AMI,
and you can see here we are indeed
at ec2-user@ that particular address.
And so, we can see
that we are now logged
into that particular machine.
And we will continue to explore this
in an upcoming demo.
Right, so just like that.
In just a few minutes we have launched
a Linux-based EC2 instance
and gained remote access to it
by way of SSH.