Lesson 02 — Why Amazon EC2?

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what Amazon EC2 is.
Explain why businesses use Amazon EC2.
Identify common enterprise workloads running on EC2.
Understand the advantages of cloud-based virtual servers.
Recognise the Cloud Security Engineer’s role in protecting EC2 workloads.

📚 Lesson Information

Estimated Time: 45 Minutes

Difficulty: Beginner

Prerequisites: Lesson 01 – Module Overview

Hands-on Lab: No

💼 Business Value

Imagine CloudNova Technologies launches a new online learning platform.

Students expect:

Fast website performance
Reliable video streaming
Secure online payments
24×7 availability
No downtime during examinations

To deliver these services, CloudNova needs reliable compute resources.

This is where Amazon EC2 (Elastic Compute Cloud) becomes essential.

🏢 CloudNova Scenario

CloudNova plans to host the following applications in AWS:

Student Learning Portal
Instructor Dashboard
Learning APIs
Authentication Service
Internal HR Portal
CI/CD Server
Monitoring Server
AI Recommendation Engine

Instead of purchasing physical servers, CloudNova deploys Amazon EC2 instances.

As the Cloud Security Engineer, your responsibility is to ensure these servers remain secure, available and compliant with company security standards.

🤔 What is Amazon EC2?

Amazon EC2 (Elastic Compute Cloud) is AWS’s virtual server service.

Instead of buying physical hardware, organisations create virtual machines in minutes.

These virtual machines are called EC2 Instances.

Each instance can run:

Linux
Windows Server
Commercial software
Custom business applications
Containers
Development tools

Think of an EC2 instance as a computer running inside AWS that you control.

🏢 Traditional Data Centre vs AWS EC2

Traditional Infrastructure

Purchase Server

↓

Install Hardware

↓

Configure Network

↓

Install Operating System

↓

Deploy Applications

↓

Maintain Hardware

Provisioning may take days or weeks.

Amazon EC2

AWS Console

↓

Launch EC2 Instance

↓

Choose Operating System

↓

Deploy Application

↓

Server Ready

Provisioning typically takes only a few minutes.

🌍 Why Do Enterprises Use Amazon EC2?

Amazon EC2 provides:

On-demand compute capacity
High availability
Global deployment
Flexible pricing
Auto Scaling support
Enterprise-grade security
Integration with other AWS services

This allows organisations to deploy applications quickly without investing in physical infrastructure.

🚀 Real-World Enterprise Workloads

Amazon EC2 supports many types of workloads.

Web Applications

Student Portal

Company Website

Corporate Intranet

API Servers

REST APIs

Microservices

Backend Services

Databases

Self-managed PostgreSQL

MySQL

MongoDB

SQL Server

CI/CD Platforms

Jenkins

GitLab Runner

Build Servers

Security Platforms

SIEM

Vulnerability Scanners

Security Monitoring

Threat Detection

Artificial Intelligence

Machine Learning

Model Training

Inference Servers

GPU Workloads

🌐 EC2 in the CloudNova Architecture

                     Internet
                         │
                Internet Gateway
                         │
                Application Load Balancer
                         │
          ┌──────────────┴──────────────┐
          │                             │
     Private EC2                  Private EC2
   Student Portal                Learning APIs
          │                             │
          └──────────────┬──────────────┘
                         │
                   Amazon RDS

──────────────────────────────────────────

Supporting Services

IAM Roles

CloudWatch

Systems Manager

CloudTrail

AWS Backup

Notice that the EC2 instances are deployed in Private Subnets, reducing direct exposure to the Internet.

💰 Why Cloud is Better Than Traditional Servers

Traditional Servers

Large upfront investment
Hardware maintenance
Power and cooling costs
Slow deployment
Limited scalability

Amazon EC2

Pay only for what you use.
Launch servers in minutes.
Scale up or down as demand changes.
Choose from many instance types.
Deploy globally with ease.
Integrate with AWS security services.

🔒 Why EC2 Security Matters

An EC2 instance often contains:

Business applications
Customer information
Configuration files
API keys
Application logs
Internal documentation

If an attacker compromises an EC2 instance, they may gain access to sensitive business resources.

Cloud Security Engineers help reduce this risk by implementing secure configurations and continuous monitoring.

👨‍💻 Responsibilities of a Cloud Security Engineer

At CloudNova, you are responsible for:

Deploying secure EC2 instances.
Applying the Principle of Least Privilege.
Encrypting storage.
Managing operating system updates.
Monitoring security events.
Performing vulnerability remediation.
Investigating suspicious activity.
Supporting compliance requirements.

☁️ AWS Services That Work with EC2

AWS Service	Purpose
IAM	Secure access management
Amazon VPC	Network isolation
Security Groups	Instance firewall
Amazon EBS	Persistent storage
AWS Systems Manager	Secure administration
CloudWatch	Monitoring and alerts
CloudTrail	Audit logging
AWS Backup	Backup management
KMS	Encryption key management
AWS Config	Configuration compliance

Together, these services create a secure and manageable compute environment.

📊 EC2 Lifecycle

Every EC2 instance follows a lifecycle.

Launch

↓

Configure

↓

Secure

↓

Monitor

↓

Patch

↓

Backup

↓

Scale

↓

Terminate

Cloud Security Engineers are involved throughout this lifecycle.

🏢 Enterprise Best Practices

CloudNova follows these principles when deploying EC2:

Deploy production instances in Private Subnets.
Use IAM Roles instead of storing access keys.
Encrypt all EBS volumes.
Restrict network access using Security Groups.
Manage instances using AWS Systems Manager.
Enable monitoring and logging.
Apply security updates regularly.
Tag resources consistently.
Review configurations on a regular basis.

🚫 Common Mistakes

❌ Deploying production servers in Public Subnets.

❌ Leaving SSH open to the Internet.

❌ Storing AWS Access Keys on EC2 instances.

❌ Disabling operating system updates.

❌ Launching unencrypted EBS volumes.

❌ Ignoring monitoring and logging.

❌ Using default security configurations without review.

🧠 Think Like a Cloud Security Engineer

Before launching an EC2 instance, ask yourself:

Does this server really need Internet access?
Who should be allowed to connect?
Is storage encrypted?
Are backups enabled?
Is monitoring configured?
How will administrators securely access the server?
What happens if this server is compromised?

These questions help ensure security is considered from the beginning, not added later.

📊 Knowledge Check

What is Amazon EC2?
Why do organisations prefer Amazon EC2 over physical servers?
Name five workloads commonly hosted on EC2.
Why should production EC2 instances usually be placed in Private Subnets?
What responsibilities does a Cloud Security Engineer have when managing EC2?
Name three AWS services commonly integrated with EC2.
Why is monitoring important for EC2 instances?
Why is encrypting storage considered a security best practice?
What are some risks of exposing an EC2 instance directly to the Internet?
Which stage of the EC2 lifecycle includes applying operating system updates?

💡 Key Takeaways

After completing this lesson, you should understand:

Amazon EC2 is AWS’s primary compute service for running virtual servers.
Enterprises use EC2 to host business-critical applications, APIs, databases and supporting services.
EC2 instances should be deployed with security in mind from the beginning, including network isolation, encryption and monitoring.
Cloud Security Engineers are responsible for protecting compute workloads throughout their lifecycle.
Amazon EC2 integrates with many AWS security and management services to build secure, scalable and production-ready environments.

🚀 Next Lesson

➡️ Lesson 03 — Amazon EC2 Fundamentals