Lesson 04 — Launching Secure EC2 Instances

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Launch secure Amazon EC2 instances.
Select the appropriate AMI and Instance Type.
Configure networking securely.
Attach IAM Roles.
Configure encrypted EBS volumes.
Apply enterprise tagging standards.
Validate a secure EC2 deployment.

📚 Lesson Information

Estimated Time: 2–3 Hours

Difficulty: Beginner → Intermediate

Prerequisites: Lesson 03 – Amazon EC2 Fundamentals

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies is ready to deploy the first production application.

The networking team has completed:

Enterprise VPC
Public Subnets
Private Application Subnets
Private Database Subnets
Security Groups
Route Tables
Internet Gateway
NAT Gateway
VPC Endpoints

Your responsibility is to deploy secure application servers that comply with CloudNova’s security standards.

🚫 Common Beginner Mistake

Many beginners launch EC2 instances using the default settings.

Launch Instance

↓

Next

↓

Next

↓

Launch

Although the instance works, it may have:

Public IP enabled
Default Security Group
No IAM Role
Unencrypted storage
Weak tagging
No monitoring

In enterprise environments, this is unacceptable.

Every deployment must follow a secure configuration process.

🏗 Enterprise Deployment Workflow

CloudNova follows this workflow for every EC2 deployment.

Choose AMI

↓

Select Instance Type

↓

Choose Secure Network

↓

Attach IAM Role

↓

Configure Storage

↓

Configure Security Group

↓

Add Tags

↓

Review

↓

Launch

↓

Validate

↓

Monitor

🔐 Secure EC2 Design

Our application server will use:

Component	Value
AMI	Amazon Linux 2023
Instance Type	t3.micro
VPC	CloudNova-Prod-VPC
Subnet	Private-App-A
Public IP	Disabled
IAM Role	CloudNova-EC2-Role
Security Group	App-SG
Root Volume	Encrypted GP3
Monitoring	Enabled

🏢 Enterprise Architecture

                    Internet
                        │
                Internet Gateway
                        │
            Application Load Balancer
                        │
                Private App Subnet
                        │
              Amazon EC2 Instance
                        │
      ┌─────────────────┼─────────────────┐
      │                 │                 │
 IAM Role          Encrypted EBS     Security Group
      │
 AWS Systems Manager
      │
 CloudWatch

Notice that the EC2 instance does not have a Public IP Address.

Administrative access is provided through AWS Systems Manager Session Manager, which is more secure than exposing SSH to the Internet.

🛠 Lab 01 — Launch a Secure EC2 Instance

Open:

AWS Console

↓

EC2

↓

Instances

↓

Launch Instance

Step 1 — Name the Instance

CloudNova-App-Server-01

Naming resources consistently makes them easier to identify and manage.

Step 2 — Choose an AMI

Select:

Amazon Linux 2023

Why?

AWS maintained
Regular security updates
Optimised for AWS services
Long-term support

Step 3 — Select an Instance Type

Choose:

t3.micro

Suitable for:

Learning
Small web applications
Development
AWS Free Tier (where applicable)

Step 4 — Configure the Key Pair

Select an existing Key Pair or create a new one.

Example:

CloudNova-KeyPair

Download and securely store the private key (.pem file).

Note: In later lessons, we’ll use AWS Systems Manager Session Manager for administration, reducing the need for direct SSH access.

Step 5 — Configure Network Settings

Click Edit under Network Settings.

Configure:

Setting	Value
VPC	CloudNova-Prod-VPC
Subnet	Private-App-A
Auto-assign Public IP	Disabled

This ensures the instance is not directly accessible from the Internet.

Step 6 — Configure Security Group

Select:

App-SG

Allow only the required inbound traffic.

Example:

Protocol	Source
HTTPS (443)	ALB-SG
SSH (22)	Bastion-SG or Session Manager (preferred)

Avoid using:

0.0.0.0/0

unless absolutely necessary.

Step 7 — Attach an IAM Role

Select:

CloudNova-EC2-Role

This IAM Role will later allow the instance to securely access:

Amazon S3
CloudWatch
Systems Manager
Secrets Manager

without storing AWS Access Keys.

Step 8 — Configure Storage

Configure:

Setting	Value
Volume Type	gp3
Size	20 GiB
Encryption	Enabled

Encryption protects data if storage media is compromised.

Step 9 — Enable Detailed Monitoring

Enable:

Detailed CloudWatch Monitoring

Benefits:

Faster metrics
Better troubleshooting
Improved alerting

Step 10 — Add Tags

Create tags.

Key	Value
Name	CloudNova-App-Server-01
Environment	Production
Project	Learning Platform
Owner	Cloud Security
Department	IT

Tagging improves visibility, governance and cost management.

Step 11 — Review & Launch

Verify:

Correct AMI
Correct Instance Type
Private Subnet
No Public IP
Correct Security Group
IAM Role attached
Encrypted EBS
Tags added

Click:

Launch Instance

Step 12 — Validate Deployment

Open:

EC2

↓

Instances

Verify:

Instance State = Running
System Status = 2/2 Checks Passed

Review:

Networking
Security
Storage
IAM Role
Monitoring

💻 AWS CLI Lab

Launch an EC2 Instance

aws ec2 run-instances \
    --image-id ami-xxxxxxxx \
    --instance-type t3.micro \
    --subnet-id subnet-xxxxxxxx \
    --security-group-ids sg-xxxxxxxx \
    --iam-instance-profile Name=CloudNova-EC2-Role \
    --block-device-mappings '[{"DeviceName":"/dev/xvda","Ebs":{"VolumeSize":20,"VolumeType":"gp3","Encrypted":true}}]' \
    --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=CloudNova-App-Server-01}]'

List EC2 Instances

aws ec2 describe-instances

Describe Security Groups

aws ec2 describe-security-groups

Describe Attached Volumes

aws ec2 describe-volumes

Describe Tags

aws ec2 describe-tags

Stop an Instance

aws ec2 stop-instances \
    --instance-ids i-xxxxxxxx

Start an Instance

aws ec2 start-instances \
    --instance-ids i-xxxxxxxx

✅ Verification

Verify the following:

✔ EC2 instance is running.

✔ Deployed into the correct VPC.

✔ Located in the Private Application Subnet.

✔ No Public IP assigned.

✔ IAM Role attached.

✔ Security Group configured.

✔ EBS volume encrypted.

✔ Tags applied.

✔ CloudWatch monitoring enabled.

🔍 Troubleshooting

Problem

Instance launch failed.

Check:

Service quotas.
Subnet capacity.
AMI availability.
IAM permissions.

Problem

Instance not reachable.

Verify:

Correct Security Group.
Route Tables.
NAT Gateway.
Systems Manager configuration.

Problem

IAM Role missing.

Check:

Instance Profile exists.
Correct IAM Role selected.
Required IAM permissions granted.

Problem

EBS encryption disabled.

Review:

Volume configuration.
Default EBS encryption settings.
Account encryption policies.

🏢 Enterprise Best Practices

CloudNova standards:

Deploy production servers in Private Subnets.
Disable Public IP addresses unless required.
Encrypt all EBS volumes.
Use IAM Roles instead of Access Keys.
Apply consistent resource tags.
Enable CloudWatch monitoring.
Restrict Security Group rules.
Use Session Manager for administration whenever possible.
Validate deployments before handing them over to application teams.

🚫 Common Mistakes

❌ Deploying EC2 instances into Public Subnets unnecessarily.

❌ Leaving SSH open to 0.0.0.0/0.

❌ Launching unencrypted EBS volumes.

❌ Forgetting to attach an IAM Role.

❌ Using the default Security Group without review.

❌ Skipping resource tagging.

❌ Forgetting to enable monitoring.

🧪 DIY Challenge

Launch a second application server:

CloudNova-App-Server-02

Requirements:

Amazon Linux 2023
t3.micro
Private-App-B Subnet
App-SG
IAM Role attached
Encrypted GP3 volume
Public IP disabled
Enterprise tags applied

After deployment:

Compare the configurations of both instances.
Verify that both comply with CloudNova’s standards.
Record any differences and explain why they exist.

Take screenshots of:

EC2 Dashboard
Networking
Security Group
IAM Role
Storage
Tags
AWS CLI outputs

📊 Knowledge Check

Why should production EC2 instances typically be launched in Private Subnets?
Why is Amazon Linux 2023 a common choice for AWS workloads?
What is the purpose of an IAM Role attached to an EC2 instance?
Why should EBS volumes be encrypted?
Why should Public IP addresses be disabled for application servers?
What is the advantage of using AWS Systems Manager instead of SSH?
Why are resource tags important in enterprise environments?
Which AWS CLI command launches a new EC2 instance?
What checks should you perform after launching an instance?
Which CloudNova deployment standard contributes most to reducing the attack surface?

💡 Key Takeaways

After completing this lesson, you should understand:

Launching an EC2 instance securely involves much more than selecting an AMI and clicking Launch.
Secure deployments require careful configuration of networking, identity, storage and monitoring.
Private Subnets, IAM Roles, encrypted EBS volumes and properly configured Security Groups are fundamental building blocks of a secure EC2 environment.
Enterprise standards such as consistent tagging, validation and monitoring improve security, governance and operational efficiency.
Following a repeatable deployment workflow helps ensure every EC2 instance is built securely and consistently.

🚀 Next Lesson

➡️ Lesson 05 — IAM Roles for EC2