• October 21, 2026
• 8 min read

Amazon EC2 — Instances, Networking & Testing¶

Amazon Elastic Compute Cloud (EC2) rents virtual machines by the second. You pick an AMI (the disk image), an instance type (CPU, memory, network), a subnet and security groups (where it lives and who may talk to it), and an IAM role (what it may call). EC2 boots the machine; everything above the hypervisor — OS patches, the application, scaling, replacement of failed machines — is yours. Many other services (ECS on EC2, EKS nodes, RDS, EMR) are EC2 under the hood.

This guide is for Python developers and QA engineers who run, deploy to, or test against EC2: launching and cleaning up instances from code, giving them the right network and IAM, putting them behind a load balancer, and testing all of that without surprise bills. It does not cover VPC design or multi-account architecture. Sessions, Config, retries, ClientError and the credential chain are in AWS Foundations and are not repeated here. If your workload is a container, read Amazon ECS first.

The examples use boto3, moto (extras ec2, autoscaling, elbv2, ssm, iam, sts, server), pytest and pytest-xdist.

Where EC2 Fits¶

flowchart LR
  AMI["AMI<br/>(root disk template)"] -->|"run_instances"| I
  subgraph VPC["VPC"]
    subgraph SN["Subnet (one Availability Zone)"]
      I["EC2 instance"]
      EBS[("EBS volume")]
    end
    SG["Security group<br/>(stateful firewall)"]
  end
  PROFILE["Instance profile<br/>(IAM role)"] --> I
  SG -.-> I
  EBS --- I
  LB["ALB / NLB<br/>target group"] --> I
  ASG["Auto Scaling group<br/>(launch template)"] -. "launches and replaces" .-> I
  TESTS["pytest / CI"] -- "boto3: run, describe, terminate" --> I

• An instance is disposable. Build it from an AMI plus user data, give it a role, and be ready to replace it. Anything that must survive goes on EBS, S3 or a database.
• Networking is per instance, not per OS. The security group is a firewall outside the VM; the subnet decides the Availability Zone and whether a public IP is possible. See 02 Networking, Security & IAM.
• Credentials come from the instance profile. Code on the instance gets short-lived keys from the metadata service (IMDS), with no key files. See 02.
• Tests run against moto for request shape and bookkeeping, and against a tiny real instance for what an emulator cannot do (boot, user data, IAM, the metadata service). See 05 Testing.

Section Map¶

Minimal Working Example¶

# uv add boto3 "moto[ec2,ssm]"
import boto3
from moto import mock_aws

with mock_aws():                                              # in-process fake EC2; no account, no network
    ec2 = boto3.client("ec2", region_name="us-east-1")
    ssm = boto3.client("ssm", region_name="us-east-1")

    # Never hard-code AMI IDs: resolve the current Amazon Linux 2023 image from the public SSM parameter.
    ami = ssm.get_parameter(Name="/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64")["Parameter"]["Value"]

    resp = ec2.run_instances(
        ImageId=ami,
        InstanceType="t3.micro",
        MinCount=1,
        MaxCount=1,
        MetadataOptions={"HttpTokens": "required"},            # IMDSv2 only
        TagSpecifications=[{"ResourceType": "instance",
                            "Tags": [{"Key": "Name", "Value": "demo"}, {"Key": "owner", "Value": "qa"}]}],
    )
    instance_id = resp["Instances"][0]["InstanceId"]
    print("launched, state in the response:", resp["Instances"][0]["State"]["Name"])

    ec2.get_waiter("instance_running").wait(InstanceIds=[instance_id])        # polls DescribeInstances until "running"

    inst = ec2.describe_instances(InstanceIds=[instance_id])["Reservations"][0]["Instances"][0]
    print("state:", inst["State"]["Name"], "| type:", inst["InstanceType"], "| tags:", {t["Key"]: t["Value"] for t in inst["Tags"]})

    ec2.terminate_instances(InstanceIds=[instance_id])
    ec2.get_waiter("instance_terminated").wait(InstanceIds=[instance_id])
    print("state after terminate:", ec2.describe_instances(InstanceIds=[instance_id])["Reservations"][0]["Instances"][0]["State"]["Name"])

launched, state in the response: pending
state: running | type: t3.micro | tags: {'Name': 'demo', 'owner': 'qa'}
state after terminate: terminated

Against a real account the same code works with mock_aws() removed, a real AMI from SSM and credentials from the usual chain (see Foundations); the instance then needs about a minute to reach running, and it bills until you terminate it.

EC2 vs Containers vs Lambda¶

Rule of thumb: start with Lambda or Fargate; use EC2 when you need something they cannot give (hardware, OS control, long-lived hosts) or when a fleet of always-busy machines is cheaper.

Facts That Changed Recently¶

Older tutorials get these wrong. As of October 2026 (AWS documentation):

Quick Rules¶

1. Tag every resource at creation (TagSpecifications) with at least an owner, an environment and a run ID. Untagged instances cannot be found, billed or cleaned up.
2. Require IMDSv2 (MetadataOptions={"HttpTokens": "required"}) on every instance you launch; use HttpPutResponseHopLimit=2 only when containers on the host need the metadata service.
3. Resolve AMIs from SSM parameters (resolve:ssm:/aws/service/...) or by tag. Never paste AMI IDs: they are Region-specific and AWS-provided images are replaced regularly (each Amazon Linux 2023 release is deprecated after 90 days).
4. No SSH keys and no 0.0.0.0/0 on port 22 or 3389. Use Session Manager (SSM) and a role with AmazonSSMManagedInstanceCore.
5. Give every instance a role (instance profile), never access keys. Scope the role to the resources it uses.
6. Wait with waiters and deadlines, not sleep. instance_running is not instance_status_ok: the second one means the OS booted.
7. Pass a ClientToken and catch ClientError codes. EC2 has no modeled exception classes; RequestLimitExceeded and InsufficientInstanceCapacity need different handling.
8. Always clean up in finally or fixture teardown, keyed on a unique run tag, and run a scheduled janitor for what slips through.
9. Use DryRun=True to check permissions and parameters before an expensive launch: success is the DryRunOperation error.
10. Keep a tiny real-instance smoke test (a t4g.nano for minutes, in a sandbox account); moto proves requests, not boot, IAM or networking.

See also¶

• Digital Garden: Knowledge Base
• AWS — Service Guides for Python & Test Automation
• AWS Foundations — boto3, Credentials & Local Testing
• Amazon ECS — Containers on Fargate, Services & Testing
• Amazon SQS — Queues, Consumers & Testing
• Amazon SNS — Topics, Subscriptions & Fan-out
• Amazon Bedrock — Foundation Models, Converse API & Guardrails
• Docker & Docker Compose — Overview
• Linux Terminal — Essential Commands
• CI/CD
• Performance Testing
• Pytest — Python Testing Framework