• October 21, 2026
• 12 min read

Amazon EC2 — Core Concepts¶

The building blocks you meet in every EC2 task: where instances run, how to choose a type, what an AMI is, what survives a stop, what is billed in each state, and which quotas bite first. Code samples here run against moto; the next page covers the network, 02 Networking, Security & IAM.

Regions and Availability Zones¶

zones = ec2.describe_availability_zones(Filters=[{"Name": "state", "Values": ["available"]}])["AvailabilityZones"]
print([(z["ZoneName"], z["ZoneId"]) for z in zones][:3])     # name is per-account (older accounts); ZoneId is the stable one

offers = ec2.describe_instance_type_offerings(LocationType="availability-zone", Filters=[{"Name": "instance-type", "Values": ["t4g.small"]}])
print("t4g.small offered in", sorted(o["Location"] for o in offers["InstanceTypeOfferings"])[:3], "...")   # is the type available in my AZ?

Instance Types¶

The name is a code: c7gn.xlarge = series c (compute), generation 7, options gn (Graviton, network-optimized), size xlarge.

Choosing a type, in this order:

1. Architecture. The AMI and the instance type must match: an arm64 AMI needs a Graviton type (m8g, c8g, t4g), an x86_64 AMI needs an Intel or AMD type. AWS positions Graviton as the better price-performance option; pure-Python code and most popular wheels work on aarch64, but benchmark your workload and keep an x86_64 option for native dependencies without Arm wheels. Amazon Linux 2023 on Arm needs Graviton2 or later.
2. Series. General purpose (M) for most services, compute (C) for CPU-bound load generators and CI runners, memory (R) for caches and big test data, T for idle-most-of-the-time dev and test hosts.
3. Generation. Pick a current-generation type. The EC2 docs list A1, M1-M4, C1, C3, C4, R3, R4, T1, I2 as previous generation: still sold, but not recommended for new work.
4. Size. Start small, measure, then resize (stop, change type, start). AWS Compute Optimizer recommends sizes from CloudWatch data.
5. Availability. Check describe_instance_type_offerings for your AZ before you hard-code a type in a test.

resp = ec2.describe_instance_types(Filters=[
    {"Name": "processor-info.supported-architecture", "Values": ["arm64"]},
    {"Name": "instance-type", "Values": ["t4g.*"]},
])
for t in sorted(resp["InstanceTypes"], key=lambda t: t["MemoryInfo"]["SizeInMiB"])[:3]:
    print(t["InstanceType"], t["VCpuInfo"]["DefaultVCpus"], "vCPU", t["MemoryInfo"]["SizeInMiB"], "MiB", t["ProcessorInfo"]["SupportedArchitectures"], "burstable:", t["BurstablePerformanceSupported"])

Burstable and flex¶

A CI runner or load generator that runs hot for an hour is a bad fit for a T type: use a C or M type and stop it afterwards. Watch CPUCreditBalance and CPUSurplusCreditBalance in CloudWatch.

Purchasing Options¶

For test automation the practical rule: On-Demand plus a janitor for ad hoc tests, Spot for fleets that can be restarted, Savings Plans only for the always-on baseline someone else owns.

AMIs¶

An Amazon Machine Image (AMI) is the template for the root volume (plus launch permissions and a device mapping). It is Region-specific and has an architecture (x86_64 or arm64). Never hard-code an AMI ID: IDs differ per Region and the AWS-provided ones are replaced regularly (each Amazon Linux 2023 release is deprecated 90 days after publication).

Details of the calls are in 03. To bake your own, see EC2 Image Builder in 04.

Storage: EBS vs Instance Store¶

Stopped instances stop billing for compute, not for EBS: volumes (and their snapshots) are charged until deleted. Create volumes with Encrypted: True and tag them at creation (a volume entry in TagSpecifications); untagged orphan volumes are the most common leftover of failed tests.

IP Addresses and Network Interfaces¶

Test code that stores an instance's public IP must re-read it after any stop/start. In a private subnet there is no public IP at all: reach the instance with Session Manager or from inside the VPC (02).

Access: Key Pairs vs Session Manager¶

User Data and cloud-init¶

User data is a blob (shell script starting with #!, or #cloud-config YAML) handed to the instance; cloud-init runs it.

Slow user data makes "running" a poor readiness signal: a test should wait for the application (a health check, an SSM command, a log line), not for the instance state. Rendering and validating user data is a pure-function problem, tested in 05.

Lifecycle and Billing¶

stateDiagram-v2
  [*] --> pending: run_instances
  pending --> running
  running --> stopping: stop_instances
  stopping --> stopped
  stopped --> pending: start_instances
  running --> shutting_down: terminate_instances
  stopped --> shutting_down: terminate_instances
  shutting_down --> terminated
  terminated --> [*]

• Reboot keeps the host, public IP and instance store, and does not start a new billing minute. Stop/start usually moves the instance to another host.
• InstanceInitiatedShutdownBehavior decides what shutdown -h inside the guest does: default stop; set terminate for disposable test instances (our launch helper does).
• Termination protection (DisableApiTermination) blocks terminate_instances until you clear it; a protected instance is a janitor-job trap.

Tags¶

A minimal tagging policy for tests: owner, env, run-id (unique per test run), plus Name. The run-id tag is what makes cleanup safe (05).

Quotas and Throttling¶

Errors for exceeded quotas: VcpuLimitExceeded, InstanceLimitExceeded, MaxSpotInstanceCountExceeded, SecurityGroupsPerInstanceLimitExceeded. A launch of 20 m5.24xlarge (1,920 vCPUs) in a new account fails on real EC2 and succeeds on moto (07).

sq = boto3.client("service-quotas", region_name="us-east-1")
with Stubber(sq) as stub:                                 # scripted response; the request is checked by Stubber
    stub.add_response("get_service_quota", {"Quota": {"QuotaName": "Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances", "Value": 5.0, "Unit": "None"}},
                      expected_params={"ServiceCode": "ec2", "QuotaCode": "L-1216C47A"})
    quota = sq.get_service_quota(ServiceCode="ec2", QuotaCode="L-1216C47A")["Quota"]
    print(quota["QuotaName"], "=", quota["Value"], "vCPUs")

[('us-east-1a', 'use1-az6'), ('us-east-1b', 'use1-az1'), ('us-east-1c', 'use1-az2')]
t4g.nano 2 vCPU 512 MiB ['arm64'] burstable: True
t4g.micro 2 vCPU 1024 MiB ['arm64'] burstable: True
t4g.small 2 vCPU 2048 MiB ['arm64'] burstable: True
t4g.small offered in ['us-east-1a', 'us-east-1b', 'us-east-1c'] ...
Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances = 5.0 vCPUs

The first four lines come from moto's bundled instance-type data (the AZ IDs and offerings are moto's, not a real Region's). The last line is the Stubber response, not a value from AWS.

API throttling¶

EC2 throttles per account and Region with a token bucket per API: a bucket size (burst) and a refill rate (sustained), and a second resource bucket for RunInstances, StartInstances, StopInstances and TerminateInstances. Exceeding it returns RequestLimitExceeded.

Always call Describe* with filters and pagination (it draws from the larger bucket) and use waiters or EventBridge instead of tight polling. Retry throttling with backoff: boto3's standard retry mode already does.

Quick Rules¶

1. Match architecture: arm64 AMI with Graviton types, x86_64 AMI with Intel or AMD types.
2. Use a current-generation type and check describe_instance_type_offerings for the AZ.
3. Resolve AMIs from SSM parameters or tags; never paste IDs.
4. Stopped is not free: EBS volumes, snapshots and Elastic IPs still bill.
5. Instance store is scratch: it is wiped on stop and terminate.
6. Public IPs change on stop/start; re-read them or use an Elastic IP or DNS.
7. User data runs once, as root, within 16 KB; wait for the application, not for running.
8. Tag at creation with owner, env and run-id; activate cost-allocation tags once.
9. Know your vCPU quota before a fleet test; new accounts start at 5 vCPUs.
10. Filter and paginate Describe* calls and let the retry mode handle RequestLimitExceeded.

See also¶

• Amazon EC2 — Instances, Networking & Testing
• Amazon EC2 — Networking, Security & IAM
• Amazon EC2 — boto3 in Python
• AWS Foundations — Clients, Config, Retries & Errors
• AWS Foundations — Credentials, IAM & Local Testing
• Linux Terminal — Essential Commands