9. Glossary and Cheatsheet

Goal: the 10-second lookup. Terms alphabetised, commands grouped by what you're trying to do, and the handful of limits worth knowing the shape of.

---

Glossary

Term	One line
AMI	Amazon Machine Image — immutable, region-scoped boot template backed by an EBS snapshot
ARN	Amazon Resource Name — globally unique resource identifier: arn:aws:ec2:region:account:instance/i-…
ASG	Auto Scaling group — maintains a desired count of instances from a launch template across subnets
Availability Zone (AZ)	One or more discrete data centres in a region with independent power, cooling, and networking
Bare metal (*.metal)	An instance type with no hypervisor — the whole physical machine
Block device mapping	The launch-time definition of which volumes attach at which device names
Burstable (t family)	Instance types with a low CPU baseline that earn and spend credits for bursts
Capacity Reservation	Reserves capacity in a specific AZ; billed whether used or not. The only common way to guarantee a launch
cloud-init	The in-guest agent that applies metadata at first boot: SSH keys, hostname, filesystem growth, user data
Cluster placement group	Packs instances onto one low-latency network segment; concentrates failure risk
Composite alarm	A CloudWatch alarm over other alarms — used to page once instead of forty times
CPU credits	The burstable-instance currency; CPUCreditBalance hitting zero means throttling or surplus charges
Dedicated Host	A physical server allocated to you, with socket/core visibility — for per-core BYOL licensing
Dedicated Instance	An instance on hardware not shared with other AWS accounts (no host visibility)
DeleteOnTermination	Per-volume flag. true for root volumes by default, false for additional volumes — the orphaned-volume cause
Deregistration delay	How long a load balancer lets in-flight requests finish before cutting a target off
Detailed monitoring	1-minute CloudWatch metrics instead of 5-minute; costs extra, necessary for responsive auto-scaling
Drift	Divergence between what the IaC declares and what exists in AWS
EBS	Elastic Block Store — durable, replicated-within-one-AZ, network-attached block storage
EBS-optimised	Dedicated bandwidth between instance and EBS; standard on current instance types
Elastic IP (EIP)	A static public IPv4 you allocate and can remap; billed hourly, including while idle
ENA	Elastic Network Adapter — enhanced networking with direct hardware access; also exposes allowance metrics
ENI	Elastic Network Interface — a virtual NIC carrying private IPs, MAC, and security groups
Fast Snapshot Restore	Pre-hydrates volumes created from a snapshot to avoid first-read latency; charged per snapshot per AZ
Gateway endpoint	Route-table-based VPC endpoint for S3 and DynamoDB only; no hourly charge
gp3	Current default SSD volume type; IOPS and throughput provisioned independently of size
Graviton (*g)	AWS ARM64 processors — typically better price/performance, requires ARM64-built software
Health check grace period	How long after launch before an ASG acts on health checks; too short causes infinite replacement loops
Hibernation	Writes RAM to the encrypted root volume and stops; resumes with memory intact
IMDS	Instance Metadata Service at 169.254.169.254 — metadata and instance-profile credentials
IMDSv2	Session-token-required IMDS with a hop limit; mitigates SSRF-to-credential-theft. Require it
Instance	A running virtual machine in one AZ, identified i-…, billed by the second while running
Instance profile	A container for one IAM role, attached to an instance so code gets temporary credentials
Instance refresh	ASG-managed rolling replacement of instances when the launch template changes — your deploy
Instance store	Ephemeral local NVMe/SSD; included in the price, lost on stop, terminate, or host change
Instance type	The named vCPU/memory/network/accelerator shape, e.g. m6i.large
Interface endpoint	PrivateLink VPC endpoint for most AWS services; charged per endpoint-hour per AZ plus per GB
Key pair	SSH keypair; AWS holds the public half, the private half is shown exactly once
Launch template	The versioned recipe for launching an instance; supersedes launch configurations
Lifecycle hook	Pauses an instance in Pending:Wait/Terminating:Wait so you can register, drain, or checkpoint
Mixed instances policy	Lets one ASG span multiple instance types and On-Demand/Spot splits — the resilience and cost win
NACL	Network ACL — stateless allow/deny filter at the subnet boundary (contrast: stateful security group)
NAT gateway	Managed outbound internet access for private subnets; billed per hour and per GB processed
Nitro	The AWS hardware platform — Nitro Cards offload I/O, a security chip roots trust, a thin hypervisor allocates CPU/memory
On-Demand	Per-second billing with no commitment
Placement group	Cluster (low latency), spread (distinct hardware), or partition (rack-aware) instance placement
Region	A geographically isolated group of AZs, e.g. us-east-1. Most resources are region-scoped
Reserved Instance (RI)	Older attribute-based commitment discount; Zonal RIs also reserve capacity
Savings Plan	A 1- or 3-year $/hour commitment for a discount. Not a capacity guarantee
Security group	Stateful, allow-only virtual firewall enforced at the ENI in Nitro hardware
Session Manager	SSM browser/CLI shell with IAM authorisation and CloudTrail audit — no port 22, no keys
Snapshot	Incremental point-in-time copy of an EBS volume, stored in S3, region-scoped, independently restorable
Spot	Spare capacity at a deep discount, reclaimable with ~2 minutes' notice. Separate vCPU quota
SSM Agent	The Systems Manager agent; pre-installed on current Amazon Linux/Ubuntu/Windows AMIs
Static stability	Provisioning enough spare capacity that failure recovery requires no new launches
Status checks	System (host), instance (guest OS), and attached-EBS health signals
Subnet	An AZ-bound CIDR slice of a VPC; "public" if its route table reaches an internet gateway
Tag	Key/value metadata — the basis of cost allocation, automation targeting, and tag-based IAM
Target group	The registered set of targets a load balancer routes to, with its own health check
Target tracking	Scaling policy that holds a metric at a set value — the sensible default
Termination protection	Blocks TerminateInstances until disabled; the instance-level equivalent of deletion protection
User data	Launch-time script run as root by cloud-init on first boot only; visible via IMDS — never put secrets in it
vCPU quota	The real EC2 limit: running vCPUs per instance-family group per region, separately for On-Demand and Spot
VPC	Your logically isolated virtual network
VPC endpoint	Private connectivity to AWS services without an internet gateway or NAT
Warm pool	Pre-initialised, stopped instances an ASG can start quickly to shorten scale-out time

---

Instance type decoder

m6i.large → family m · generation 6 · capability i · size large

Position	Values
Family	t burstable · m general · c compute · r/x/z memory · i/d storage · g/p/inf/trn accelerated · hpc
Capability	i Intel · a AMD · g Graviton (ARM64) · d local NVMe · n extra network · e extra storage/memory · flex partial sustained CPU
Size	nano → micro → small → medium → large → xlarge → 2xlarge … → metal

Each size step roughly doubles vCPU, memory, and price.

---

Cheatsheet

Discover

# Current Amazon Linux 2023 AMI for this region — never hard-code an AMI ID
aws ssm get-parameters --names \
  /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query 'Parameters[0].Value' --output text

# What's running, at a glance
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].[InstanceId,InstanceType,PrivateIpAddress,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# Is this instance type even offered in these AZs?
aws ec2 describe-instance-type-offerings --location-type availability-zone \
  --filters Name=instance-type,Values=m6i.large \
  --query 'InstanceTypeOfferings[].Location' --output text

# Instance type specs (vCPU, memory, network)
aws ec2 describe-instance-types --instance-types m6i.large \
  --query 'InstanceTypes[].[VCpuInfo.DefaultVCpus,MemoryInfo.SizeInMiB,NetworkInfo.NetworkPerformance]' \
  --output table

Launch and connect

aws ec2 run-instances \
  --image-id $AMI_ID --instance-type t3.micro \
  --subnet-id subnet-0abc123 --security-group-ids sg-0abc123 \
  --iam-instance-profile Name=my-instance-profile \
  --metadata-options "HttpTokens=required,HttpPutResponseHopLimit=1" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=demo}]'

# Wait for reachability, not just 'running' — this is the flaky-script fix
aws ec2 wait instance-status-ok --instance-ids i-0abc123

# Shell in, no SSH key, no port 22
aws ssm start-session --target i-0abc123

# Port-forward a local port to the instance (e.g. a database through it)
aws ssm start-session --target i-0abc123 \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["8080"],"localPortNumber":["8080"]}'

# Run a command across a fleet by tag
aws ssm send-command --document-name AWS-RunShellScript \
  --targets "Key=tag:Environment,Values=dev" \
  --parameters 'commands=["systemctl status nginx"]'

# Boot diagnostics when it won't come up
aws ec2 get-console-output --instance-id i-0abc123 --output text

Lifecycle

aws ec2 stop-instances      --instance-ids i-0abc123   # keeps EBS, loses instance store + public IP
aws ec2 start-instances     --instance-ids i-0abc123
aws ec2 reboot-instances    --instance-ids i-0abc123   # stays on the same host
aws ec2 terminate-instances --instance-ids i-0abc123
aws ec2 wait instance-terminated --instance-ids i-0abc123

# Resize (requires a stop)
aws ec2 modify-instance-attribute --instance-id i-0abc123 --instance-type m6i.large

# Guard against accidental termination
aws ec2 modify-instance-attribute --instance-id i-0abc123 --disable-api-termination

Storage

# Grow a volume (then extend the filesystem inside the OS: growpart + resize2fs/xfs_growfs)
aws ec2 modify-volume --volume-id vol-0abc123 --size 100 --volume-type gp3

aws ec2 create-snapshot --volume-id vol-0abc123 --description "pre-migration $(date +%F)"
aws ec2 wait snapshot-completed --snapshot-ids snap-0abc123

# gp2 → gp3, no downtime
aws ec2 modify-volume --volume-id vol-0abc123 --volume-type gp3

Deploy (ASG)

# Roll the fleet onto the new launch template version
aws autoscaling start-instance-refresh --auto-scaling-group-name my-asg \
  --preferences '{"MinHealthyPercentage":90,"InstanceWarmup":180,"AutoRollback":true}'

aws autoscaling describe-instance-refreshes --auto-scaling-group-name my-asg \
  --query 'InstanceRefreshes[0].[Status,PercentageComplete,StatusReason]' --output table

aws autoscaling cancel-instance-refresh   --auto-scaling-group-name my-asg
aws autoscaling rollback-instance-refresh --auto-scaling-group-name my-asg

# Keep an instance for forensics; the ASG launches a replacement
aws autoscaling detach-instances --instance-ids i-0abc123 \
  --auto-scaling-group-name my-asg --should-decrement-desired-capacity

Cost and quota checks

# Orphaned volumes — billing for nothing
aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,CreateTime]' --output table

# Idle Elastic IPs — billing hourly
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==`null`].[PublicIp,AllocationId]' --output table

# Instances still on IMDSv1
aws ec2 describe-instances --filters "Name=metadata-options.http-tokens,Values=optional" \
  --query 'Reservations[].Instances[].InstanceId' --output text

# Unencrypted volumes
aws ec2 describe-volumes --filters Name=encrypted,Values=false \
  --query 'Volumes[].VolumeId' --output text

# What's my quota, and ask for more
aws service-quotas get-service-quota --service-code ec2 --quota-code L-1216C47A
aws service-quotas request-service-quota-increase \
  --service-code ec2 --quota-code L-1216C47A --desired-value 512

Terraform / Ansible

terraform init && terraform plan -out=tfplan && terraform apply tfplan
terraform plan -detailed-exitcode        # 0 = clean, 1 = error, 2 = DRIFT
terraform state list
terraform import aws_instance.demo i-0abc123
terraform destroy

ansible-playbook -i inventory/aws_ec2.yml playbooks/app.yml --check   # dry run
ansible-playbook -i inventory/aws_ec2.yml playbooks/app.yml
ansible-inventory -i inventory/aws_ec2.yml --graph                    # who will this hit?

---

Symptom → metric

The fast diagnostic path:

Symptom	Check	Likely cause
Instance unreachable	StatusCheckFailed_System	Host failure — often auto-recovers; stop/start moves hosts
Instance unreachable, host fine	StatusCheckFailed_Instance + get-console-output	Kernel panic, full disk, broken network config
Gradually slower over days	CPUCreditBalance	Burstable credits exhausted
Disk slow, volume looks fine	EBSIOBalance%, instance-type EBS ceiling	Instance bandwidth limit, not volume limit
Throughput plateaus, CPU idle	ENA bw_*_allowance_exceeded, pps_allowance_exceeded	Instance network allowance
Random packet loss under load	ENA conntrack_allowance_exceeded	Connection-tracking exhaustion
Out of memory, nothing in CloudWatch	mem_used_percent (agent required)	Memory isn't a default metric
502s after every scale-out	health_check_grace_period, target group health	Traffic routed before the app was ready
Requests dropped on scale-in	deregistration_delay	Too short — connections cut mid-flight
ASG launching and killing in a loop	Grace period vs. boot time	Health checks failing before the app starts
Can't reach desired capacity	GroupInServiceInstances, ASG activity history	Quota or AZ capacity

---

Limits worth knowing the shape of

Every number here changes. Check Service Quotas in your own account — ⚠️ verify against current AWS docs and your account's quotas. What's durable is the kind of limit.

Limit	Kind	Notes
Running On-Demand vCPUs per family group, per region	Soft	Counted in vCPUs, not instances. Separate quotas for standard vs G/P/Inf/Trn/X/DL/HPC
Running Spot vCPUs per family group, per region	Soft	Separate from On-Demand — the common surprise
Elastic IPs per region	Soft, low by default	The classic early-account wall
EBS storage per volume type, per region	Soft	TiB-denominated
Snapshots per region	Soft
Instances per ASG / ASGs per region	Soft
Launch template versions	Soft	Matters for frequently-deployed services
Security groups per ENI / rules per group	Soft	Rule count is the one that bites
Instance type availability in an AZ	Hard, momentary	Not a quota — this is InsufficientInstanceCapacity
Largest size in a family	Hard	Go horizontal
Spot interruption notice	Fixed (~2 min as of writing)	Design the drain to fit inside it

Quotas are per account, per region. A new region starts you back at defaults — a classic expansion-day outage. Request increases days ahead, not during the spike.

---

Error → fix

Error	Meaning	Fix
VcpuLimitExceeded	Your quota	Service Quotas increase request
InsufficientInstanceCapacity	AWS capacity in that AZ, right now	Different AZ or type; diversify the ASG; Capacity Reservation
UnauthorizedOperation	IAM — often missing iam:PassRole	Grant the named action on the specific ARN
InvalidAMIID.NotFound	AMI is in another region, or deregistered	Look it up per region via SSM
VolumeInUse	Volume still attached	Detach first, or --force knowingly
DependencyViolation on SG delete	Something still references it	Find the referencing ENI/SG; create_before_destroy prevents this in Terraform
IncorrectInstanceState	Wrong lifecycle state for the operation	Stop it first (e.g. to resize)
RequestLimitExceeded	API throttling	Exponential backoff; batch your describe calls
Client.InstanceInitiatedShutdown	The guest OS shut itself down	Check console output and your user data

---

The 10-second decision table

Question	Answer
Which volume type?	gp3 unless you've measured a reason not to
Which instance family?	m to start; profile, then move to c or r. Try Graviton (*g)
Burstable in prod?	Only for genuinely spiky, low-duty-cycle work — and know your credit mode
How do I get a shell?	Session Manager. Not SSH
Public or private subnet?	Private. The load balancer is the public surface
One instance or two?	Two, minimum, in different AZs. One instance is not a service
ASG health check type?	ELB, always, with a real /health
Which scaling metric?	ALBRequestCountPerTarget for web, queue depth for workers, CPU last
Spot or On-Demand?	Spot for stateless and interruptible — with a drain handler. On-Demand/committed for the baseline
Savings Plan sizing?	Cover your floor, not your average
Where do secrets live?	Secrets Manager or Parameter Store, fetched at startup. Never user data or the AMI
Deploy a new AMI how?	New launch template version + instance refresh with auto_rollback
Terraform or Ansible?	Terraform owns existence; Ansible owns configuration

---

All sub-topics in this topic

#	Sub-topic
1	What & Why
2	Core Concepts
3	Architecture
4	Getting Started
5	Deployment
6	Integrations
7	Production
8	Interview Questions
9	Glossary & Cheatsheet — you are here

← Back to the EC2 overview · All topics