Amazon EC2

What EC2 is

EC2 (Elastic Compute Cloud) rents you a virtual server, called an instance. You pick an instance type — a bundle of CPU, memory, network, and storage — and an AMI (a template with the OS and whatever software you bake in), attach EBS storage, and it boots like a normal machine you SSH or RDP into. Unlike Lambda or the other managed compute options, you own the OS: patching, scaling, and process management are yours unless you layer on something like Auto Scaling.

Design Beaver models EC2 as an instance that launches into a subnet inside a VPC — outside one isn’t possible in AWS — and validates its connections and the IAM each one needs as you draw, while the diagram is still cheap to change.

When to use EC2 (and when not to)

Reach for EC2 when you need full control over the OS, runtime, and installed software. It’s the right call for long-running or stateful workloads that don’t map to short request/response cycles, for software that needs root access or hardware-tied licensing, for lifting an existing server app into AWS without rearchitecting it first, and for workloads that need specific hardware — GPU, very high memory, high I/O — that serverless options don’t expose directly.

Don’t reach for it for simple, spiky, event-driven logic — Lambda avoids paying for idle capacity between events. It’s also the wrong tool when you don’t want to own OS patching and capacity management, or when traffic is highly variable and you haven’t set up Auto Scaling. A fixed-size fleet either sits idle burning money or falls over under load.

Variants: instance families

EC2’s “variants” are instance families — the dial between CPU, memory, and hardware accelerators. The T family bursts cheaply for low-average-utilization work; M, C, and R trade off the CPU-to-memory ratio for steady workloads; G/P bring GPUs and other accelerators.

EC2 pricing

You pay per instance-hour for the compute, and the family and size you pick move that number a lot — plus the purchase model (On-Demand, Savings Plans, Reserved, Spot) changes the effective rate. Graviton (ARM) variants are consistently cheaper than their x86 equivalents where your software supports ARM.

How EC2 connects to other services

An EC2 instance is rarely a lone box — it’s an app server talking to a database, a queue, object storage, and more. Each of those edges has a requirement that makes it actually work, and the one that matters most is the credential pattern: attach an IAM role via an instance profile instead of storing access keys on the instance. The SDK then picks up temporary, auto-rotating credentials from instance metadata. Design Beaver models each connection and the IAM it needs, so it knows what belongs on every edge.

• →RDS

  Application running on the EC2 instance connects to an RDS database as its data layer (the standard self-managed-app-server + managed-database pattern)

• →DynamoDBsecurity

  Application on the EC2 instance reads/writes DynamoDB via the AWS SDK

  IAM:dynamodb:GetItemdynamodb:PutItemdynamodb:Querydynamodb:UpdateItemdynamodb:DeleteItem

• →S3security

  Application on the EC2 instance reads/writes S3 objects via the AWS SDK (e.g. uploading user content, reading config/assets, writing logs or backups)

  IAM:s3:GetObjects3:PutObjects3:ListBucket

• →Lambdasecurity

  Application code on the EC2 instance directly invokes a Lambda function (via the SDK or a Lambda function URL) to offload a specific task

  IAM:lambda:InvokeFunction

• →SQSsecurity

  An application on the EC2 instance sends or polls SQS messages via the AWS SDK to decouple components of the system

  IAM:sqs:SendMessagesqs:ReceiveMessagesqs:DeleteMessagesqs:GetQueueAttributes

• →SESsecurity

  An application on the EC2 instance sends email through SES via the AWS SDK or the SES SMTP interface

  IAM:ses:SendEmailses:SendRawEmail

• →SNSsecurity

  An application on the EC2 instance publishes messages to an SNS topic via the AWS SDK to fan out events to multiple subscribers

  IAM:sns:Publish

• →EventBridgesecurity

  An application on the EC2 instance publishes custom events to an event bus with PutEvents via the AWS SDK, so other services react through EventBridge rules without the app calling them directly. (Distinct from EC2's own instance state-change lifecycle events, which the EC2 service emits to the default bus automatically — see the note on the Lambda edge above.)

  IAM:events:PutEvents

• →Secrets Managersecurity

  An application on the EC2 instance reads a secret (e.g. database credentials or a third-party API key) from Secrets Manager at runtime via the AWS SDK instead of storing it on the instance

  IAM:secretsmanager:GetSecretValuesecretsmanager:DescribeSecret

Anti-patterns Design Beaver catches

These are the EC2 mistakes that pass a diagram review but bite in production — the ones the validation engine flags as you draw.

Gotchas that bite in production

• A single instance with no Auto Scaling group and no load balancer has no resilience. It can’t survive instance failure or an AZ outage, and it can’t absorb a traffic spike without manual intervention. This is the most common EC2 anti-pattern for anything production-facing — put instances in an Auto Scaling group across multiple AZs behind an ALB or CloudFront.
• Store an IAM role, not access keys. Long-lived keys on disk are a standing credential-leak risk. An instance profile hands the SDK temporary, auto-rotating credentials from instance metadata — nothing to manage or accidentally commit.
• EC2 can absolutely be a CloudFront origin — it isn’t S3-only. A publicly resolvable EC2 instance works as a custom origin, and CloudFront’s VPC origins feature lets a private-subnet instance serve as an origin without exposing it to the internet.
• A private instance with no public IP needs an ALB in front to be reachable at all. The ALB terminates public traffic; the instance just registers as a healthy target in a target group.
• “EC2 triggers Lambda” mostly runs backwards. EC2 state-change events (start/stop/terminate) are published to EventBridge, which then invokes Lambda for automation. Direct application-level EC2-to-Lambda invocation via the SDK or a function URL is valid, but less common than that event-driven direction.
• Cross-AZ traffic to RDS is billed as data transfer. Same-AZ placement avoids that cost — at the expense of losing AZ-level redundancy for that pairing.
• Burstable T-family instances aren’t free performance forever. Sustained high CPU burns through credits, after which performance drops to the baseline. Don’t put a sustained high-CPU workload on a T-family instance and expect it to keep bursting indefinitely.

Further reading

• Official AWS documentation
• Why we built a validation engine