AWS EC2 | DevOps QuickRef | DevOps QuickRef

Instances

aws ec2 describe-instances

Lists instances and their full detail as JSON.

aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name,PublicIpAddress]" --output table

A readable table of instance ID, state and public IP — the practical everyday version of describe-instances.

aws ec2 start-instances --instance-ids i-0123456789abcdef0

Starts a stopped instance.

aws ec2 stop-instances --instance-ids i-0123456789abcdef0

Stops a running instance. EBS-backed data persists; instance-store data does not.

aws ec2 terminate-instances --instance-ids i-0123456789abcdef0

destructive

Permanently destroys the instance. Unlike stop, this deletes the instance and (by default) any attached EBS volumes set to delete-on-termination.

aws ec2 reboot-instances --instance-ids i-0123456789abcdef0

Reboots an instance in place, without changing its instance ID or IP addresses.

Connecting

ssh -i my-key.pem ec2-user@PUBLIC_IP

Connects over SSH using the instance's key pair. Username varies by AMI: ec2-user (Amazon Linux/RHEL), ubuntu (Ubuntu), admin (Debian).

aws ec2-instance-connect ssh --instance-id i-0123456789abcdef0

Connects via EC2 Instance Connect, pushing a temporary SSH key instead of relying on a long-lived one.

aws ssm start-session --target i-0123456789abcdef0

Opens a shell via Systems Manager Session Manager — no SSH key, no open inbound port 22 required, as long as the instance has the SSM agent and an appropriate role.

Key Pairs

aws ec2 create-key-pair --key-name my-key --query 'KeyMaterial' --output text > my-key.pem

Creates a new key pair and saves the private key locally. AWS does not retain a copy — losing this file means losing access via that key.

chmod 400 my-key.pem

Restricts the key file to owner-read-only. SSH refuses to use a key with looser permissions.

Security Groups

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

Shows a security group's inbound and outbound rules.

aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0

Opens inbound access on a port from a CIDR range. 0.0.0.0/0 means the entire internet — scope this to what actually needs access.

aws ec2 revoke-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 22 --cidr 0.0.0.0/0

Removes an inbound rule — commonly used to close SSH access opened too broadly.

Security groups are stateful, NACLs aren't

A security group automatically allows the return traffic for a connection it allowed outbound — you don't need a matching inbound rule for responses. Network ACLs are stateless and need explicit rules in both directions, which is the most common cause of "the security group looks right but it still doesn't connect."

See AWS EC2 Cannot Connect for the full connectivity diagnostic sequence.