Launch Your First EC2 Instance

Launch a Linux server on EC2 and serve a live web page from the cloud.

Introduction

30 Second Summary

Every website you visit is served by a computer running somewhere in the world. With cloud computing, you can launch your own server in minutes without buying any hardware.

In this project, you will launch a virtual server on Amazon EC2, connect to it over SSH from your Mac's terminal, and create a custom web page that anyone on the internet can visit.

What You'll Build

You will paste your server's public IP address into any browser and see a web page you created, served from a Linux server you launched and configured yourself in the AWS cloud.

By the end of this project, you'll have:

A running EC2 instance you can connect to from your Mac's terminal and control with typed commands.
A security group you configured yourself, acting as a firewall that controls exactly which traffic can reach your server.
A custom web page served by Apache, accessible to anyone on the internet via your instance's public IP address.
Secret Mission: Deploy a second page and configure a custom security group with tighter access rules.

Are there any prerequisites?

You need an AWS account with Free Tier eligibility. You also need a Mac with the built-in Terminal app, which includes an SSH client by default.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters for your cloud journey.

Launch Your EC2 Instance

You cannot learn cloud computing without having a real server to work with. In this step, you will launch your first EC2 instance, a virtual server running in the AWS cloud.

Once your instance is up and running, it will have its own public IP address. This is the foundation you will connect to and build on for the rest of the project.

In this step, get ready to:

Launch an EC2 instance with the Amazon Linux 2023 AMI.
Create a key pair for secure SSH access to your instance.
Configure network settings and start your instance.

Sign in to AWS and configure your instance

The AWS Management Console is a web-based dashboard where you manage all your AWS resources. You will use it to launch and configure your EC2 instance.

Open your browser and navigate to the EC2 console at https://console.aws.amazon.com/ec2/.
Sign in with your AWS account credentials if prompted.
On the EC2 dashboard, click Launch instance.

The launch wizard opens. This is where you configure your virtual server before it starts running.

Under Name and tags, enter my-web-server in the Name field.
Under Application and OS Images (Amazon Machine Image), click Amazon Linux.
Confirm the selected AMI reads Amazon Linux 2023 AMI and is marked Free tier eligible.

What is an AMI?

An AMI (Amazon Machine Image) is a template that contains the operating system and software your instance starts with. Think of it as a blueprint for your server.

Amazon Linux 2023 is a lightweight Linux distribution maintained by AWS. It comes pre-configured for cloud workloads and is free to use.

Under Instance type, confirm that t2.micro is selected.

Which instance type should I pick?

The instance type determines how much CPU and memory your server gets. For this project, you need the smallest free option.

If your AWS account was created before July 15, 2025, confirm t2.micro is selected. This is covered by the Free Tier (750 hours/month for 12 months).

If your account was created on or after July 15, 2025, select t3.micro instead. Your account includes sign-up credits that cover this instance type for 6 months.

Create a key pair for SSH access

Before you can connect to your instance from your Mac, you need a key pair. This is a set of security credentials that proves your identity when you log in remotely.

Under Key pair (login), click Create new key pair.
Enter my-ec2-key as the key pair name.
For Key pair type, select RSA.
For Private key file format, select .pem.
Click Create key pair.

Your browser automatically downloads a file called my-ec2-key.pem to your Downloads folder. This is your private key file.

What is a key pair?

A key pair has two parts. The public key lives on your EC2 instance, and the private key (the .pem file you just downloaded) stays on your computer.

When you connect to your instance over SSH, the two keys are matched to verify your identity. Without the private key file, you cannot log in.

Keep your private key safe

This is the only time AWS lets you download the private key. If you lose the my-ec2-key.pem file, you will not be able to connect to your instance and will have to create a new key pair.

Configure network settings and launch your instance

The last settings control which network traffic can reach your instance. A security group acts as a virtual firewall, with rules that allow or block specific types of traffic.

Under Network settings, keep the default VPC and subnet.
Confirm the checkbox Allow SSH traffic from is selected, with the source set to Anywhere (0.0.0.0/0).
Leave all other settings at their defaults.
In the Summary panel on the right, click Launch instance.

What is a security group?

A security group is a set of firewall rules that controls what traffic can reach your instance. Right now, the only rule allows SSH connections (port 22) from any IP address.

Security groups are stateful. This means responses to allowed inbound traffic are automatically allowed back out, so you only need to set inbound rules.

You should see a success banner confirming your instance is launching. Before you check on it, what do you think the instance's state will be when you first see it on the Instances page?

Click the instance ID link in the success banner to go to the Instances page.
Wait for the Instance state column to change from Pending to Running. Click the refresh icon above the table if the state does not update after a minute.
Confirm your instance shows a Public IPv4 address in its details. You will need this address to connect later.

Instance stuck in Pending?

It can take 1-2 minutes for a new instance to reach the Running state. Click the refresh icon above the instances table to check again.

If the instance moves to a Stopped or Terminated state instead, your account may have a service quota or Free Tier issue. Check that your account is fully activated and try launching again.

Still stuck? Help me troubleshoot why my EC2 instance won't start.

Your EC2 instance is live in the cloud. Next up, you will connect to it from your Mac's terminal using SSH.

Connect to Your Instance via SSH

Your EC2 instance is running in the cloud, but right now you have no way to interact with it.

SSH is a protocol that lets you open a terminal session on a remote server. In this step, you'll use it to connect to your instance from your Mac and get a command prompt directly on the machine.

In this step, get ready to:

Secure your key pair file so SSH accepts it.
Connect to your EC2 instance and get a command prompt on the server.

Open Terminal and secure your key file

SSH refuses to use a private key file if its permissions are too open. Before connecting, you need to lock down the .pem file you downloaded in Step 1.

Press Cmd+Space to open Spotlight search.
Type Terminal and press Enter to open it.
Secure your key file by running this command:

chmod 400 ~/Downloads/my-ec2-key.pem

What does this command do?

chmod 400 sets the file to read-only for you and removes all access for anyone else. SSH requires this restriction. If the key file is readable by other users on your system, SSH refuses to use it as a security precaution.

Confirm the permissions changed by running:

ls -l ~/Downloads/my-ec2-key.pem

You should see -r-------- at the start of the output. This means only you can read the file.

File not found?

Make sure my-ec2-key.pem is in your ~/Downloads folder. If your browser saved it elsewhere or you moved it, adjust the path in the command.
If you accidentally deleted the file, you'll need to go back to the EC2 console, delete the old key pair, and create a new one. The .pem file can only be downloaded once at creation time.
Help me find my .pem key file on my Mac.

Connect to your instance

The EC2 console generates a ready-made SSH command with the correct address for your instance. You'll grab it from there and run it in Terminal.

Switch back to the EC2 console in your browser.
Select your my-web-server instance by clicking its checkbox on the Instances page.
Click the Connect button at the top of the page.
Click the SSH client tab.

What is on this page?

The SSH client tab shows step-by-step instructions for connecting, including the exact command you need. The Example section at the bottom contains a pre-built ssh command customized with your instance's public DNS address.

Before you run the SSH command, think about what you expect to see. Will the connection succeed immediately, or will SSH ask you something first?

Switch back to your Terminal.
Connect to your instance by running the SSH command below. Replace the public DNS placeholder with the value shown in the Example section of the SSH client tab:

ssh -i ~/Downloads/my-ec2-key.pem ec2-user@[[EC2_PUBLIC_DNS="your instance's Public DNS from the SSH client tab"]]

What does this command do?

ssh starts a Secure Shell connection to the remote server.
-i ~/Downloads/my-ec2-key.pem tells SSH which private key file to use for authentication.
ec2-user is the default username on Amazon Linux instances.
The address after @ is your instance's public DNS, which uniquely identifies the server on the internet.

When you see the message asking if you are sure you want to continue connecting, type yes and press Enter.

Why does SSH ask if I want to continue?

The first time you connect to any new server, SSH doesn't recognize it yet. It shows the server's fingerprint and asks you to confirm that you trust it. Typing yes saves the server's identity to your Mac so SSH won't ask again for this instance.

You should see the Amazon Linux 2023 welcome banner with ASCII art, followed by a [ec2-user ~]$ prompt. You are now logged into your EC2 instance.

Connection timing out or refused?

Double-check that you copied the full public DNS from the SSH client tab. A missing or extra character causes the connection to fail.
Confirm your instance's state is Running in the EC2 console. If it is still initializing, wait a minute and try again.
If you see a "Permission denied" error, make sure you ran chmod 400 on the correct .pem file and that the path in your command matches where the file is stored.
If you see "WARNING: UNPROTECTED PRIVATE KEY FILE", the chmod 400 command did not apply. Run it again on the correct file path.
Help me troubleshoot my SSH connection to EC2.

You now have a direct command line on your EC2 instance. Next up, you'll install a web server and create a page that anyone can visit.

Install a Web Server and Create Your Page

You have a live terminal session on your EC2 instance. Now it's time to put that server to work.

In this step, you'll install Apache, the world's most widely used web server software, and create a custom web page. Along the way, you'll discover something important about how AWS controls network traffic to your instance.

In this step, get ready to:

Install and start the Apache web server on your instance.
Create a custom HTML page and verify it's being served.
Discover how security groups control which traffic reaches your server.

Install and start Apache

Your EC2 instance is a blank Linux server right now. It can receive SSH connections, but it has no software to serve web pages to browsers.

Apache (also known as httpd) is a web server that listens for incoming requests and responds with web page content. You need to install it before your instance can serve anything.

Install Apache by running this command in your SSH session:

sudo dnf install -y httpd

What does this command do?

sudo runs the command with administrator privileges.
dnf is the package manager for Amazon Linux 2023. It handles downloading and installing software.
install -y httpd installs the Apache web server package and automatically confirms any prompts.

You'll see a stream of output as packages download and install. Look for Complete! at the end to confirm the install succeeded.

Seeing an error?

Make sure you're running this inside your SSH session on the EC2 instance, not in your local Mac terminal. Your prompt should show [ec2-user ~]$, not your Mac username.

Help me troubleshoot installing httpd on my EC2 instance.

Apache is installed, but it isn't running yet. You need to start it and tell the system to launch it automatically on future reboots.

Start the Apache web server by running:

sudo systemctl start httpd

Enable Apache to start automatically on future reboots by running:

sudo systemctl enable httpd

Why two separate commands?

start launches Apache right now, in your current session.

enable tells the system to start Apache automatically after any future reboots. Without it, you'd need to manually start the server every time your instance restarts.

Confirm Apache is running by checking its status:

sudo systemctl status httpd

You should see Active: active (running) in the output. This confirms Apache is up and listening for requests.

Press q to exit the status view and return to your command prompt.

Create a custom web page

Apache is running, but it has no content to serve yet. Web servers look for files in a specific directory called the document root. On Amazon Linux, that directory is /var/www/html/.

Create your web page by running this command:

echo '<html><body><h1>Hello from EC2!</h1><p>I launched this server myself.</p></body></html>' | sudo tee /var/www/html/index.html

What does this command do?

echo outputs the HTML content you typed.
The pipe (|) sends that output to the next command.
sudo tee /var/www/html/index.html writes the content to a file called index.html in Apache's document root, using administrator privileges. It also prints the content to your terminal so you can confirm what was written.

You should see the HTML content echoed back to your terminal. Now let's confirm Apache is actually serving it.

Verify Apache is serving your page by running:

curl http://localhost/

You should see your HTML content printed in the terminal. That confirms Apache received the request and responded with your page.

Seeing a connection refused error?

This means Apache isn't running. Try starting it again with sudo systemctl start httpd and then re-run the curl command.

Help me troubleshoot why curl localhost is not returning my page on EC2.

Try accessing your page from a browser

Your web page works inside the instance. The real test is whether the rest of the internet can see it too.

Before you try, think about this: your security group currently allows SSH traffic on port 22. Apache serves web pages over HTTP on port 80. Do you think the page will load in your browser?

Switch back to the EC2 console in your browser.
Select your my-web-server instance on the Instances page.
Copy the Public IPv4 address from the instance details panel at the bottom.
Open a new browser tab and navigate to http:// followed by your instance's Public IPv4 address.

The page does not load. Your browser spins and eventually times out.

This is expected. Your security group only has one inbound rule: SSH on port 22. HTTP traffic on port 80 is completely blocked, so the request never reaches Apache.

What is a security group?

A security group is a virtual firewall for your EC2 instance. It controls which traffic is allowed in (inbound rules) and which traffic is allowed out (outbound rules).

Right now, your security group has a single inbound rule that permits SSH connections on port 22. Web browsers use HTTP on port 80, and there's no rule to permit that traffic. The request hits the firewall and gets silently dropped.

Your web server is installed and your page is ready to go. The only thing standing between you and a live website is the security group. In the next step, you'll add the rule that opens the door.

Open HTTP Traffic and See Your Page Live

Your web page is working inside the instance, but the outside world cannot reach it. When you visited the public IP in your browser, the connection timed out.

The security group attached to your instance is the gatekeeper blocking HTTP traffic. In this step, you will add an inbound rule to open port 80 and bring your page online.

In this step, get ready to:

Edit the security group to allow HTTP traffic on port 80.
View your custom web page live in a browser using the instance's public IP address.

Open your instance's security group settings

The security group controls which types of traffic can reach your instance. Right now, the only inbound rule allows SSH traffic on port 22. There is no rule for HTTP on port 80, which is why your browser cannot connect.

Return to the EC2 console in your browser.
Click Instances in the left sidebar to open the Instances page.
Select your my-web-server instance by clicking its checkbox.
Scroll down to the Security tab in the details panel below.
Click on the security group link (it starts with sg-).
Click Edit inbound rules.

You should see one existing rule listed: the SSH rule on port 22 that was created when you launched the instance.

Add an HTTP inbound rule

Click Add rule.
Set Type to HTTP.

The Port range and Protocol fields automatically fill in with 80 and TCP.

Set Source to Anywhere-IPv4 (0.0.0.0/0).
Click Save rules.

You should now see two inbound rules listed: the original SSH rule on port 22 and your new HTTP rule on port 80.

What does this rule do?

Setting the Type to HTTP opens port 80 for incoming web traffic. This is the standard port that browsers use when you visit an http:// URL.

Setting the Source to 0.0.0.0/0 means any device on the internet can send HTTP requests to your instance. This is standard for a public web server where you want anyone to be able to visit your page.

See your page live on the internet

The last time you tried visiting your instance's public IP in the browser, the page timed out. Now that you have added the HTTP rule, what do you expect to see this time?

Return to the EC2 Instances page and find your instance's Public IPv4 address in the details panel.
Open a new browser tab.
Type http:// followed by your instance's Public IPv4 address into the address bar and press Enter.

Your "Hello from EC2!" page is now live on the internet. Anyone with the IP address can see it.

Why did one rule change everything?

Security groups act as firewalls for your EC2 instance. They block all traffic by default. Without an explicit inbound rule for HTTP, every web request was silently dropped before it could reach Apache.

Security groups are also stateful. Once you allow inbound HTTP traffic, the responses back to the browser are automatically allowed outbound. You only needed to add one rule.

Page still not loading?

Check that the inbound rule's Source is set to Anywhere-IPv4 (0.0.0.0/0), not a specific IP address.
Make sure you are using http:// in the URL, not https://. Apache is not configured for HTTPS in this project.
Confirm that your instance's Instance state still shows Running on the Instances page. A stopped instance will not respond.

Still stuck? Why can't I see my web page even after adding the HTTP inbound rule?

Secret mission

Tighten Security and Add a Second Page

Your web server is live, but its security group allows SSH from anywhere on the internet. In production, that is a risk. Can you create a custom security group with tighter rules and deploy a second page?

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Your EC2 instance consumes Free Tier hours while it runs, so review the options below to avoid any surprise charges.

Cost warning

A running EC2 instance consumes Free Tier hours even when you are not using it. Accounts created before July 15, 2025 receive 750 hours/month of t2.micro or t3.micro for 12 months. Accounts created on or after July 15, 2025 receive credits that last up to 6 months.

If you are done with this project, terminating the instance is the safest way to ensure no charges accumulate.

Resources you used:

EC2 instance my-web-server (t2.micro or t3.micro, Free Tier eligible). Running this instance consumes Free Tier hours.
EBS volume attached to the instance. Free Tier includes up to 30 GB of gp2/gp3 storage.
Key pair my-ec2-key (in the EC2 console and as a local .pem file on your Mac). No cost.
Security group web-server-sg (attached to your instance). No cost.
Security group launch-wizard (detached, still exists in the console). No cost.

Keep everything running

No action needed. Choose this if you are still actively building or want to keep exploring your instance.

Your instance continues running and consuming Free Tier hours.
Monitor your Free Tier usage in the AWS Billing console to avoid surprise charges.
Your my-ec2-key.pem file remains in your ~/Downloads/ folder.

Pause - I'll come back to this later

Stop your instance to pause compute charges while keeping your files and configuration intact.

In the EC2 console, select your my-web-server instance.
Click Instance state at the top of the page.
Choose Stop instance and confirm.

Compute charges stop immediately. The EBS volume persists and continues consuming storage, which is free under Free Tier limits. You can restart the instance later by selecting it and choosing Instance state then Start instance.

Delete - I don't want to use this again

Remove all project resources permanently. This is recommended for this project since you can always launch a new instance.

Terminate the instance:

In the EC2 console, select your my-web-server instance.
Click Instance state, then choose Terminate instance. Confirm the termination.
This permanently deletes the instance and its attached EBS volume. No further compute or storage charges apply.

Delete the key pair:

In the EC2 console left sidebar, click Key Pairs under Network & Security.
Select my-ec2-key, click Actions, then choose Delete. Confirm the deletion.

Delete the security groups:

Wait for the instance to reach the "Terminated" state. You cannot delete a security group while it is still associated with an instance.
In the left sidebar, click Security Groups under Network & Security.
Select the web-server-sg security group, click Actions, then choose Delete security groups. Confirm.
Repeat for the launch-wizard security group.

Delete the local key file:

Delete the .pem file from your Mac by running this command in Terminal:

rm ~/Downloads/my-ec2-key.pem

Nice Work!

You just launched a virtual server in the cloud, connected to it over SSH, and served a live web page that anyone on the internet can visit. That is real cloud infrastructure, built and configured by you.

You've learned how to:

Launch an EC2 instance and connect to it from your terminal using a key pair for secure SSH access.
Install Apache on a Linux server and serve a custom web page from your instance's public IP address.
Configure security groups to control which traffic reaches your instance, experiencing firsthand how they act as gatekeepers by hitting an HTTP block and then fixing it.
Secret Mission: Create a custom security group with tighter SSH restrictions and deploy a second page on your server.

Ready to quiz yourself?