Launch and Secure a Virtual Server

Launch a Linux server on AWS, connect via SSH, and lock it down with firewall rules.

Introduction

30 Second Summary

Every website you visit, every app you open, and every file you store online runs on a server somewhere in the world. Cloud administrators are the people who launch, secure, and manage those servers.

In this project, you will launch your own Linux server on AWS, connect to it remotely from your Windows machine, lock it down with firewall rules, and set up cost monitoring alerts.

What You'll Build

A fully configured cloud server running Amazon Linux on AWS, secured with custom firewall rules and monitored with a cost budget alert.

By the end of this project, you'll have:

  • A running EC2 instance that you launched and configured in the AWS cloud.
  • A secure SSH connection from your Windows machine to the remote server.
  • Custom security group rules that restrict access to only your IP address, plus an AWS Budgets alert to track your Free Tier credit usage.
  • Secret Mission: Install a web server and serve a live web page from your cloud instance.

Are there any prerequisites?

You need a Windows computer and an AWS account created after July 15, 2025 (which comes with $100 in Free Tier credits). This project costs nothing to complete thanks to those credits.

Set Up Your Environment

Before you can launch a server in the cloud, you need two things ready on your local machine.

First, you need OpenSSH so you can connect to your cloud server remotely. Second, you need the AWS Management Console open and pointed at the right region. This step gets both of those ready.

In this step, get ready to:
  • Verify that OpenSSH is installed on your Windows machine.
  • Sign into the AWS Management Console.
  • Open the EC2 Dashboard where you will launch your server.
Verify OpenSSH is installed on Windows

SSH is the protocol you will use to connect to your cloud server from your Windows machine. Modern Windows includes an OpenSSH client as a built-in optional feature, so most learners already have it.

  • Press the Windows key to open your search bar.
  • Type PowerShell and press Enter to open it.
  • Check if OpenSSH is installed by running this command:
ssh

Look at the output in your terminal and pick the tab below that matches what you see.

✔️ I see usage information

You should see output that starts with a line like:

usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] ...

OpenSSH is installed and working. You are ready to move on.

ⓧ 'ssh' is not recognized

If you see an error mentioning that the term is not recognized, OpenSSH is not installed yet. Follow the steps below to install it.

  • Close your current PowerShell window.
  • Press the Windows key, type PowerShell, then right-click Windows PowerShell and select Run as administrator.
  • Install the OpenSSH client by running this command:
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

What does this command do?

This tells Windows to download and enable the OpenSSH client feature. The long string of tildes and the version number is the exact feature name Windows uses internally.

  • After the install finishes, close the Administrator PowerShell window.
  • Open a new regular PowerShell window (press the Windows key, type PowerShell, and press Enter).
  • Verify the installation by running:
ssh

You should now see usage information listing available SSH options. This confirms OpenSSH is ready.

Still seeing 'ssh' is not recognized?

Make sure you opened a brand-new PowerShell window after installing. Existing windows do not pick up newly installed commands.

If you are running a 32-bit (x86) version of PowerShell, it cannot see the 64-bit OpenSSH folder. Search for Windows PowerShell (without "x86" in the name) and try again.

help me troubleshoot why ssh is not recognized in my PowerShell

Log into the AWS Management Console

The AWS Management Console is the web-based control panel where you manage all your cloud resources. You need to be signed in and set to the correct region before launching any services.

  • Open your web browser and navigate to https://console.aws.amazon.com/.
  • Sign in with your AWS account credentials.
  • Look at the top-right corner of the console navigation bar. You should see a region name displayed there.
  • Click the region name and select US East (N. Virginia) us-east-1 from the dropdown list.

Why us-east-1?

AWS has data centers around the world grouped into regions. us-east-1 is the most commonly used region for learning because it typically has the broadest Free Tier support and the most services available.

Navigate to the EC2 Dashboard

EC2 (Elastic Compute Cloud) is the AWS service that lets you launch virtual servers. The EC2 Dashboard is where you will create and manage your server instance.

  • Click the search bar at the top of the AWS Console.
  • Type EC2 and select EC2 from the results.
  • Confirm you can see the EC2 Dashboard with the Launch instance button visible.

What is EC2?

EC2 stands for Elastic Compute Cloud. It provides resizable virtual servers (called instances) in the cloud. You can think of each instance as a computer that lives in an AWS data center instead of on your desk.

Your local environment is ready and your AWS Console is pointed at the right region. Next up, you will launch your first cloud server.

Launch Your EC2 Instance

Your development environment is ready. Now it's time to launch your first virtual server in the cloud.

In AWS, a virtual server is called an EC2 instance. To connect to it securely, you'll first create a key pair that acts like a digital lock and key. Then you'll launch the instance itself using the EC2 launch wizard.

In this step, get ready to:
  • Create an RSA key pair for secure SSH authentication.
  • Launch an EC2 instance running Amazon Linux.
  • Verify the instance is running and note its public address.
Create a key pair for SSH access

Before you can connect to a server remotely via SSH, you need a way to prove your identity. A key pair is a set of two matched cryptographic keys. AWS keeps the public key on the server, and you keep the private key on your computer.

  • In the EC2 console left navigation pane, under Network & Security, choose Key Pairs.
  • Choose Create key pair.
  • For Name, enter my-server-key.
  • For Key pair type, choose RSA.
  • For Private key file format, choose .pem.
  • Choose Create key pair.

Your browser automatically downloads a file called my-server-key.pem. This is your private key. You will use it every time you connect to your server.

  • Create a new folder on your computer to store the key, for example C:\Users\YourName\keys\.
  • Move the downloaded my-server-key.pem file from your Downloads folder into this new keys folder.

What is a key pair?

A key pair consists of a public key and a private key. Think of it like a house lock. AWS installs the lock (public key) on your server. You hold the only key (private key) that can open it.

Anyone who has your private key file can access your server. Keep it safe and never share it.

Why .pem and RSA?

The .pem format works directly with the OpenSSH client you verified in Step 1. RSA has the broadest compatibility with Windows OpenSSH, avoiding potential edge-case issues.

Don't see the downloaded file?

Check your browser's default Downloads folder. The file is named my-server-key.pem. This is the only time AWS lets you download this file. If you lose it, you'll need to create a new key pair.

Help me find my downloaded .pem key file

Launch the instance

Now you'll use the EC2 launch wizard to create your virtual server. The wizard walks you through choosing an operating system, hardware size, and network settings.

  • In the left navigation pane, choose EC2 Dashboard to return to the main dashboard.
  • Choose Launch instance.
  • Under Name and tags, for Name, enter my-first-server.
  • Under Application and OS Images (Amazon Machine Image), choose Quick Start, then choose Amazon Linux.
  • From the Amazon Machine Image (AMI) dropdown, select an AMI that is marked Free tier eligible.
  • Under Instance type, choose t3.micro (marked Free tier eligible).
  • Under Key pair (login), select my-server-key from the dropdown.
  • Under Network settings, keep the default VPC and subnet.
  • Under Firewall (security groups), keep Allow SSH traffic from selected with Anywhere (0.0.0.0/0).
  • Choose Launch instance.

What is an AMI?

An AMI (Amazon Machine Image) is a template that contains the operating system and software your server starts with. Choosing Amazon Linux gives you an AWS-optimized Linux distribution that works smoothly with other AWS services.

Why allow SSH from Anywhere for now?

Setting the security group to allow SSH from 0.0.0.0/0 lets you connect from any network. This gets you connected quickly. In Step 4, you'll lock this down to only your IP address for proper security.

Verify the instance is running

After launching, your instance takes a short time to boot up. You'll confirm it's healthy and grab the address you'll use to connect.

  • Click the instance ID link in the green success banner at the top of the page.
  • Wait for Instance state to change from Pending to Running.
  • Wait for Status check to show 2/2 checks passed.
  • Click the Details tab below.
  • Find the Public IPv4 DNS value and copy it somewhere safe (like a sticky note or text file). You'll need this to connect in the next step.

What should I see?

The Public IPv4 DNS looks something like ec2-3-85-123-456.compute-1.amazonaws.com. This is the public address of your server on the internet. Without it, you have no way to reach your instance from your Windows machine.

Instance stuck in Pending?

It's normal for an instance to take 1-2 minutes to reach the Running state. Click the refresh icon in the instances table header to update the status. If it stays in Pending for more than 5 minutes, there may be a capacity issue in your region.

My instance is stuck and won't start running

Your server is live in the cloud. Next up, you'll connect to it directly from your Windows machine using SSH.

Connect to Your Server from Windows

Your server is running in the cloud, but right now it's just a machine sitting in an AWS data center. To actually use it, you need to connect to it remotely from your Windows machine.

SSH (Secure Shell) creates an encrypted connection between your computer and the server. The key pair you created earlier acts as your proof of identity. In this step, you'll set up your key file, connect to the server, and run a few commands to explore what's running.

In this step, get ready to:
  • Set file permissions on your private key so Windows allows SSH to use it.
  • Connect to your EC2 instance via SSH from PowerShell.
  • Run basic Linux commands to explore your server.
Set file permissions on the private key

SSH refuses to use a private key file if other users on your computer could read it. You need to lock down your my-server-key.pem file so that only your Windows account has access.

  • Open File Explorer and navigate to the folder where you saved my-server-key.pem (e.g., C:\Users\YourName\keys\).
  • Right-click the my-server-key.pem file and select Properties.
  • Click the Security tab.
  • Click Advanced.
  • Click Disable inheritance.
  • Choose Remove all inherited permissions from this object.
  • Click Add.
  • Click Select a principal.
  • Type your Windows username into the text field, then click OK.
  • Check the Full control checkbox, then click OK.
  • Click OK on all remaining dialogs to save your changes.

Why do these permissions matter?

Your private key is like a physical door key to your server. If other accounts on your Windows machine could read it, anyone using those accounts could access your server.

SSH enforces this rule automatically. If the file permissions are too open, SSH shows a "WARNING: UNPROTECTED PRIVATE KEY FILE" error and refuses to connect.

Can't find the Security tab?

Make sure you right-clicked the .pem file itself (not the folder containing it). The Security tab appears in the file's Properties dialog.

If the Security tab is missing entirely, your Windows edition may not support per-file permissions. Help me troubleshoot my .pem file permissions on Windows.

Connect via SSH from PowerShell

With permissions set, you can now use PowerShell and the ssh command to connect to your EC2 instance.

  • Press the Windows key to open your search bar.
  • Type PowerShell and press Enter to open it.
  • Connect to your instance by running this command:
ssh -i "[[PEMPATH=\"C:\\Users\\YourName\\keys\\my-server-key.pem\"]]" ec2-user@[[EC2DNS=\"your instance Public IPv4 DNS\"]]

What does this command do?

  • ssh starts a Secure Shell connection.
  • -i tells SSH which private key file to use for authentication.
  • ec2-user is the default username for Amazon Linux instances.
  • The part after @ is your instance's public address, which you noted from the EC2 Dashboard in the previous step.

You'll see a fingerprint prompt

The first time you connect, SSH displays a message saying the authenticity of the host can't be established and asks:

Are you sure you want to continue connecting (yes/no)?

Type yes and press Enter. This adds your server to your computer's list of known hosts so you won't be asked again.

You should see the Amazon Linux welcome banner and a command prompt ending in $. You are now logged into your cloud server.

Connection timed out or refused?

  • Double-check that you copied the full Public IPv4 DNS from the EC2 console (it looks like ec2-XX-XX-XX-XX.compute-1.amazonaws.com).
  • Confirm your instance state is running (not stopped or terminated) in the EC2 Dashboard.
  • Make sure you wrapped the path to your .pem file in quotes if it contains spaces.

Help me troubleshoot my SSH connection to EC2 from Windows PowerShell.

Explore your server

You're now logged into a real Linux server running in the cloud. Let's run a few commands to see what's happening on it.

  • Explore your server by running these commands one at a time:
# See your server's hostname
hostname

# Check how long the server has been running
uptime

# View available memory
free -h

# Check disk space
df -h

What are these commands showing you?

  • hostname displays your server's internal name (assigned by AWS).
  • uptime shows how long the server has been running since launch.
  • free -h displays available RAM in human-readable format.
  • df -h shows disk partitions and how much storage is used.
  • When you're done exploring, disconnect from the server by running:
exit

Your PowerShell prompt returns to your local Windows machine. You are no longer connected to the remote server.

Commands not working?

Make sure your prompt shows [ec2-user@...] before you type the commands. If you see your normal Windows prompt, you're not connected to the server yet. Re-run the ssh command from the previous substep.

Help me run commands on my EC2 instance after connecting via SSH.

You've just proven that you can reach your cloud server from your Windows machine. Next up, you'll lock down the firewall rules so that only your IP address can connect.

Secure Your Server with Firewall Rules

In the previous step, you connected to your server from PowerShell using SSH. That connection worked because the server's firewall currently allows SSH traffic from any IP address on the internet.

That open-door policy is fine for getting started, but it means anyone who discovers your server's address could attempt to connect. In this step, you will lock down access so that only your computer can reach the server.

In this step, get ready to:
  • Restrict SSH access to your IP address only.
  • Test that you can still connect after the rule change.
  • Confirm the security group configuration.
Restrict SSH access to your IP address only

A security group acts as a virtual firewall for your instance. Right now, the inbound rule allows SSH from 0.0.0.0/0, which means the entire internet.

  • Return to the EC2 Console in your browser.
  • In the instance list, select your my-first-server instance.
  • Click the Security tab in the lower panel.
  • Click the security group link (it starts with sg-).
  • Under Inbound rules, choose Edit inbound rules.
  • For the existing SSH rule, click the Source dropdown (currently showing Anywhere-IPv4).
  • Select My IP.
  • Choose Save rules.

What did My IP do?

When you select My IP, AWS automatically detects your current public IPv4 address and fills it in with a /32 suffix. The /32 means "this single IP address only."

Your server now rejects SSH connections from every other address on the internet. Only traffic originating from your computer is allowed through.

Why start open, then restrict?

Starting with Anywhere let you connect quickly without debugging firewall issues. Now that you know the connection works, restricting to My IP teaches you the security best practice through direct contrast.

In production, you would never leave SSH open to the entire internet.

Test the restricted access

The rule change takes effect immediately. Let's confirm that your computer is still allowed through.

  • Switch back to PowerShell.
  • Reconnect to your server by running this command:
ssh -i [[PEMPATH="C:\Users\YourName\keys\my-server-key.pem"]] ec2-user@[[EC2_DNS="your instance Public IPv4 DNS"]]
  • When prompted to continue connecting, type yes and press Enter.

What should I see?

You should see the Amazon Linux welcome banner and a command prompt, just like before. This confirms your IP address is whitelisted in the security group.

  • Type exit and press Enter to disconnect from the server.

Connection timed out?

If your SSH command hangs or times out, your IP may have changed since you saved the rule. This happens if you switched Wi-Fi networks or your ISP assigned a new IP.

Go back to the security group's Inbound rules, choose Edit inbound rules, and select My IP again to update it.

Need more help? Why can't I connect after restricting my security group to My IP?

Confirm what you configured

Now let's verify the rule looks correct in the console.

  • Return to the security group's Inbound rules tab in your browser.
  • Confirm the SSH rule now shows your specific IP address followed by /32 in the Source column.
  • Click the Outbound rules tab.
  • Notice it still shows All traffic to 0.0.0.0/0.

Why allow all outbound traffic?

Outbound rules control traffic leaving your server (software updates, API calls, responses to your SSH session). Allowing all outbound traffic is the default and is safe for most use cases.

The critical restriction is on inbound rules, which control who can initiate a connection to your server.

Your server is now locked down to your IP address only. Next up, you'll set up cost monitoring so you always know how your AWS credits are being used.

Set Up Cost Monitoring with AWS Budgets

Your server is running and locked down with custom firewall rules. The next priority is making sure you never get surprised by unexpected charges.

AWS Budgets lets you set a spending threshold and receive email alerts when your credits start running low. Without monitoring, you could accidentally leave resources running and burn through your $100 in Free Tier credits without realizing it.

In this step, get ready to:
  • Navigate to the AWS Budgets console.
  • Create a monthly cost budget with email alerts.
  • Verify your budget is active and tracking your credits.
Navigate to AWS Budgets

AWS Budgets lives under the Billing and Cost Management section of the console. You can reach it directly from the search bar.

  • In the AWS Console search bar at the top, type Budgets.
  • Select AWS Budgets (listed under Billing and Cost Management).
  • Choose Create budget.

You should see the budget setup page with options for templates and custom configurations.

Can't find AWS Budgets?

Make sure you're typing Budgets in the top search bar (not the EC2 search). If you don't see results, try navigating directly by clicking your account name in the top-right corner, then selecting Billing and Cost Management.

Help me find AWS Budgets in my console.

Create a monthly cost budget

AWS provides a simplified template designed for accounts with Free Tier credits. This template pre-configures alert thresholds so you get emailed as your credits decrease.

  • Under Budget setup, choose Use a template (simplified).
  • Select Monthly cost budget.
  • For Budget name, enter My Free Tier Budget.
  • For Budgeted amount, enter 100 (this matches your $100 sign-up credits).
  • For Email recipients, enter your email address.
  • Choose Create budget.

Why $100 as the budgeted amount?

AWS gives accounts created after July 15, 2025 a total of $100 in Free Tier credits at sign-up. Setting your budget to $100 means you'll get alerts as you use up portions of your total allowance.

Your Free account plan will not incur any charges during the 6-month period until you upgrade to a paid account plan. The budget alerts help you track how fast your credits are being consumed.

Seeing an error when creating the budget?

Double-check that you entered a valid email address in the Email recipients field. Also confirm that the budgeted amount is just the number 100 without a dollar sign.

Help me troubleshoot creating my AWS Budget.

Verify your budget is active

After creating the budget, AWS returns you to the Budgets list. This is where you confirm everything is set up correctly.

  • Confirm you can see My Free Tier Budget in the Budgets list.
  • Check that the Budgeted amount column shows $100.00.

When will I get email alerts?

AWS will send you email alerts when 50%, 25%, or 10% of your credits remain. This gives you three warning points before your credits run out.

AWS also sends notifications when you have 15 days, 7 days, and 2 days left in your 6-month free period. These time-based alerts ensure you know when your Free Tier window is closing, even if you haven't spent much.

Secret mission

Install a Web Server and Serve a Live Page

Your server is secured and monitored. But right now it just sits there, invisible to the world. In this secret mission, you will install a web server, write a custom HTML page, and make it accessible to anyone with a browser. Your cloud instance becomes a real, live website.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Your EC2 instance uses Free Tier credits while in the "running" state, so always stop or terminate it when you are not actively using it.

Cost warning

If you leave your instance running 24/7 for a month, it uses approximately $7.50 of your $100 credits. A stopped instance pauses compute charges but continues a small EBS storage charge. Always stop or terminate when not actively experimenting.

Resources you used:

  • EC2 instance (my-first-server, t3.micro) — uses Free Tier credits while running.
  • Key pair (my-server-key) and local .pem file.
  • Security group (custom inbound rules for SSH and HTTP).
  • AWS Budget (My Free Tier Budget).

Keep everything running

No action needed. Choose this if you are still actively building or plan to continue experimenting with your server today.

  • Your instance continues using credits while in the "running" state. A t3.micro costs roughly $0.0104/hour.
  • With $100 in sign-up credits and a 6-month window, you have plenty of runway for experimentation.
  • Your AWS Budget will email you when credits reach 50%, 25%, or 10% remaining.
  • OpenSSH remains installed on your Windows machine. This is a built-in Windows capability and does not need removal.

Pause - I'll come back to this later

Stop your instance to pause compute charges. Your server's data and configuration are preserved, and you can restart it later.

  • In the EC2 console, choose Instances in the navigation pane.
  • Select your my-first-server instance.
  • Choose Instance state, then Stop instance.
  • Choose Stop when prompted for confirmation.
  • A small EBS storage charge continues while the instance is stopped, but compute charges pause entirely.
  • To restart later, select the instance and choose Instance state, then Start instance.

Delete - I don't want to use this again

Remove all project resources permanently. Choose this when you are done experimenting and want to stop all charges.

Terminate the EC2 instance:

  • In the EC2 console, choose Instances in the navigation pane.
  • Select your my-first-server instance.
  • Choose Instance state, then Terminate (delete) instance.
  • Choose Terminate (delete) when prompted for confirmation.
  • The instance will briefly show as "terminated" in the console, then disappear automatically.

Delete the key pair from AWS:

  • In the EC2 console navigation pane, under Network & Security, choose Key Pairs.
  • Select my-server-key.
  • Choose Actions, then Delete.
  • Confirm the deletion.

Delete the local .pem file:

  • Open File Explorer and navigate to the folder where you saved my-server-key.pem (e.g., C:\Users\YourName\keys\).
  • Right-click the file and choose Delete.

Delete the security group:

  • Wait until the instance state shows "terminated" (this releases the security group).
  • In the EC2 console navigation pane, under Network & Security, choose Security Groups.
  • Select the security group you created during this project (the one with your SSH and HTTP rules).
  • Choose Actions, then Delete security groups.
  • Confirm the deletion.

Delete the AWS Budget:

  • In the AWS Console search bar, type "Budgets" and select AWS Budgets.
  • Select My Free Tier Budget.
  • Choose Actions, then Delete.
  • Confirm the deletion.

Why keep the budget?

You may want to keep your AWS Budget active even after deleting the instance. It costs nothing (the first two budgets are free) and will continue alerting you if any other AWS usage generates charges on your account.

Nice Work!

Nice Work!

Nice work! You just launched, connected to, and secured your own Linux server running in the AWS cloud. That is the foundational skill behind every cloud administrator role.

You learned how to:

  • Launch a Linux server (EC2 t3.micro) on AWS and connect to it remotely from Windows using SSH in PowerShell.
  • Secure the server with custom security group firewall rules that restrict access to your IP address only.
  • Set up AWS Budgets to monitor your Free Tier credit usage with automatic email alerts.
  • Secret Mission: Installed Apache HTTP Server and served a custom web page from your cloud instance.

Ready to quiz yourself?