Lightsail is simple because it decides for you. EC2 is the opposite: the "Launch instance" form asks about everything, with names that only make sense to someone who has done it before. The good news is that for a normal server only five decisions matter and the rest can be left at the defaults. This guide walks through the form from top to bottom saying what to put and why.
Before you start: what each thing means
- EC2
- Amazon's "made-to-measure" servers, paid for by the hours they are running. More flexible than Lightsail, with more to decide.
- Instance
- What AWS calls each machine. Launching an instance is creating and starting a machine.
- AMI (image)
- The operating system the machine boots with: Ubuntu, Amazon Linux, Debian, Windows... or an image of your own.
- Instance type
- The size: how many processors and how much memory. It is named with letters and numbers (t3.small, m6i.large). The letter is the family; the end, the size.
- Key pair
- The key for logging into the machine via SSH. You create it once, download the file and keep it: it cannot be downloaded again.
- Security group
- The machine's firewall: which ports are open and for whom. It is created in the same form.
- EBS
- The machine's disk. You choose size and type; gp3 is the normal one.
- VPC and subnet
- The private network where the machine lives. The account comes with a default one that is fine to start with.
Step by step
Name and image
EC2 console, correct region at the top right, Launch instance. Give it a name that says what it is (
web-tienda). Under Application and OS Images, for a web server choose Ubuntu (latest LTS version) or Amazon Linux; if you are going to follow tutorials from the internet, Ubuntu has more of them. Check that the architecture is 64-bit (x86) unless you deliberately choose an ARM type (Graviton), cheaper but not compatible with all software.Instance type
To start with, the t3 family (or t4g if you chose ARM): they are "burstable" machines, cheap, that can run flat out for a while. t3.micro to try things out, t3.small for a small website, t3.medium if it carries a database and some traffic. It can be changed later by stopping the machine, so don't stress: start small.
Key pair
If it is your first machine, Create new key pair: name (
clave-web-2026), type ED25519, format .pem. When you create it a file is downloaded: keep it somewhere safe, because it is the only copy and without it you won't get into the machine. If you already have a key from another machine, you can reuse it.Network settings (firewall)
Leave the default VPC and subnet and Auto-assign public IP: Enable. Under Firewall, choose Create security group, name it (
sg-web) and tick the boxes Allow SSH traffic from with My IP (not "Anywhere"), and Allow HTTPS traffic and HTTP traffic from the internet. With that the website is public and the administration door only opens from your connection.Disk
Under Configure storage, the root disk comes with a small size. Raise it to what you need (20 or 30 GB for a normal website) and type gp3. Expand "Advanced" and check that Delete on termination is enabled for the root disk (so no orphan disk is left being charged if you delete the machine) and, if the data matters, enable encryption. It can be grown later without reinstalling.
Launch and do the three things that come after
Review the summary on the right and Launch instance. In a minute it will be "Running". Do three things straight away: assign it an Elastic IP (Elastic IPs menu, Allocate, Associate) so the address doesn't change on reboot; connect via SSH with
ssh -i clave-web-2026.pem ubuntu@IPand update the system; and create a status check alarm so you find out if it goes down (guide in this section).
What can go wrong
I can't get in via SSH
Three causes, in order: the security group allows SSH from "My IP" and your IP has changed (edit it); the user is not the right one (ubuntu on Ubuntu, ec2-user on Amazon Linux, admin on Debian); or the key file has permissions that are too open (chmod 400 clave.pem).
I have lost the key file
It cannot be downloaded again. For a freshly created machine, the quickest thing is to terminate it and create another. For one with data, create an image (AMI) and launch a new machine from it choosing a new key.
The website doesn't load even though the machine is running
The web server is not installed inside (the machine is born empty), or the security group doesn't have HTTP and HTTPS open. Check the security group first on the instance's Security tab.
The bill includes an IP I don't use
An Elastic IP you allocated and didn't associate with any machine, or that was left behind when you deleted the machine. Release it from Elastic IPs.
In Simplio
In Simplio you create an EC2 or Lightsail machine from the same short form, with the static IP, the firewall closed to your IP, the encrypted disk and scheduled backups ticked by default, and each person on your team can only create what their permission and budget allow. The machine appears in the list alongside the others, with its metrics and its alerts active.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Creating the machine | Form with 7 blocks and about 20 options, 15 minutes if you know which ones matter | Form with 5 fields and the decisions already made (static IP, firewall to my IP, encrypted disk with delete on termination) |
| What comes after | Elastic IP, status alarm, backups: 3 more screens | Boxes at creation time: scheduled backups and alerts active from the first minute |
| Who can create machines | Anyone with IAM permission, no cap | Permission per user and budget per person |