launching-ec2-instance-with-best-practices
aws/agent-toolkit-for-aws
Launch EC2 instances with secure, cost-efficient defaults including IAM roles, hardened security groups, and encrypted storage.
What is launching-ec2-instance-with-best-practices?
Automates EC2 instance deployment with built-in best practices for security, cost optimization, and operational standards. Use when provisioning new EC2 instances to ensure least-privilege access, hardened networking, encryption, and proper tagging without manual configuration.
- Selects appropriate AMIs with architecture compatibility validation
- Recommends burstable instance types optimized for cost
- Creates least-privilege IAM roles for required AWS service access
- Configures hardened security groups with minimal port exposure
- Enables encrypted gp3 EBS volumes with environment-appropriate retention
- Applies comprehensive tagging for cost tracking and resource organization
How to install launching-ec2-instance-with-best-practices
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill launching-ec2-instance-with-best-practices- AWS account with appropriate IAM permissions to create EC2 instances, IAM roles, and security groups
- AWS CLI configured with valid credentials
- VPC and subnet already provisioned
- EC2 key pair created for SSH access
How to use launching-ec2-instance-with-best-practices
- 1.Specify workload type and environment (e.g., web server, development)
- 2.Provide VPC and subnet selection or accept defaults
- 3.Confirm AMI selection and instance type recommendation
- 4.Review generated IAM role and security group configuration
- 5.Execute the launch procedure
- 6.Verify instance is running and accessible via provided connection instructions
Use cases
- Deploying web application servers with secure defaults
- Launching development/staging instances with cost controls
- Provisioning workload-specific instances following compliance requirements
- Automating instance creation in infrastructure-as-code pipelines
- Setting up instances with automatic security group and IAM configuration
- AWS infrastructure engineers
- DevOps practitioners
- Cloud architects implementing security policies
- Teams standardizing EC2 deployment practices
- Organizations requiring cost optimization and security compliance
launching-ec2-instance-with-best-practices FAQ
The skill recommends burstable instance types (t3, t3a, t4g) optimized for cost-efficiency. It validates architecture compatibility with your selected AMI.
The skill creates hardened security groups with minimal port exposure by default. You can review and modify rules before launch through the procedure.
The skill applies comprehensive tagging for cost tracking and organization based on workload type, environment, and other metadata you provide.
Check console output with `aws ec2 get-console-output`, verify EBS volume size is sufficient, and confirm AMI compatibility with the instance type.
SSH is the default, but the skill documentation mentions AWS Systems Manager Session Manager as an alternative connection method if SSH is unavailable.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: launching-ec2-instance-with-best-practices description: Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best practices for security and cost optimization. version: 1
Launching EC2 Instances with Best Practices
Overview
Domain expertise for launching EC2 instances with sensible defaults optimized for security, cost-efficiency, and operational best practices. Covers AMI selection, instance type recommendation, network configuration, IAM role creation, security group hardening, storage configuration, tagging strategy, and post-launch verification.
Launch an EC2 instance
To launch a fully configured EC2 instance with best-practice defaults, follow the procedure exactly. See EC2 instance launch procedure.
The procedure handles:
- Intelligent defaults based on workload type and environment
- Network validation (VPC, subnet, public/private placement)
- AMI selection with architecture compatibility checks
- Least-privilege IAM roles for required AWS service access
- Hardened security groups with minimal port exposure
- Encrypted gp3 storage with environment-appropriate retention
- Comprehensive tagging for cost tracking and organization
- Post-launch verification and connection instructions
Troubleshooting
Insufficient instance capacity
Try a different availability zone or instance type (e.g., t3a instead of t3). See the full troubleshooting guide in the launch procedure.
Instance immediately terminates
Check console output with aws ec2 get-console-output. Verify EBS volume size is sufficient and AMI is compatible with the instance type.
Cannot connect via SSH
Verify the security group allows SSH from your IP, key file permissions are 400, and the instance is running. Consider AWS Systems Manager Session Manager as an alternative.
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
querying-data-lake
Execute SQL queries on Amazon Athena across Glue, S3 Tables, and Redshift catalogs with workgroup management and cost tracking.
routing-traffic-with-route53-and-cloudfront
Configures Amazon Route 53 to route traffic to a CloudFront distribution using a custom domain. Use when setting up DNS alias records, alternate domain names (CNAMEs), ACM certificates for HTTPS, and IPv6 support for CloudFront.
securing-s3-buckets
Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation.
setting-up-cloudtrail-multi-region
Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions.
setting-up-cloudwatch-alarm-notifications
Set up encrypted SNS topics and subscriptions for CloudWatch alarm notifications with proper security controls.
setting-up-ec2-instance-profiles
Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary credentials.