Fjall Docs — deploy AWS infrastructure into your own account

Overview

Ec2Instance deploys EC2 capacity behind an Auto Scaling Group with a launch template, a security group, and a graceful-termination handler. Use it for workloads that need direct server access, a custom AMI, or persistent block storage. Defaults applied by the construct:

Behaviour	Default
IMDSv2	Required (`httpTokens: required`, hop limit 2, metadata tags on)
Root volume	30 GiB gp3 on `/dev/xvda`, encrypted
Machine image	Latest Amazon Linux 2023
Detailed monitoring	On (1-minute metrics)
Session Manager permissions	Added to the instance role, when you supply a `role`
`AZRebalance` process	Suspended, so instances stay pinned to their subnet
Update policy	Instance refresh, 100 / 200 healthy percentages
Subnet placement	Private (isolated when the VPC has no NAT gateways)
SSH	Off: no key pair and no port-22 rule until you set `sshAccess`

What this creates

Every Ec2Instance synthesises the following resources:

A launch template (<serviceName>LaunchTemplate) carrying the AMI, instance type, block devices, IMDSv2 settings, and security group.
An Auto Scaling Group with a 60-second cooldown, all group metrics enabled, and termination policies OLDEST_LAUNCH_CONFIGURATION then CLOSEST_TO_NEXT_INSTANCE_HOUR.
A security group (AsgSecurityGroup), unless you pass your own via securityGroup.
A graceful-termination handler: an SQS queue with a dead-letter queue, a Node.js 24 Lambda (300s timeout, 256 MB), an EventBridge rule, and an ASG EC2_INSTANCE_TERMINATING lifecycle hook with a 600-second heartbeat and a CONTINUE default result.
A custom resource that suspends the AZRebalance scaling process.
A VPC, only when you omit the vpc prop.
A key pair (<serviceName>KeyPair), only when sshAccess is set without a keyName.
A persistent EBS data volume plus re-attach Lambdas, only when persistentDataVolume is set.

The termination hook is why a rolling update takes longer than a bare ASG replacement: each instance drains before the ASG releases it.

Resource class

import { Ec2Instance } from "@fjall/components-infrastructure/lib/resources/aws/compute/ec2";

The deep lib/... path is a published subpath of @fjall/components-infrastructure and is how you use a construct class directly. The scaffolded fjall/<app>/infrastructure.ts never does this. It imports App and the *Factory symbols from the package root instead.

Basic usage

const api = new Ec2Instance(this, "Api", {
  serviceName: "api",
  instanceType: "t4g.medium",
  vpc: myVpc,
  minCapacity: 1,
  maxCapacity: 3,
});

Configuration options

Core properties

Property	Type	Description	Default
`serviceName`	`string`	Service identifier, used to name the launch template, key pair, and generated VPC	Required
`instanceType`	`string`	EC2 instance type, for example `t4g.medium`	Required
`vpc`	`IVpc`	VPC to deploy into	A new Fjall `Vpc` is created
`accountId`	`string`	AWS account ID, used when the construct creates the VPC	Current account
`subnetConfiguration`	`SubnetConfiguration[]`	Subnet layout for the created VPC. Ignored when you pass `vpc`	Standard public/private

Capacity

Property	Type	Description	Default
`minCapacity`	`number`	Minimum instances (passed to the CDK ASG)	CDK default 1
`maxCapacity`	`number`	Maximum instances (passed to the CDK ASG)	CDK default 1
`desiredCapacity`	`number`	Initial instance count (passed to the CDK ASG)	Matches `minCapacity`
`spotCapacityPercentage`	`number`	Percentage of the group above base capacity served by spot, 0 to 100	`0`
`capacityRebalance`	`boolean`	Replace spot instances ahead of interruption	CDK default
`warmPool`	`WarmPoolOptions`	CDK warm-pool options, applied via `asg.addWarmPool()`	No warm pool
`maxInstanceLifetime`	`Duration`	Replace instances older than this. AWS bounds are 1 to 365 days	No lifetime cap

minCapacity and maxCapacity forward straight to the CDK Auto Scaling Group without a Fjall-supplied fallback. When both are omitted, CDK’s default of 1 applies to each. Synth fails when spotCapacityPercentage is not an integer between 0 and 100, when minCapacity is negative or fractional, or when maxCapacity is below minCapacity.

Instance

Property	Type	Description	Default
`machineImage`	`IMachineImage`	AMI to launch	`MachineImage.latestAmazonLinux2023()`
`userData`	`UserData`	Boot script	None
`role`	`Role`	IAM role attached to the instance profile	None, no instance profile is created
`blockDevices`	`BlockDevice[]`	Block device mapping. Replaces the default root mapping	Encrypted 30 GiB gp3 `/dev/xvda`
`sshAccess`	`Ec2SshAccessProps`	Who may reach port 22, which key pair, and whether the instances are public. See sshAccess	None: Session Manager only
`instanceMonitoring`	`Monitoring`	`Monitoring.DETAILED` for 1-minute metrics, `Monitoring.BASIC` for 5-minute	Detailed
`ssmSessionPermissions`	`boolean`	Add `AmazonSSMManagedInstanceCore` to the supplied `role`. No effect without `role`	`true`
`tags`	`Record<string, string>`	Tags applied to the ASG and propagated to launched instances, usable as SSM `SendCommand` targets	None
`defaultPort`	`number`	Default TCP port for the construct’s `connections` object	None

Empty-string tag keys or values are rejected at synth.

Network

Property	Type	Description	Default
`securityGroup`	`ISecurityGroup`	Bring your own security group. The construct then creates none and exposes yours as `asgSecurityGroup`	Construct creates `AsgSecurityGroup`
`vpcSubnets`	`SubnetSelection`	Explicit subnet selection, for example AZ pinning	Private with egress (isolated when the VPC has no NAT); public when `sshAccess.public` is `true`
`associatePublicIpAddress`	`boolean`	Assign a public IP to launched instances	`true` when `sshAccess.public` is `true`, otherwise `false`

Lifecycle and storage

Property	Type	Description	Default
`updatePolicy`	`Ec2InstanceUpdatePolicyConfig`	Rollout strategy for launch-template changes	Instance refresh, 100 / 200
`ecsClusterArn`	`string`	Drain and deregister the container instance before generic cleanup	Unset (bare EC2)
`persistentDataVolume`	`Ec2InstancePersistentDataVolumeConfig`	Standalone EBS volume that re-attaches across instance refreshes	None
`dataVolumeStableOwnerId`	`string`	Re-attach identity for the persistent volume. Required whenever `persistentDataVolume` is set	Required with `persistentDataVolume`

A persistent data volume is AZ-local, so vpcSubnets.availabilityZones must hold exactly one entry and it must match persistentDataVolume.availabilityZone. Synth fails otherwise. Changing dataVolumeStableOwnerId after deploy strands the existing volume, because the lifecycle Lambdas filter on it as a tag.

Machine images

When machineImage is omitted, the construct uses MachineImage.latestAmazonLinux2023().

Amazon Linux 2023 (default)

const api = new Ec2Instance(this, "Api", {
  serviceName: "api",
  instanceType: "t4g.micro",
  machineImage: MachineImage.latestAmazonLinux2023(),
});

Ubuntu

Match the AMI architecture to the instance family. t4g is Graviton, so pick the arm64 parameter.

const web = new Ec2Instance(this, "Web", {
  serviceName: "web",
  instanceType: "t4g.small",
  machineImage: MachineImage.fromSsmParameter(
    "/aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id",
  ),
});

Custom AMI

const dashboard = new Ec2Instance(this, "Dashboard", {
  serviceName: "dashboard",
  instanceType: "m5.large",
  machineImage: MachineImage.lookup({
    name: "dashboard-base-*",
    owners: ["self"],
  }),
});

User data

Amazon Linux 2023 ships dnf. Swap the package manager to match a non-default AMI.

Basic script

const userData = UserData.forLinux();
userData.addCommands(
  "dnf update -y",
  "dnf install -y nginx",
  "systemctl enable --now nginx",
);

const web = new Ec2Instance(this, "Web", {
  serviceName: "web",
  instanceType: "t4g.micro",
  userData,
});

Container host

const userData = UserData.forLinux();
userData.addCommands(
  "dnf update -y",
  "dnf install -y docker",
  "systemctl enable --now docker",
  "usermod -a -G docker ec2-user",
  "docker run -d --restart=always -p 80:80 nginx:latest",
);

Storage

blockDevices replaces the default mapping, it does not extend it. Pass an entry for the /dev/xvda root volume alongside any extra volumes, or the root falls back to the AMI’s own default and loses the wrapper-enforced encryption.

Additional EBS volumes

const worker = new Ec2Instance(this, "Worker", {
  serviceName: "worker",
  instanceType: "m5.large",
  blockDevices: [
    {
      // Keep the encrypted root default when overriding blockDevices.
      deviceName: "/dev/xvda",
      volume: BlockDeviceVolume.ebs(30, {
        volumeType: EbsDeviceVolumeType.GP3,
        encrypted: true,
      }),
    },
    {
      deviceName: "/dev/sdf",
      volume: BlockDeviceVolume.ebs(100, {
        volumeType: EbsDeviceVolumeType.GP3,
        encrypted: true,
        deleteOnTermination: false,
      }),
    },
  ],
});

The construct builds its own default through the safeEbs() helper, which pins encrypted: true and gp3. Import it from @fjall/components-infrastructure/lib/resources/aws/compute/blockDeviceVolume if you prefer that shape over hand-written CDK options.

RAID 0 across two volumes

const userData = UserData.forLinux();
userData.addCommands(
  "mdadm --create /dev/md0 --level=0 --raid-devices=2 /dev/xvdf /dev/xvdg",
  "mkfs.ext4 /dev/md0",
  "mkdir -p /data",
  "mount /dev/md0 /data",
);

const analytics = new Ec2Instance(this, "Analytics", {
  serviceName: "analytics",
  instanceType: "m5.2xlarge",
  userData,
  blockDevices: [
    {
      deviceName: "/dev/xvda",
      volume: BlockDeviceVolume.ebs(30, { encrypted: true }),
    },
    {
      deviceName: "/dev/xvdf",
      volume: BlockDeviceVolume.ebs(500, { encrypted: true }),
    },
    {
      deviceName: "/dev/xvdg",
      volume: BlockDeviceVolume.ebs(500, { encrypted: true }),
    },
  ],
});

For storage that must survive an instance refresh, use persistentDataVolume rather than a block device. Block devices are recreated empty with every replacement.

Security

Session Manager is the default access path

Session Manager needs no inbound rule and no public IP, which makes it the access path to reach for. It has one prerequisite: pass a role. CDK attaches the instance profile only when a role exists, so an Ec2Instance without role launches with no instance profile and ssmSessionPermissions has nothing to act on. With a role supplied, ssmSessionPermissions defaults to true and adds AmazonSSMManagedInstanceCore to it. Reach an instance with:

fjall aws exec --target production-use1 -- aws ssm start-session --target i-0123456789abcdef0

Pass ssmSessionPermissions: false when your role already carries scoped Session Manager statements, because the managed policy grants account-wide ssm:GetParameter.

sshAccess

sshAccess opts the group into SSH. Each field is one decision, and the construct makes none of them for you:

Field	Type	Description	Default
`allowedIpCidrs`	`string[]`	IPv4 source ranges allowed on TCP 22, one ingress rule each. At least one entry, no duplicates. A CDK token per element, such as `vpc.vpcCidrBlock`, passes through to CloudFormation; the list itself must be literal	Required
`keyName`	`string`	An existing EC2 key pair, resolved with `KeyPair.fromKeyPairName`. Naming the key pair the construct would create is rejected, because that swap deletes it	A key pair named `<serviceName>KeyPair` is created
`public`	`boolean`	Place the instances in public subnets with a public IP. `vpcSubnets` may still pin availability zones; a `subnetType` or `associatePublicIpAddress` that contradicts `public: true` is rejected	`false`: private subnets, reached from inside the VPC, a peer or a VPN

Omit sshAccess and the construct creates no key pair, adds no port-22 rule and keeps the private placement. That is the default, and Session Manager covers it. A bastion reachable from one office address:

const bastion = new Ec2Instance(this, "Bastion", {
  serviceName: "bastion",
  instanceType: "t4g.nano",
  vpc: myVpc,
  role: bastionRole,
  sshAccess: {
    allowedIpCidrs: ["203.0.113.4/32"],
    public: true,
  },
});

A build runner that stays private, reached over the VPN with a key pair the team already holds:

const runner = new Ec2Instance(this, "Runner", {
  serviceName: "runner",
  instanceType: "t4g.medium",
  vpc: myVpc,
  sshAccess: {
    allowedIpCidrs: ["10.0.0.0/8"],
    keyName: "ops",
  },
});

When the construct creates the key pair, AWS stores the private key in Systems Manager Parameter Store as /ec2/keypair/<key-pair-id>. Read it once and keep it out of the repository:

fjall aws exec --target production-use1 -- aws ssm get-parameter \
  --name /ec2/keypair/<key-pair-id> --with-decryption

"0.0.0.0/0" still deploys, because a world-open rule is sometimes the intent, but it synthesises with a warning that names the instance (ec2WorldOpenSsh). The warning reads the placement the group resolved to, not public alone: it says “the entire internet” when the instances are internet-facing, through public: true or through public vpcSubnets together with associatePublicIpAddress: true, and otherwise that the rule admits every address that can route to them. Scope allowedIpCidrs to the addresses that need access instead. Adding a narrower range beside it restricts nothing, because both rules land on the same security group.

Synth rejects, naming the reason:

sshAccess alongside securityGroup. The construct adds ingress only to a security group it owns. Drop securityGroup, or keep it and add the port-22 rule there yourself with no sshAccess.
An empty allowedIpCidrs, a duplicated range, a literal that is not dotted-quad/prefix-length, or a list token such as valueAsList or Fn.split over a parameter in place of the list, even spread into a literal one. A token per element passes through, and Fn.split over a literal string is already a list. IPv6 ranges are not accepted.
An empty keyName, or a keyName equal to <serviceName>KeyPair. Omit it to have a key pair created and kept.
public: true with associatePublicIpAddress: false, with a vpcSubnets.subnetType other than public, or with a vpcSubnets selector by group name or instance.
A field sshAccess does not have. The pre-34 allowedCidrs is allowedIpCidrs here.
null in place of the object. Omit sshAccess instead.

The retired enableSSH is still read at synth so an older file cannot deploy silently without SSH. enableSSH: true fails with the translation to sshAccess. enableSSH: false asked for the default and still gets it, with a warning to delete the prop (ec2RetiredSshProp). Changing keyName or public on a deployed group changes the launch template, so the next deploy runs an instance refresh under updatePolicy. Changing allowedIpCidrs edits the security group’s rules in place.

Bring your own security group

const internal = new SecurityGroup(this, "InternalSg", {
  vpc: myVpc,
  description: "Internal-only access to the reporting service",
});
internal.addIngressRule(
  Peer.ipv4("10.0.0.0/8"),
  Port.tcp(443),
  "HTTPS from the internal network",
);

const reporting = new Ec2Instance(this, "Reporting", {
  serviceName: "reporting",
  instanceType: "t4g.small",
  vpc: myVpc,
  securityGroup: internal,
});

reporting.connections.allowTo(
  database,
  Port.tcp(5432),
  "Reporting to database",
);

IAM role

The role prop takes a standard CDK IAM Role from aws-cdk-lib/aws-iam.

const role = new Role(this, "ApiRole", {
  assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
  managedPolicies: [
    ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
  ],
  inlinePolicies: {
    S3Access: new PolicyDocument({
      statements: [
        new PolicyStatement({
          actions: ["s3:GetObject", "s3:PutObject"],
          resources: ["arn:aws:s3:::api-artifacts/*"],
        }),
      ],
    }),
  },
});

const api = new Ec2Instance(this, "Api", {
  serviceName: "api",
  instanceType: "t4g.medium",
  role,
});

Scaling and rollout

Across availability zones

const web = new Ec2Instance(this, "Web", {
  serviceName: "web",
  instanceType: "t4g.large",
  minCapacity: 2,
  maxCapacity: 10,
  vpc, // The VPC needs subnets in more than one AZ
});

Spot capacity

spotCapacityPercentage sets the spot share above base capacity, using the price-capacity-optimized allocation strategy. Any value above 0 switches the ASG to a mixed instances policy.

const batch = new Ec2Instance(this, "Batch", {
  serviceName: "batch",
  instanceType: "c5.large",
  minCapacity: 3,
  maxCapacity: 10,
  spotCapacityPercentage: 70, // 70% spot, 30% on-demand
  capacityRebalance: true,
});

Update policy

Any change to the launch template (user data, AMI, block devices) triggers a rollout. updatePolicy picks the strategy.

Variant	Behaviour	Overridable fields
`instanceRefresh` (default)	ASG-native rolling replacement	`minHealthyPercentage`, `maxHealthyPercentage`
`rollingUpdate`	Legacy CloudFormation single-instance roll, `minInstancesInService: 0`, `maxBatchSize: 1`	`pauseTime` (default 300s)
`replacingUpdate`	Full-replacement CloudFormation shape	None
`none`	No caller-driven update policy. Own the rollout externally	None

Default healthy percentages are 100 / 200, which surges then shrinks and avoids a capacity dip. With persistentDataVolume set they become 0 / 100, because a single-attach EBS volume cannot serve a surge instance.

const clickhouse = new Ec2Instance(this, "Clickhouse", {
  serviceName: "clickhouse",
  instanceType: "m6g.xlarge",
  updatePolicy: {
    type: "instanceRefresh",
    minHealthyPercentage: 0,
    maxHealthyPercentage: 100,
  },
});

Properties and methods

Member	Type	Purpose
`asgSecurityGroup`	`ISecurityGroup`	The group used by the launch template, yours when you passed `securityGroup`
`connections`	`Connections`	`IConnectable` view for `allowTo` / `allowFrom` wiring
`vpc`	`IVpc`	The supplied or generated VPC
`getAutoScalingGroup()`	`AutoScalingGroup`	The underlying ASG, for load balancer targets and scaling policies

const asg = api.getAutoScalingGroup();
api.connections.allowTo(database, Port.tcp(5432));

Patterns

Web fleet behind a load balancer

const webFleet = new Ec2Instance(this, "WebFleet", {
  serviceName: "web",
  instanceType: "t4g.small",
  minCapacity: 2,
  maxCapacity: 10,
  userData: UserData.forLinux({ shebang: "#!/bin/bash -xe" }),
});

const alb = new ApplicationLoadBalancer(this, "WebAlb", {
  vpc: webFleet.vpc,
  internetFacing: true,
});

const targetGroup = new ApplicationTargetGroup(this, "WebTargets", {
  vpc: webFleet.vpc,
  port: 80,
  targets: [webFleet.getAutoScalingGroup()],
});

Operations host

Reach it over Session Manager rather than SSH, so it needs no inbound rule and no public IP. The role is what makes that work.

const opsRole = new Role(this, "OpsRole", {
  assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
});

const ops = new Ec2Instance(this, "Ops", {
  serviceName: "ops",
  instanceType: "t4g.nano",
  minCapacity: 1,
  maxCapacity: 1,
  vpc: myVpc,
  role: opsRole, // ssmSessionPermissions adds AmazonSSMManagedInstanceCore
  // no sshAccess: private subnets, no ingress, Session Manager access
  tags: { Role: "ops-host" },
});

The tags entry propagates to launched instances, so SSM SendCommand can target tag:Role = ops-host. The instance also needs a route to the SSM endpoints, either NAT egress from a private subnet or VPC interface endpoints for ssm, ssmmessages, and ec2messages.

GPU instance

const training = new Ec2Instance(this, "Training", {
  serviceName: "training",
  instanceType: "p3.2xlarge",
  machineImage: MachineImage.fromSsmParameter(
    "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2",
  ),
  blockDevices: [
    {
      deviceName: "/dev/xvda", // Root device on Amazon Linux
      volume: BlockDeviceVolume.ebs(100, {
        volumeType: EbsDeviceVolumeType.GP3,
        encrypted: true,
        iops: 3000,
      }),
    },
  ],
});

Complete example

import { Ec2Instance } from "@fjall/components-infrastructure/lib/resources/aws/compute/ec2";
import {
  BlockDeviceVolume,
  EbsDeviceVolumeType,
  MachineImage,
  Port,
  UserData,
} from "aws-cdk-lib/aws-ec2";
import { Monitoring } from "aws-cdk-lib/aws-autoscaling";
import {
  PolicyDocument,
  PolicyStatement,
  Role,
  ServicePrincipal,
} from "aws-cdk-lib/aws-iam";

const instanceRole = new Role(this, "ApiRole", {
  assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
  inlinePolicies: {
    ApiPolicy: new PolicyDocument({
      statements: [
        new PolicyStatement({
          actions: ["s3:GetObject"],
          resources: ["arn:aws:s3:::api-artifacts/*"],
        }),
      ],
    }),
  },
});

const userData = UserData.forLinux();
userData.addCommands(
  "dnf update -y",
  "dnf install -y nodejs",
  "aws s3 cp s3://api-artifacts/api.tar.gz /opt/",
  "cd /opt && tar -xzf api.tar.gz",
  "npm ci --omit=dev",
  "npm start",
);

const api = new Ec2Instance(this, "Api", {
  serviceName: "api",
  instanceType: "t4g.medium",
  minCapacity: 2,
  maxCapacity: 6,
  machineImage: MachineImage.latestAmazonLinux2023(),
  userData,
  role: instanceRole,
  instanceMonitoring: Monitoring.BASIC,
  tags: { Service: "api" },
  blockDevices: [
    {
      deviceName: "/dev/xvda",
      volume: BlockDeviceVolume.ebs(30, {
        volumeType: EbsDeviceVolumeType.GP3,
        encrypted: true,
        deleteOnTermination: true,
      }),
    },
  ],
  // no sshAccess: private subnets, Session Manager access only
});

api.connections.allowTo(database, Port.tcp(5432), "API to database");

Best practices

Reach instances through Session Manager. When someone must have SSH, scope sshAccess.allowedIpCidrs to their addresses and leave public off unless they arrive from the internet.
Keep the encrypted /dev/xvda root entry whenever you override blockDevices.
Supply a scoped securityGroup rather than mutating the generated one after construction.
Always pass a role. Without one there is no instance profile, so Session Manager, S3 reads, and every other AWS call from the instance fail. Pass ssmSessionPermissions: false when that role already carries scoped Session Manager statements.
Use persistentDataVolume for state that must survive an instance refresh, and pin dataVolumeStableOwnerId for the life of the stack.
Set tags so SSM SendCommand and cost allocation can target the fleet.
Pick the AMI architecture that matches the instance family. Graviton families (t4g, m6g, c7g) need arm64 images.

Cost optimisation

Set spotCapacityPercentage for fault-tolerant workloads, with capacityRebalance: true.
Pass instanceMonitoring: Monitoring.BASIC to drop from 1-minute to 5-minute metrics. Detailed monitoring is on by default and is billed per instance.
Right-size instanceType from CloudWatch metrics, and prefer Graviton families where the workload supports arm64.
Use gp3 volumes rather than gp2, which the construct default already does.
Set maxInstanceLifetime to recycle long-lived instances instead of running oversized ones indefinitely.
Consider Savings Plans for steady-state capacity.

Next Steps

Compute Factory

Build EC2 and ECS compute through the Fjall compute factory pattern.

Security Group

Control inbound and outbound traffic for your instances.

VPC

Configure the network your EC2 instances run in.

IAM Role

Grant least-privilege AWS permissions to your instances.

​Overview

​What this creates

​Resource class

​Basic usage

​Configuration options

​Core properties

​Capacity

​Instance

​Network

​Lifecycle and storage

​Machine images

​Amazon Linux 2023 (default)

​Ubuntu

​Custom AMI

​User data

​Basic script

​Container host

​Storage

​Additional EBS volumes

​RAID 0 across two volumes

​Security

​Session Manager is the default access path

​sshAccess

​Bring your own security group

​IAM role

​Scaling and rollout

​Across availability zones

​Spot capacity

​Update policy

​Properties and methods

​Patterns

​Web fleet behind a load balancer

​Operations host

​GPU instance

​Complete example

​Best practices

​Cost optimisation

​Next Steps

Compute Factory

Security Group

VPC

IAM Role

Overview

What this creates

Resource class

Basic usage

Configuration options

Core properties

Capacity

Instance

Network

Lifecycle and storage

Machine images

Amazon Linux 2023 (default)

Ubuntu

Custom AMI

User data

Basic script

Container host

Storage

Additional EBS volumes

RAID 0 across two volumes

Security

Session Manager is the default access path

sshAccess

Bring your own security group

IAM role

Scaling and rollout

Across availability zones

Spot capacity

Update policy

Properties and methods

Patterns

Web fleet behind a load balancer

Operations host

GPU instance

Complete example

Best practices

Cost optimisation

Next Steps