Inside an EC2 server: EBS, ENI, instance states, connecting with SSH, and what Linux is

By Ravindra Bagale, trainer · LinkedIn · Last updated: 8 October 2026

1. Quick recap: the 7 launch steps

Why. Everything today builds on the server we launched last class. Here is the short version. The full step-by-step is in the previous chapter, Root user, IAM users, MFA and launching your first EC2 server.

What. The seven parts of the launch page, with today's extra notes:

1. Name and tags. Optional, but name every server. It is discipline.
2. AMI (operating system). Amazon Linux, Ubuntu, Debian, Fedora, SUSE, Red Hat and more. The commands are mostly the same on all of them. Package names can differ (section 20).
3. Instance type. For practice, 1 or 2 vCPU and 1 GiB RAM is enough. Pick the type marked Free tier eligible for your account: t3.micro for accounts made on or after 15 July 2025; t2.micro or t3.micro for older accounts.
4. Key pair. Login without a password. It is a 2048-bit RSA key that proves who you are.
5. Security group. Inbound ports are closed until you open them. For SSH we open port 22.
6. Storage. The Amazon Linux root volume starts at 8 GiB. Extra EBS volumes are like extra USB drives; a gp3 volume can be as small as 1 GiB.
7. Number of instances. Every instance is a clone of steps 1 to 6.

One key pair per project. You can reuse one security group or one key pair for many servers. Should you? Look at the story.

Worked example: 100 servers, one key.

1. Suppose your company runs 100 servers: 50 for project A and 50 for project B.
2. All 100 were launched with the same key pair, company.pem.
3. One developer of project A loses his laptop. The .pem file is on it.
4. Whoever has that file can try to log in to all 100 servers.
5. Now suppose project A used project-a.pem and project B used project-b.pem.
6. The same lost laptop exposes only the 50 servers of project A. Project B stays safe.
7. 100 exposed → 50 exposed: half the damage, from one simple habit.

2. What happens in Pending: three parts come together

Why. After you click Launch instance, the state shows Pending for a short time. In class it took about 10 to 15 seconds. Knowing what AWS does in that time explains everything about stop, start and billing later.

What. AWS puts together three separate parts:

1. EC2 compute. Only the RAM and CPU of your instance type, on a physical host in the Availability Zone. EC2 = Elastic Compute Cloud.
2. EBS volume. The disk (EBS = Elastic Block Store). For our server: 8 GiB gp3. It is a separate AWS service, connected to the compute over AWS's network.
3. ENI. The Elastic Network Interface: the server's network card. Your private and public IP addresses belong to the ENI.

When all three are joined, the state becomes Running.

Worked example: when does the bill start?

1. You click Launch at 10:00:00.
2. Pending lasts 15 seconds. AWS does not bill the instance in Pending.
3. At 10:00:15 the state is Running. Billing starts now, per second, with a 1-minute minimum.
4. You terminate at 10:30:15. Billed time: 30 minutes.
5. With t3.micro in N. Virginia at $0.0104 per hour: 0.5 × $0.0104 = $0.0052.

3. The ENI: where your IP addresses live

Why. People say "my server's IP". Strictly, the IP is on the server's network interface, the ENI. This matters when you stop and start a server.

What. The laptop analogy.

1. Your laptop has an Ethernet port. You plug in a cable, and the network gives an IP address to that connection.
2. Your EC2 instance has an ENI. Its main one is called the primary network interface (eth0 inside Linux).
3. The ENI holds the private IPv4 address (from the subnet; the default VPC uses 172.31.x.x) and, if the instance gets one, the public IPv4 address.

Worked example: two addresses, two jobs.

1. Suppose your server's ENI has private IP 172.31.5.10 and public IP 3.3.3.3 (example values).
2. Another server in the same VPC talks to it on 172.31.5.10. That traffic never leaves AWS's network.
3. You, at home, connect to 3.3.3.3. That is the address the internet can reach.
4. Inside the server, Linux shows the private one: the prompt says ip-172-31-5-10 (section 15).

4. Stop under the hood: AWS takes the compute back

Why. "Why is a stopped server free, but my bill is not zero?" The answer is in the three parts.

What happens when you stop.

1. The state goes Stopping, then Stopped.
2. The operating system shuts down. Anything in RAM is lost.
3. AWS takes back the compute (RAM and CPU) and can give that hardware to another customer. So you pay no instance charge.
4. Your EBS volume stays, with all your data. You keep paying for its storage.
5. Your ENI stays, with its private IP.
6. The public IPv4 that AWS auto-assigned is released.

5. Start again: what stays and what changes

Why. Students are surprised when the SSH command that worked yesterday fails today. Usually the public IP changed.

What happens when you start.

1. The state goes Pending again. Why Pending? Because the compute was given back. AWS must put the three parts together again, usually on a new host.
2. New compute of the same instance type is attached to your same EBS volume and same ENI.
3. The private IPv4 stays the same.
4. The public IPv4 is new, if the instance gets an auto-assigned one.
5. An Elastic IP (a static public IP you allocate) stays with the instance across stop and start.
6. Each start begins a new billing period with a 1-minute minimum.

Worked example: yesterday's command fails.

1. Yesterday: public IP 3.3.3.3. You logged in with ssh -i Downloads\firstlast.pem ec2-user@3.3.3.3.
2. Last night you stopped the server to save money.
3. Today you start it. The console shows public IP 5.5.5.5 (example).
4. Yesterday's command now waits and fails with a timeout.
5. Fix: copy the new public IP from the console and use ec2-user@5.5.5.5.
6. If you need an address that never changes (for a website or a domain), attach an Elastic IP. We do that later in the course.

Public IPv4 costs money. Since February 2024 AWS charges $0.005 per hour for every public IPv4 address, in use or idle.

1. One running server with one public IPv4 for a month: 720 hours × $0.005 = $3.60.
2. Accounts made before 15 July 2025 got 750 hours a month of public IPv4 free during their first 12 months. Newer accounts pay it from their credits.
3. A stopped server releases its auto-assigned public IP, so that charge stops too.
4. An Elastic IP is charged even when its server is stopped. Release Elastic IPs you no longer need.

6. The EBS bill: real numbers

Why. A stopped server still costs a little, because the disk stays. Let's calculate it, the way we did on the board.

What. gp3 storage is charged per GB-month for the size you provision, even if the disk is empty. It is billed per second, so a part of a month costs a part of the price. AWS's price list (October 2026): $0.08 per GB-month in N. Virginia and $0.0912 in Mumbai.

Worked example 1: one server.

1. One server with an 8 GB root volume, in N. Virginia.
2. 8 × $0.08 = $0.64 a month, whether the server is running or stopped.
3. Terminate it (and the root volume is deleted by default): $0.

Worked example 2: the class example, four servers. In class we used a round "₹5 per GB" to see the idea. Here is the same calculation with the real gp3 price.

1. 3 servers × 8 GB = 24 GB.
2. Accounts made before 15 July 2025 get 30 GB of EBS free per month during their first 12 months (the legacy Free Tier). 24 GB is under 30 GB: $0.
3. Launch a 4th server: 4 × 8 = 32 GB.
4. 32 − 30 = 2 GB over the free amount.
5. 2 × $0.08 = $0.16 for a full month.
6. Keep the 4th server for only 15 days of a 30-day month: $0.16 × 15 ÷ 30 = $0.08.

Worked example 3: the same disks on a newer account.

1. Accounts made on or after 15 July 2025 have no 30 GB allowance. Usage is paid from the $100 to $200 credits.
2. All 32 GB count: 32 × $0.08 = $2.56 a month, taken from your credits.
3. The same 32 GB in Mumbai: 32 × $0.0912 = $2.92 a month.

7. Terminate under the hood

Why. Stop is a pause. Terminate is delete. You must know exactly what is lost.

What happens when you terminate.

1. The state goes Shutting-down, then Terminated.
2. Billing for the instance stops as soon as it is Shutting-down.
3. The root EBS volume is deleted by default (its DeleteOnTermination setting is on). Extra EBS volumes you attached later are kept by default.
4. An Elastic IP is disassociated (and keeps costing money until you release it).
5. You cannot start a terminated instance again. It stays visible in the console for a short while, then disappears.

Worked example: what is left after terminate?

1. Server with an 8 GB root volume and an extra 10 GB data volume you attached later.
2. You terminate it.
3. The 8 GB root volume is deleted.
4. The 10 GB data volume becomes "available" (not attached) and is still billed: 10 × $0.08 = $0.80 a month.
5. Delete it from EC2 → Volumes if you don't need it.

8. The instance state diagram

Why. This diagram explains billing, IP changes and data safety in one picture, and interviewers love to ask it.

What. The six states:

How the arrows go:

1. Launch → pending → running.
2. running → Stop → stopping → stopped.
3. stopped → Start → pending → running.
4. running (or stopped) → Terminate → shutting-down → terminated.

Worked example: three interview questions.

1. "You stop a server. Which charges stop, and which continue?" The instance charge stops; EBS storage and any Elastic IP continue.
2. "Why does a started server go to Pending?" Because the compute was released on stop, so AWS puts compute, EBS and ENI together again, usually on a new host.
3. "Can you start a terminated instance?" No. Launch a new one, from an AMI or snapshot if you saved one.

9. Backups before you stop or terminate

Why. Stop keeps the disk, but terminate deletes the root volume by default. And mistakes happen. A backup must exist before you press the button.

What. Three good ways:

1. By hand, before: create an EBS snapshot of the volume, or create an AMI of the instance (an AMI includes snapshots of its volumes).
2. On a schedule: an AWS Backup plan, or an Amazon Data Lifecycle Manager policy that snapshots volumes every day.
3. On an event: an Amazon EventBridge rule that matches the "EC2 Instance State-change Notification" event (for example state stopping) and runs a Lambda function that creates a snapshot.

Worked example: snapshot before terminate.

1. EC2 → Instances → select the server → Storage tab → click the volume ID.
2. Actions → Create snapshot → add a description, for example before-terminate → Create snapshot.
3. Wait until the snapshot status is Completed.
4. Now terminate the server.
5. Later you can create a new volume, or an AMI, from that snapshot.
6. The snapshot itself is billed by the GB-month while you keep it.

10. Launching again in the console

Why. In class we launched a fresh server to practise SSH. Two small habits make the next sections easier.

How (same 7 steps, with today's choices).

1. Name: firstlast.
2. AMI: Amazon Linux 2023, marked Free tier eligible.
3. Instance type: the one marked Free tier eligible for your account (section 1).
4. Key pair: Create new key pair → name firstlast → RSA → .pem → Create key pair. The file firstlast.pem downloads, usually to Downloads.
5. Network settings: Create security group, Allow SSH traffic from (port 22).
6. Storage: 1 × 8 GiB gp3.
7. Launch instance → View all instances.

Why a single word? In the ssh command a space ends one argument. my key pair.pem needs quotes; firstlast.pem does not (section 17).

11. Status checks: 2/2 or 3/3?

Why. Right after launch, the Status check column says Initializing. Wait for the checks to pass before you try SSH.

What. Three checks run automatically, every minute:

1. System status check: the AWS side. The physical host, its power and its network. If it fails, AWS fixes it, or you stop and start the instance to move it to a healthy host.
2. Instance status check: your side. Your OS boots, its network is configured, it is not out of memory. If it fails, you fix it (reboot, or correct the configuration).
3. Attached EBS status check: your EBS volumes are reachable and can complete reads and writes. This one is available only on Nitro-based instances.

So a t3.micro (Nitro) shows 3/3 checks passed. An older Xen-based type such as t2.micro shows 2/2.

Worked example: reading the column.

1. 10:00 Launch. Status check: Initializing.
2. 10:02 Status check: 3/3 checks passed. Now try SSH.
3. Suppose one day it shows 2/3 and the system check failed: AWS's hardware has a problem. Stop and start the instance; it moves to a new host.
4. Suppose the instance check failed: look inside. Reboot, or check what you changed last.

12. The instance summary page

Why. Everything you need for SSH is on this page.

How. EC2 → Instances → click the Instance ID. Important fields:

1. Instance ID: i- followed by letters and numbers. AWS's name for this server. Don't post it in public screenshots.
2. Public IPv4 address: what you use in the ssh command. It has a copy icon.
3. Private IPv4 address: for example 172.31.5.10. The default VPC uses 172.31.0.0/16.
4. Availability Zone: for example ap-south-1b. We did not pick it; AWS chose one for us. We choose it ourselves when we learn VPC and subnets.
5. Elastic IP addresses: blank for now. That is the static IP for later.
6. Instance state and Status checks.

The left menu of EC2 (Instances, Images, Elastic Block Store, Network & Security, Load Balancing, Auto Scaling) is a big part of this course. We will cover it over the coming months.

13. Opening PowerShell in the right folder

Why. The key file is in your Downloads folder. If PowerShell opens somewhere else, the ssh command can't find it.

How (Windows).

1. Press the Start button and type PowerShell.
2. Open Windows PowerShell (normal, not "Run as administrator").
3. Look at the prompt. Suppose your Windows user name is ravi. You should see PS C:\Users\ravi>. Your Downloads folder is right inside it: C:\Users\ravi\Downloads.
4. If you see PS C:\Windows\System32>, that window was opened as Administrator. Open a new normal tab with the + button, or close it and open PowerShell normally.

14. Building the ssh command piece by piece

Why. If you understand each part, you can fix any SSH error yourself.

What. Ask four questions, and write one part for each:

1. Which program? ssh (Secure Shell).
2. How do I prove who I am? Not with a password; with the key file. -i means identity file: the private key.
3. Where is the key file? Its path, for example Downloads\firstlast.pem.
4. Who logs in, and to which server? The user name, @, and the server's public IP: ec2-user@3.3.3.3.

Put together:

ssh -i Downloads\firstlast.pem ec2-user@3.3.3.3

3.3.3.3 is a placeholder. Use your own public IPv4 from the summary page.

The default user name depends on the AMI:

Type the path with Tab, not by hand.

1. Type ssh -i D and press Tab. PowerShell cycles through Desktop, Documents, Downloads.
2. Better: type Dow and press Tab. It completes .\Downloads\.
3. Type f and press Tab. It completes firstlast.pem (press Tab again to cycle if several files start with f).
4. Type a space, then ec2-user@, then paste the IP.

Spaces matter.

1. One space after ssh.
2. One space after -i.
3. One space after the key path.
4. No spaces inside ec2-user@3.3.3.3. It is one word.

15. Logging in, first commands, and logging out

How.

1. In the console, open the instance summary and click the copy icon next to Public IPv4 address.
2. In PowerShell type ssh -i Dow, press Tab, type f, press Tab.
3. Type a space and ec2-user@, then paste the IP (right-click pastes in PowerShell).
4. Press Enter.
5. The first time only, SSH asks: Are you sure you want to continue connecting (yes/no/[fingerprint])? Type yes and press Enter. SSH saves the server's fingerprint so it can warn you if a different machine ever answers on that address.
6. You see the Amazon Linux 2023 banner, and a prompt like [ec2-user@ip-172-31-5-10 ~]$.
7. Look at the prompt: ip-172-31-5-10 is the server's private IP with dashes. Compare it with the console. You are inside the server.

First commands:

1. ls lists the files in your home folder. A new server shows nothing.
2. mkdir ravi makes a folder named ravi.
3. ls again shows ravi.
4. exit logs you out. You are back at PS C:\Users\ravi>.

Worked example: which IP is which?

1. The console shows public 3.3.3.3 and private 172.31.5.10 (examples).
2. You connect to 3.3.3.3, because your laptop is on the internet, not inside the VPC.
3. The prompt shows ip-172-31-5-10, because the server names itself after its private IP.
4. Two different IPs, one server.

16. Mac and Linux: chmod 400

Why. On Mac and Linux, SSH refuses a private key that other users of the computer can read.

How.

1. Open Terminal.
2. cd Downloads
3. chmod 400 firstlast.pem (400 = only you, the owner, can read it; nobody can write it).
4. ssh -i firstlast.pem ec2-user@3.3.3.3
5. Type yes the first time.

Notice step 4: after cd Downloads you are already in Downloads, so the path is just firstlast.pem. If you did not cd, use Downloads/firstlast.pem (Mac and Linux use /, Windows uses \; PowerShell accepts both).

17. Common SSH errors and their fixes

Why. In class almost everyone hit one of these. Read the error message; it usually tells you which part is wrong.

Worked example 1: a file name with spaces.

1. Suppose the key downloaded as my key pair.pem.
2. ssh -i Downloads\my key pair.pem ec2-user@3.3.3.3 fails: ssh sees Downloads\my as the key and key as something else.
3. Put the path in quotes: ssh -i 'Downloads\my key pair.pem' ec2-user@3.3.3.3.
4. Easier: type Dow, Tab, my, Tab. PowerShell adds the quotes for you.

Worked example 2: the key is on the D: drive.

1. Suppose you moved the key to D:\aws keys\firstlast.pem.
2. A path relative to C:\Users\ravi will not find it.
3. Give the full path: ssh -i 'D:\aws keys\firstlast.pem' ec2-user@3.3.3.3 (quotes because of the space).
4. Or cd D:\ first, then use Tab.

Worked example 3: the Windows key-permission error, by command.

1. In PowerShell, in the folder with the key: icacls .\firstlast.pem /inheritance:r (remove inherited permissions).
2. icacls .\firstlast.pem /grant:r "$($env:USERNAME):(R)" (give only you read access).
3. Try the ssh command again.

Two more checks.

1. No VPN is needed. SSH goes straight over the internet to port 22.
2. Is it your IP? In class some students had copied the trainer's IP from the board instead of their own server's.

18. Other ways in: the Connect page and EC2 Instance Connect

The Connect page.

1. Select the instance → Connect → SSH client tab.
2. AWS shows the steps and an example command with your key name and the instance's public DNS name.
3. The chmod 400 step is for Mac and Linux. On Windows, use the file Security tab instead.
4. Mac users can copy the example command into Terminal (from the folder that has the key).

EC2 Instance Connect (in the browser).

1. Select the instance → Connect → EC2 Instance Connect tab.
2. User name: ec2-user.
3. Connect. A terminal opens in a new browser tab. No key file needed.
4. It works when EC2 Instance Connect is installed (it comes pre-installed on Amazon Linux 2023 and Ubuntu 20.04 and later), the instance has a public IP, and the security group allows SSH (port 22) from the EC2 Instance Connect service's IP range. The launch wizard's "Anywhere 0.0.0.0/0" rule allows it; a "My IP" rule alone does not.

Worked example: when to use which.

1. Your laptop has the key and OpenSSH: use the ssh command. This is what you will use at work.
2. You are on someone else's computer without your key: EC2 Instance Connect in the browser.
3. Your security group allows SSH only from My IP: EC2 Instance Connect needs an extra rule for its prefix list com.amazonaws.<region>.ec2-instance-connect.

19. What Linux is: files and folders

Why. You are now inside a Linux server with only a black screen. What do you do there? Exactly what you do on Windows, but with commands.

What. An operating system lets you use the hardware. Think of what you do every day on Windows: create, write, modify, delete, rename, move, copy, paste, download, install apps. Almost all of it is working with files and folders.

How. Windows action → Linux command:

Worked example: the same task, two ways.

1. Windows: right-click → New folder → type reports → Enter.
2. Linux: mkdir reports
3. Windows: copy jan.txt into reports.
4. Linux: cp jan.txt reports/
5. Windows: rename jan.txt to january.txt.
6. Linux: mv jan.txt january.txt
7. Careful: in a Linux terminal, Ctrl+C stops a running command. It does not copy.

20. Distributions, and how Linux was really born

Why. Windows has versions (10, 11). Linux has many names: Amazon Linux, Ubuntu, Debian, Fedora, Kali Linux, SUSE, Red Hat. Why so many?

What. The real history, in order:

1. 1969: Unix. Ken Thompson and Dennis Ritchie created Unix at AT&T's Bell Labs. It was AT&T's licensed operating system, not free for everyone.
2. 1983: GNU. Richard Stallman started the GNU project to build a free Unix-like system. It produced free tools (shell, compiler, libraries) and the GNU GPL licence.
3. 1991: the Linux kernel. Linus Torvalds, a student in Helsinki, wrote a new Unix-like kernel from scratch. It did not contain Unix code. He announced it on 25 August 1991.
4. The name. Torvalds wanted to call it "Freax". Ari Lemmke, who ran the FTP server where it was uploaded, named the folder "linux", and the name stuck.
5. 1992: GPL. Torvalds moved the kernel to the GNU GPL. Anyone may use, study, change and share it, as long as changes are shared under the same licence.
6. Distributions. Because it is open source, teams packaged the kernel with GNU tools, an installer and thousands of programs. Each package is a distribution (distro).

Who makes which distro:

1. Ubuntu: Canonical, founded by Mark Shuttleworth. "Ubuntu" is an African word often explained as "humanity to others". Based on Debian.
2. Debian: a large community project.
3. Red Hat Enterprise Linux (RHEL): Red Hat. The code is open source; companies pay a subscription for support and updates.
4. Fedora: a community distro sponsored by Red Hat.
5. CentOS Linux: was a free rebuild of RHEL. It has ended. Replacements: Rocky Linux, AlmaLinux, and CentOS Stream.
6. SUSE: SUSE Linux Enterprise and the community openSUSE.
7. Kali Linux: a Debian-based distro for security testing.
8. Amazon Linux: AWS's own distro, tuned for EC2 and shipped with AWS tools. We use Amazon Linux 2023.

Same commands, different package names. Most commands (ls, mkdir, cp) are the same everywhere. Package managers and package names can differ. Example, the Apache web server:

1. Amazon Linux, RHEL, Rocky: sudo yum install httpd -y, then sudo service httpd start.
2. Ubuntu, Debian: sudo apt install apache2 -y, then sudo service apache2 start.
3. Same software, two package names: httpd and apache2.

21. The kernel

Why. Every distro shares the same heart: the Linux kernel.

What. The kernel is the core program of the operating system. It sits between programs and hardware:

1. Memory: gives RAM to programs and takes it back.
2. Processes: decides which program runs on the CPU, and when.
3. Files: reads and writes the disk for programs.
4. Drivers: talks to devices such as disks and network cards.
5. Network: sends and receives packets.

Worked example: what happens when you type mkdir ravi.

1. You type mkdir ravi in the shell (bash) and press Enter.
2. The shell runs the mkdir program.
3. mkdir asks the kernel: "make a directory named ravi here".
4. The kernel writes the new directory entry to the disk (your EBS volume).
5. ls asks the kernel for the list, and ravi appears.

22. Why computers use binary

Why. In the end the kernel and the CPU work with electrical signals. A circuit is either on or off.

What.

1. 1 = voltage present (on). 0 = low or no voltage (off).
2. One 0 or 1 is a bit. 8 bits make a byte.
3. Each place in binary is worth double the place to its right: 1, 2, 4, 8, 16, 32, 64, 128.

Worked example 1: 5 in binary.

1. Which place values add up to 5? 4 + 1.
2. Turn on the 4 and the 1; leave the 2 off: 101.
3. In 8 bits (one byte): 00000101.

Worked example 2: 10 in binary.

1. 10 = 8 + 2.
2. On: 8 and 2. Off: 4 and 1. → 1010.
3. In one byte: 00001010.

Worked example 3: the biggest number in one byte.

1. All 8 bulbs on: 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1.
2. = 255. That is why each part of an IPv4 address goes from 0 to 255 (the IP chapter).

23. Homework

Recap

Samjla ka? Aaj ghari server launch kara, SSH kara, stop-start karun IP bagha. Pudhchya class pasun Linux commands.

Ravindra Bagale, trainer: linkedin.com/in/ravindra-bagale. The 100-server company, the user name ravi, the 3.3.3.3, 5.5.5.5 and 172.31.5.10 addresses and the "₹5 per GB" figure are examples for learning. AWS facts and prices are from AWS's own pages and price list as of October 2026 and change often, so check the live AWS pages before you rely on them.