How to Use scp to Copy Files to EC2 (Upload and Download)

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. Why scp: wget only downloads from websites

Why. wget runs on the server and downloads a file from a web address. It can't do two jobs you need every day:

1. Upload: copy a file from your laptop to the server. Your laptop is not a website, so the server can't wget from it.
2. Download: copy a file from the server to your laptop, for example a backup.

What. scp (secure copy) does both. It copies files between two machines over SSH, with the same key pair you use to log in. Any kind of file works: an image, a video, a PDF, a zip, a text file.

Why "secure". Your file travels over the public internet between your laptop and AWS. scp encrypts it on the way, so anyone who captures it in between sees only scrambled data, not your photo or your code.

2. The scp command

Why. You already type ssh to log in. scp reuses the same key, user and IP, so there is nothing new to set up: you only add what to copy and where.

What. You already know the SSH command:

ssh -i mykey.pem ec2-user@PUBLIC_IP

scp looks almost the same, with a source and a destination added:

scp -i mykey.pem SOURCE DESTINATION

1. scp: the program.
2. -i mykey.pem: your key, the same one you use for SSH.
3. SOURCE: the file you copy.
4. DESTINATION: where the copy goes.

When one side is the server, write it as user@server:path. The colon is what tells scp "this is on another machine":

1. ec2-user@PUBLIC_IP:. puts the file in the home folder, /home/ec2-user. The dot means "the home folder".
2. ec2-user@PUBLIC_IP: with nothing after the colon also means the home folder.
3. ec2-user@PUBLIC_IP:ravi puts it in the folder ravi inside the home folder.

Example 1: the colon matters. If you forget the colon, scp doesn't connect to anything. It just makes a copy on your laptop, with a file name like ec2-user@PUBLIC_IP., and nothing goes to the server. Always end the server side with : and a path.

3. Upload an image and use it on a page

Why. This is the everyday job: a photo on your laptop has to appear on the website.

Where to run scp. On your laptop, in a second terminal window or tab (PowerShell on Windows, Terminal on Mac or Linux). Not inside the SSH session: the server can't see your laptop's files, so the copy has to start from the laptop.

How. Suppose your key mykey.pem is in Downloads and the photo beach.jpg is on the Desktop.

Step 1. Open PowerShell (or Terminal). It starts in your user folder, so Downloads and Desktop are right there.

Step 2. Type the command. Use Tab to fill in the paths: type two or three letters and press Tab.

scp -i .\Downloads\mykey.pem .\Desktop\beach.jpg ec2-user@PUBLIC_IP:.

On Windows the folders in a path are separated by a backslash, \. On Mac or Linux they are separated by /: scp -i Downloads/mykey.pem Desktop/beach.jpg ec2-user@PUBLIC_IP:.

Step 3. The first time you connect to a server from this laptop, you're asked to trust it. Type yes:

The authenticity of host 'PUBLIC_IP (PUBLIC_IP)' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Step 4. Wait for 100%:

beach.jpg                         100%   ...KB   ...KB/s   00:00

Step 5. In your SSH session, check that it arrived and move it into the web root:

[ec2-user@ip-172-31-xx-xx ~]$ ls
beach.jpg
[ec2-user@ip-172-31-xx-xx ~]$ sudo mv beach.jpg /var/www/html/

The file lands in the home folder because that's where ec2-user may write. /var/www/html belongs to root, so the move needs sudo.

Step 6. Use it on a page:

cd /var/www/html
sudo nano beach.html

Type:

<img src="beach.jpg" width="600">

Step 7. Open http://PUBLIC_IP/beach.html.

If the site doesn't open after you restarted the instance.

1. Apache is stopped after a stop and start. Run sudo service httpd start (or sudo systemctl enable httpd once, so it starts at every boot).
2. Type http:// in front of the IP yourself. If the browser tries https:// (port 443), and the Security Group allows only port 80, the page waits and then times out.

4. Case-sensitive names and the ../ path

Why. A file that uploaded fine can still show as a broken image. The two usual reasons are a capital letter in the name and a wrong relative path, and both are quick to check.

Example 2: a capital letter breaks the image. The uploaded file is called Beach.jpg, but the page says <img src="beach.jpg">. The page shows a broken image. Linux file names are case-sensitive: Beach.jpg and beach.jpg are two different names. Write the name exactly as ls shows it, or rename the file.

Example 3: an image one folder up. Make a sub-folder with its own page:

cd /var/www/html
sudo mkdir gallery
cd gallery
sudo nano photos.html

The image is in /var/www/html, one level above gallery. So the page goes one level up with ../:

<img src="../beach.jpg">

Open http://PUBLIC_IP/gallery/photos.html. With only src="beach.jpg", the browser would look for /gallery/beach.jpg and show a broken image.

5. A PDF, and spaces in names

Why. Real sites serve more than images: brochures, forms, price lists. And files from laptops often have spaces in their names, which the shell splits unless you quote them.

How. Any file type works the same way. Upload a PDF (if you have none, download a sample PDF from the internet):

Step 1. On the laptop:

scp -i .\Downloads\mykey.pem .\Downloads\notes.pdf ec2-user@PUBLIC_IP:.

Step 2. On the server:

sudo mv notes.pdf /var/www/html/

Step 3. Open http://PUBLIC_IP/notes.pdf. The browser opens the PDF.

Example 4: a space in the name. A file called my notes.pdf causes two problems:

1. On the command line you must put the name in quotes: ".\Downloads\my notes.pdf", otherwise scp sees two names, my and notes.pdf.
2. In a URL a space is written as %20: http://PUBLIC_IP/my%20notes.pdf.

6. Download from the server to your laptop

Why. Sometimes you need a file from the server: a log to send to a developer, or a page someone edited on the server. Downloading is the same command with the two sides swapped.

What. Swap the two sides: the source is now the server (with its colon), and the destination is a folder on your laptop. You still run it on the laptop.

How.

Step 1. On the server, make a small file and log out:

nano notes.txt
exit

Step 2. On the laptop:

scp -i .\Downloads\mykey.pem ec2-user@PUBLIC_IP:notes.txt .\Downloads\

notes.txt without a folder after the colon means "in the home folder". To copy into the folder you're in on the laptop, use . as the destination.

Step 3. Open Downloads\notes.txt in Notepad.

This is true for copies between your laptop and a server. The one case where you run scp inside a server is a copy from one server to another server.

7. Naming rules that save you trouble

Why. Every rule here prevents a real error you would otherwise debug later: a broken image, a split command, a Tab that won't complete.

1. Use small letters only. Linux is case-sensitive, and Tab completion only works if you type the first letters in the right case.
2. No spaces. They need quotes on the command line and become %20 in URLs.
3. Join words with an underscore or nothing: my_folder or myfolder, beach_photo.jpg.

8. A whole website as one zip file

Why. A developer gives you a website folder with many files: pages, images, CSS, JavaScript. You can copy a folder directly with scp -r (recursive):

scp -i .\Downloads\mykey.pem -r .\Desktop\html ec2-user@PUBLIC_IP:.

For many files a zip is usually better:

1. It's one file, so one copy, and easy to check.
2. It's smaller. Compression stores repeated data once: ten As in a row can be stored as "A, ten times".
3. It's faster to transfer, and nothing gets left out halfway.

How.

Step 1. On Windows, right-click the website folder, here called html, and choose Send to › Compressed (zipped) folder. You get html.zip. Open it once to check that every file is inside.

Step 2. Upload it. The colon alone means the home folder:

scp -i .\Downloads\mykey.pem .\Desktop\html.zip ec2-user@PUBLIC_IP:

Step 3. On the server, move it into the web root:

sudo mv html.zip /var/www/html/

If you open http://PUBLIC_IP/html.zip now, the browser just downloads it. A browser can't show a zip file, and files it can't show are downloaded.

Step 4. Unzip it. Without sudo it fails, because the folder belongs to root:

[ec2-user@ip-172-31-xx-xx html]$ unzip html.zip
Archive:  html.zip
checkdir error:  cannot create html
                 Permission denied
...

With sudo it works:

sudo unzip html.zip

unzip comes installed on Amazon Linux.

Step 5. Windows put the folder itself into the zip, so the files are now in /var/www/html/html/. Move them up one level:

cd html
sudo mv * ..
cd ..
ls

.. is the folder one level up. * means every file here, except hidden files whose names start with a dot.

Step 6. Open http://PUBLIC_IP/ and a page or image from the zip by its name.

9. Back up a live website to your laptop

Why. Before you change a live site, keep a copy of what works. If something breaks, you can put it back.

How.

Step 1. Go one level up from the folder you want to zip. Don't zip a folder while you're standing inside it.

cd /var/www

Step 2. Zip the whole folder. /var/www belongs to root, so sudo; -r takes every subfolder and hidden file:

[ec2-user@ip-172-31-xx-xx www]$ sudo zip -r backup.zip html
  adding: html/ (stored 0%)
  adding: html/index.html (deflated ...%)
  ...

html/* without -r would leave out what's inside the subfolders.

Step 3. Move the zip to the home folder, so the scp path stays short and simple:

sudo mv /var/www/backup.zip /home/ec2-user/

scp only needs permission to read the file; a short path just makes the command easy to type.

Step 4. On the laptop, download it:

scp -i .\Downloads\mykey.pem ec2-user@PUBLIC_IP:backup.zip .\Downloads\

Step 5. Extract it on the laptop and open a few files, a page, an image, a video, to be sure the backup really works.

10. Apache, Nginx and Tomcat

Why. You will see all three names in job posts and on servers. Knowing which does what tells you which one to install for a given project.

What. Three names you will meet:

1. Apache HTTP Server (httpd): the web server we used so far.
2. Nginx: another free web server. It handles many visitors at the same time with little memory, so many busy sites use it, often in front of other servers. It serves the same HTML, images and videos.
3. Apache Tomcat: a server that runs Java web applications. Apache httpd and Nginx serve files; they don't run Java code. They can sit in front of Tomcat and pass requests to it.

Which web server a project uses is usually decided by the architect or team lead. As a cloud engineer you should be able to set up both.

11. Switch the same server from Apache to Nginx

Why. Apache and Nginx both listen on port 80, and only one program can use a port at a time. So you stop Apache first. If you start Nginx while Apache is running, Nginx fails to start:

Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.

What. The two use different web folders:

1. Apache: /var/www/html
2. Nginx: /usr/share/nginx/html

How.

Step 1. Stop Apache:

sudo service httpd stop

Step 2. Install Nginx:

sudo yum install nginx -y

Step 3. Start it and check it:

[ec2-user@ip-172-31-xx-xx ~]$ sudo service nginx start
Redirecting to /bin/systemctl start nginx.service
[ec2-user@ip-172-31-xx-xx ~]$ sudo service nginx status

Look for Active: active (running). A service runs all the time in the background and waits for requests.

Step 4. Look at Nginx's web folder:

[ec2-user@ip-172-31-xx-xx ~]$ cd /usr/share/nginx/html
[ec2-user@ip-172-31-xx-xx html]$ ls
404.html  50x.html  index.html  nginx-logo.png  poweredby.png

Step 5. Open http://PUBLIC_IP/. You may still see your old Apache page: the browser showed a saved copy from its cache. Refresh, and you see Welcome to nginx!

Step 6. Open a page that doesn't exist, like http://PUBLIC_IP/ravi.html. Now Nginx answers with its own 404 page, which comes from /usr/share/nginx/html/404.html.

Step 7. Copy your site from Apache's folder into Nginx's folder. Copy, don't move, so Apache still has the files if you switch back:

cd /usr/share/nginx/html
sudo cp -r /var/www/html/* .

Step 8. Run ls, then refresh the browser. Your own index.html has replaced the Nginx welcome page, and every page and image opens at the same URL as before, now served by Nginx.

/var/www/html/* skips hidden files (names starting with a dot). To copy those too, copy the folder's contents with a dot instead:

sudo cp -r /var/www/html/. /usr/share/nginx/html/

Step 9. Run history to see every command you ran, in order. Keep it as your notes.

12. The whole flow on one page

1. Upload: scp -i mykey.pem file ec2-user@PUBLIC_IP:., run on the laptop.
2. Download: scp -i mykey.pem ec2-user@PUBLIC_IP:file ., also on the laptop.
3. On the server: sudo mv file /var/www/html/.
4. Pages: names exactly as ls shows them; ../ for one folder up; %20 for a space in a URL (better: no spaces).
5. A website: zip it (or scp -r the folder), upload, sudo mv, sudo unzip, fix html/html with sudo mv * ...
6. Backup: cd /var/www, sudo zip -r backup.zip html, move it home, download, open it.
7. Nginx: sudo service httpd stop, sudo yum install nginx -y, sudo service nginx start, sudo cp -r /var/www/html/* /usr/share/nginx/html/.

13. Hands-on lab: upload, publish and back up with scp

Why this lab. Getting files onto a server and copies back off it is a daily job. This lab uploads an image, publishes it, downloads a page, and takes a zip backup of the whole site. Run the scp commands in your laptop terminal, not inside SSH.

1. Upload an image from your laptop
   • Command: scp -i mykey.pem beach.jpg ec2-user@PUBLIC_IP:.
   • You should see: A progress line ending in 100%.
   • Check: In your SSH window, ls ~ shows beach.jpg.
   • Why: Source first, destination second. The colon marks the server side; . after it means ec2-user's home, the one place you can write without sudo.
2. Publish it
   • Command: sudo mv ~/beach.jpg /var/www/html/
   • You should see: Nothing.
   • Check: http://PUBLIC_IP/beach.jpg shows the picture.
   • Why: /var/www/html belongs to root, so scp as ec2-user can't write there directly. Upload to home, then move with sudo.
3. Upload a file with a space in its name
   • Command: scp -i mykey.pem "price list.pdf" ec2-user@PUBLIC_IP:.
   • You should see: A progress line ending in 100%.
   • Check: ls ~ shows 'price list.pdf'.
   • Why: Without quotes, the shell sees two files, price and list.pdf. Better still, rename it to price-list.pdf before uploading.
4. Download a page to your laptop
   • Command: scp -i mykey.pem ec2-user@PUBLIC_IP:/var/www/html/index.html .
   • You should see: A progress line ending in 100%.
   • Check: index.html is now in your laptop's current folder.
   • Why: Swap the sides: the server (with its colon) is the source; . is the laptop folder you are in. Reading needs no sudo, because the file is readable by everyone.
5. Zip the whole site on the server
   • Command: cd /var/www && sudo zip -r ~/backup.zip html
   • You should see: One adding: line per file.
   • Check: ls -l ~/backup.zip shows a size above 0.
   • Why: One zip is one file to copy, instead of hundreds. -r goes into every subfolder; going one level up keeps the html folder itself inside the zip.
6. Download the backup
   • Command: scp -i mykey.pem ec2-user@PUBLIC_IP:backup.zip .
   • You should see: A progress line ending in 100%.
   • Check: Open the zip on your laptop: you see html/ with index.html and beach.jpg inside.
   • Why: A backup only counts when it is off the server and you have opened it once. If the server is lost, this copy is what you restore from.
7. Clean up and stop
   • Command: rm -f ~/backup.zip ~/"price list.pdf"
   • You should see: Nothing.
   • Check: ls ~ is clean. Then stop the instance.
   • Why: Old zips on the server fill the 8 GB disk over time. Stopping saves free-tier hours.

14. Try at home

Recap

Ravindra Bagale, trainer: linkedin.com/in/ravindra-bagale. The file names (beach.jpg, notes.pdf, notes.txt, html.zip, backup.zip, mykey.pem) and the folders ravi and gallery are examples for learning; PUBLIC_IP stands for your instance's public IPv4 address. Progress numbers and fingerprints are shortened with "..."; the hostname in the prompt is illustrative.

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.