Ravindra BagaleCourses & study guides मराठी Track your progress

4. Amazon EC2: Launch and Connect to Your Linux Server

4.7 Instance Lifecycle: Stop, Reboot, Terminate

By Last updated:

Ha table data javun deil ki bill yet rahil he tharavto – don vela vacha.

  pending ──► running ──► stopping ──► stopped ──► (start) ──► pending
                 │  ▲                                  
          reboot │  │                                  
                 ▼  │                                  
               running ──► shutting-down ──► terminated (gone for ever)
Action What happens Public IP EBS root volume Billing
Reboot OS restarts on same host Kept Kept Continues
Stop Instance shut down; may move to new host on start Released (new one on start); EIP kept Kept Instance charges stop; EBS & EIP still charged
Hibernate RAM saved to EBS, then stop Same as stop Kept Same as stop
Terminate Instance deleted permanently Released Deleted if Delete on termination = yes (default for root) All instance charges stop

Terminate is permanent

Terminated instances cannot be recovered. Enable Termination protection (Actions → Instance settings → Change termination protection) for important servers, and take an EBS snapshot or AMI before experimenting.

Why this matters for security

Forgotten running instances are both a cost risk and a security risk – unpatched, unmonitored servers are easy targets. After every lab, stop or terminate what you don't need and release unused Elastic IPs.

Ravindra Bagale's Tip

After a stop, the public IP changes – many students keep the old IP in DNS or a bookmark and then say "the site has disappeared". If you need a fixed IP, use an Elastic IP (Part 6). And always read the difference between Terminate and Stop twice before you click.

Practice task

Stop your Ubuntu instance, start it again and note the old and new public IP. Then enable termination protection on the Amazon Linux instance.

Thodkyaat sangaycha tar

  • EC2 = virtual server; you choose AMI (OS), instance type (size), key pair (login) and security group (firewall).
  • Security group: 22 from My IP only, 80/443 from anywhere; never open database ports to the internet.
  • chmod 400 mykey.pem; users ec2-user (Amazon Linux) and ubuntu (Ubuntu).
  • Windows: PowerShell OpenSSH (+ icacls), PuTTY (.ppk), or MobaXterm.
  • IMDSv2 protects instance metadata; stop changes the public IP; terminate is permanent.

Samjla ka? Tumcha server ready aahe – aata tya var Linux commands shikuya. Aata pudhe jaauya!

Extended teaching notes

Why this lesson matters

Cameras, sensors and plant controllers often ship with weak defaults. Segment them from IT, change passwords, block inbound internet, and watch outbound traffic.

Real examples

Global: Mirai showed what default passwords on routers/cameras can do at scale. Indian SME (sample): a factory puts PLCs on a separate VLAN reachable only via a jump host.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.