AMIs and launch templates

Start as usual, with the Session Manager endpoints:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$env:Path += ';C:\Program Files\Amazon\SessionManagerPlugin\bin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
.\Start-SsmEndpoints.ps1

1Build bake01

Paste this whole block:

$ud = @'
#!/bin/bash
dnf install -y nginx
echo "<h1>Hello from the saat-web AMI</h1>" > /usr/share/nginx/html/index.html
systemctl enable nginx
'@
[IO.File]::WriteAllText('C:\aws-lab\bake-userdata.sh', ($ud -replace "`r`n", "`n"))
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$bake = aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --user-data file://bake-userdata.sh --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bake01},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=15}]' 'ResourceType=volume,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=15}]' --query "Instances[0].InstanceId" --output text
do { Start-Sleep 20; $ping = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$bake" --query "InstanceInformationList[0].PingStatus" --output text } until ($ping -eq 'Online')
aws ssm start-session --target $bake --document-name AWS-StartInteractiveCommand --parameters command="cloud-init status --wait"

You should see something like this (the dots appear while user data runs):

Starting session with SessionId: yourname.admin-0a1b2c3d4e5f67890
.....
status: done

Exiting session with sessionId: yourname.admin-0a1b2c3d4e5f67890.

2Create the AMI

Paste this whole block (the wait usually takes three to six minutes):

$name = "saat-web-$(Get-Date -Format yyyyMMdd-HHmm)"
$ami = aws ec2 create-image --instance-id $bake --name $name --description "AL2023 + nginx + page" --tag-specifications 'ResourceType=image,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=15}]' 'ResourceType=snapshot,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=15}]' --query ImageId --output text
aws ec2 wait image-available --image-ids $ami
$amiSnap = aws ec2 describe-images --image-ids $ami --query "Images[0].BlockDeviceMappings[0].Ebs.SnapshotId" --output text
aws ec2 describe-images --image-ids $ami --query "Images[0].[Name,State,BlockDeviceMappings[0].Ebs.SnapshotId]" --output text

You should see something like this:

saat-web-20261020-1415   available       snap-0d1e2f3a4b5c69788

bake01 has done its job. Terminate it now; the image doesn’t need it any more:

aws ec2 terminate-instances --instance-ids $bake | Out-Null

3Create the launch template

Paste this whole block:

@'
{
  "ImageId": "AMI_ID",
  "InstanceType": "t3.micro",
  "SecurityGroupIds": ["APP_SG"],
  "IamInstanceProfile": { "Name": "saat-ec2-ssm-profile" },
  "MetadataOptions": { "HttpTokens": "required" },
  "TagSpecifications": [
    { "ResourceType": "instance", "Tags": [ { "Key": "Name", "Value": "web-lt" }, { "Key": "course", "Value": "saatvedha-aws" }, { "Key": "lesson", "Value": "15" } ] },
    { "ResourceType": "volume", "Tags": [ { "Key": "course", "Value": "saatvedha-aws" }, { "Key": "lesson", "Value": "15" } ] }
  ]
}
'@ -replace 'AMI_ID', $ami -replace 'APP_SG', $v.AppSg | Set-Content lt-v1.json
aws ec2 create-launch-template --launch-template-name saat-web-lt --version-description "v1 saat-web AMI" --launch-template-data file://lt-v1.json --query "LaunchTemplate.[LaunchTemplateName,DefaultVersionNumber]" --output text

You should see this:

saat-web-lt     1

4Launch two copies from $Default

Paste this whole block:

$ids = (aws ec2 run-instances --launch-template 'LaunchTemplateName=saat-web-lt,Version=$Default' --subnet-id $v.PrivateA --count 2 --query "Instances[].InstanceId" --output text) -split '\s+'
foreach ($i in $ids) { do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online') }
aws ssm start-session --target $ids[0] --document-name AWS-StartInteractiveCommand --parameters command="curl -s localhost"

You should see something like this:

Starting session with SessionId: yourname.admin-0b1c2d3e4f5a6b7c8
<h1>Hello from the saat-web AMI</h1>

Exiting session with sessionId: yourname.admin-0b1c2d3e4f5a6b7c8.

The page is there the moment the server boots. Nothing was installed at launch; it was all in the image. The single quotes around '...Version=$Default' stop PowerShell from treating $Default as one of its own variables.

✅ Checkpoint: saat-web-YYYYMMDD-HHMM is available, saat-web-lt version 1 is the default, and both copies serve the baked page. Keep everything for the break lab.