Launch your first EC2 instance (Linux)

Start as usual and load the network:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Find the latest Amazon Linux 2023 image

Run this:

$ami = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$ami

You should see something like this (the ID changes as AWS publishes updates):

ami-0a3c14e1ddbe7f23c

2Create a key pair and lock down the key file

Paste this whole block:

$key = aws ec2 create-key-pair --key-name saat-key --key-type ed25519 --key-format pem --tag-specifications 'ResourceType=key-pair,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=11}]' --query KeyMaterial --output text
[IO.File]::WriteAllText('C:\aws-lab\saat-key.pem', (($key -join "`n") + "`n"))
icacls C:\aws-lab\saat-key.pem /inheritance:r /grant:r "$($env:USERNAME):(R)"

The last command should end with:

Successfully processed 1 files; Failed processing 0 files

AWS shows the private key only once. WriteAllText keeps Linux line endings, and icacls removes everyone else’s access, which SSH insists on.

3Allow SSH from your IP only

Paste this whole block:

$myip = (Invoke-RestMethod https://checkip.amazonaws.com).Trim()
$sshSg = aws ec2 create-security-group --group-name saat-ssh-temp --description "SSH from one admin IP (temporary)" --vpc-id $v.VpcId --tag-specifications 'ResourceType=security-group,Tags=[{Key=Name,Value=saat-ssh-temp},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=11}]' --query GroupId --output text
aws ec2 authorize-security-group-ingress --group-id $sshSg --protocol tcp --port 22 --cidr "$myip/32" | Out-Null
"SSH allowed from $myip"

4Write the user data script with Linux line endings

Paste this whole block:

$ud = @'
#!/bin/bash
dnf install -y nginx
echo "<h1>Hello from web01</h1>" > /usr/share/nginx/html/index.html
systemctl enable --now nginx
'@
[IO.File]::WriteAllText('C:\aws-lab\web01-userdata.sh', ($ud -replace "`r`n", "`n"))

5Launch web01

Paste this whole block (the wait line takes two to three minutes):

$id = aws ec2 run-instances --image-id $ami --instance-type t3.micro --key-name saat-key --subnet-id $v.PublicA --security-group-ids $v.WebSg $sshSg --user-data file://web01-userdata.sh --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web01},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=11},{Key=owner,Value=yourname.admin}]' 'ResourceType=volume,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=11}]' --query "Instances[0].InstanceId" --output text
aws ec2 wait instance-status-ok --instance-ids $id
$ip = aws ec2 describe-instances --instance-ids $id --query "Reservations[0].Instances[0].PublicIpAddress" --output text
aws ec2 describe-instances --instance-ids $id --query "Reservations[0].Instances[0].[InstanceId,State.Name,InstanceType,Placement.AvailabilityZone,PublicIpAddress]" --output text

You should see something like this:

i-0d1e2f3a4b5c6d7e8       running t3.micro        ap-south-1a     13.204.91.17

6Open the page and connect with SSH

Run this:

(Invoke-WebRequest "http://$ip" -UseBasicParsing).Content
ssh -i C:\aws-lab\saat-key.pem ec2-user@$ip "grep PRETTY /etc/os-release; ec2-metadata --availability-zone"

Type yes the first time SSH asks about the host key. You should see something like this:

<h1>Hello from web01</h1>
PRETTY_NAME="Amazon Linux 2023.9.20251014"
placement: ap-south-1a

You can also paste http:// plus the IP into your browser. ec2-metadata reads instance metadata with an IMDSv2 token for you.

7Stop and start: watch the IP change

Paste this whole block (about two minutes):

aws ec2 stop-instances --instance-ids $id | Out-Null
aws ec2 wait instance-stopped --instance-ids $id
aws ec2 start-instances --instance-ids $id | Out-Null
aws ec2 wait instance-running --instance-ids $id
$ip2 = aws ec2 describe-instances --instance-ids $id --query "Reservations[0].Instances[0].PublicIpAddress" --output text
"Before: $ip   After: $ip2"

You should see two different addresses, something like this:

Before: 13.204.91.17   After: 3.110.42.205

Lesson 19 puts a DNS name in front of servers, and Lesson 20 a load balancer, so nobody depends on an IP that can change.

✅ Checkpoint: web01 is running, the page says “Hello from web01”, SSH worked only with your protected key, and the public IP changed after stop and start. Keep web01 for the break lab; cleanup is at its end.