EC2

# Launch instance
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t3.micro \
  --key-name my-keypair \
  --security-group-ids sg-0abc123 \
  --subnet-id subnet-0abc123 \
  --count 1 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-server}]'

# Terminate
aws ec2 terminate-instances --instance-ids i-0abc123def456

# Stop / Start / Reboot
aws ec2 stop-instances   --instance-ids i-0abc123
aws ec2 start-instances  --instance-ids i-0abc123
aws ec2 reboot-instances --instance-ids i-0abc123

# All instances (table view)
aws ec2 describe-instances --output table

# Filter by state
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running"

# Filter by tag
aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=web-server"

# Get public IPs of running instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].[InstanceId,PublicIpAddress,Tags[?Key==`Name`].Value|[0]]' \
  --output table

aws ec2 create-key-pair --key-name my-keypair \
  --query 'KeyMaterial' --output text > my-keypair.pem
chmod 400 my-keypair.pem

aws ec2 describe-key-pairs
aws ec2 delete-key-pair --key-name my-keypair

# Import existing public key
aws ec2 import-key-pair --key-name my-keypair \
  --public-key-material fileb://~/.ssh/id_rsa.pub

# Create
aws ec2 create-security-group \
  --group-name my-sg \
  --description "Web server SG" \
  --vpc-id vpc-0abc123

# Allow SSH from a specific IP
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp --port 22 \
  --cidr 203.0.113.0/24

# Allow HTTP from anywhere
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp --port 80 --cidr 0.0.0.0/0

# Revoke a rule
aws ec2 revoke-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp --port 22 --cidr 0.0.0.0/0

aws ec2 describe-security-groups --group-ids sg-0abc123
aws ec2 delete-security-group --group-id sg-0abc123

# Create AMI from running instance
aws ec2 create-image \
  --instance-id i-0abc123 \
  --name "my-app-v1.0" \
  --no-reboot

# List your AMIs
aws ec2 describe-images --owners self \
  --query 'Images[*].[ImageId,Name,CreationDate]' --output table

# Find latest Amazon Linux 2023 AMI
aws ec2 describe-images \
  --owners amazon \
  --filters "Name=name,Values=al2023-ami-*-x86_64" \
           "Name=state,Values=available" \
  --query 'sort_by(Images, &CreationDate)[-1].ImageId' \
  --output text

# Deregister AMI
aws ec2 deregister-image --image-id ami-0abc123

# Create volume
aws ec2 create-volume \
  --size 20 \
  --volume-type gp3 \
  --availability-zone us-east-1a

# Attach to instance
aws ec2 attach-volume \
  --volume-id vol-0abc123 \
  --instance-id i-0abc123 \
  --device /dev/xvdf

# Detach
aws ec2 detach-volume --volume-id vol-0abc123

# Create snapshot
aws ec2 create-snapshot \
  --volume-id vol-0abc123 \
  --description "backup-2024-01"

# List snapshots
aws ec2 describe-snapshots --owner-ids self \
  --query 'Snapshots[*].[SnapshotId,VolumeSize,StartTime,Description]' \
  --output table

aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t3.micro \
  --user-data file://init.sh \
  ...

# init.sh
#!/bin/bash
yum update -y
yum install -y nginx
systemctl enable --now nginx

# Allocate
aws ec2 allocate-address --domain vpc

# Associate with instance
aws ec2 associate-address \
  --instance-id i-0abc123 \
  --allocation-id eipalloc-0abc123

# Release (to avoid charges when unattached)
aws ec2 release-address --allocation-id eipalloc-0abc123

aws ec2 describe-addresses

# Create launch template
aws ec2 create-launch-template \
  --launch-template-name web-lt \
  --version-description "v1" \
  --launch-template-data file://lt-data.json

# Create Auto Scaling group
aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name web-asg \
  --launch-template "LaunchTemplateName=web-lt,Version=1" \
  --min-size 1 --max-size 5 --desired-capacity 2 \
  --vpc-zone-identifier "subnet-0abc,subnet-0def"

# Scale manually
aws autoscaling set-desired-capacity \
  --auto-scaling-group-name web-asg \
  --desired-capacity 3

# IMDSv2 (recommended)
TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")

curl -s http://169.254.169.254/latest/meta-data/instance-id \
  -H "X-aws-ec2-metadata-token: $TOKEN"

curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ \
  -H "X-aws-ec2-metadata-token: $TOKEN"

aws ec2 create-placement-group --group-name my-pg --strategy cluster