Home / AWS

AWSChecklistBeginner

Standalone EC2 instance production build: IMDSv2, gp3, SSM, backup and recovery

A checklist for a single production EC2 instance that is secure, patchable, recoverable and monitored, plus the auto-recovery settings that limit downtime from host failures.

Deepak Bhardwaj2 min read

Applies toAmazon EC2 (Linux and Windows), Systems Manager, AWS Backup

Launch settings

  • Instance type from measured load; current generation (for example m7i/m7g, r7i) with Nitro.
  • Private subnet; no public IP. Access through SSM Session Manager (no SSH/RDP open, no bastion to patch).
  • IMDSv2 required (blocks a whole class of SSRF credential theft).
  • Instance profile with least-privilege IAM role; AmazonSSMManagedInstanceCore for SSM.
  • Termination protection and stop protection for production.
aws ec2 modify-instance-metadata-options --instance-id i-0abc123 --http-tokens required --http-endpoint enabled
aws ec2 modify-instance-attribute --instance-id i-0abc123 --disable-api-termination

Storage

  • EBS gp3 (set IOPS/throughput explicitly; cheaper than gp2) or io2 for critical databases.
  • EBS encryption by default enabled in the account/region.
  • Data on separate volumes from the OS. Don't keep anything important on instance store volumes (lost on stop).
aws ec2 enable-ebs-encryption-by-default --region ap-south-1
aws ec2 modify-volume --volume-id vol-0abc --volume-type gp3 --iops 6000 --throughput 250

Recovery from host failures

  • Simplified automatic recovery (default for supported instance types) or a CloudWatch alarm on StatusCheckFailed_System with the EC2 recover action:
aws cloudwatch put-metric-alarm --alarm-name i-0abc123-auto-recover \
  --namespace AWS/EC2 --metric-name StatusCheckFailed_System --statistic Maximum \
  --dimensions Name=InstanceId,Value=i-0abc123 --period 60 --evaluation-periods 2 \
  --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions arn:aws:automate:ap-south-1:ec2:recover

Recovery keeps the instance ID, private IPs, Elastic IPs and EBS volumes.

Backup

  • AWS Backup plan selected by tag (Backup=daily), with retention and a copy to the DR region for region-level recovery.
  • Windows: VSS-enabled backups; Linux databases: application-consistent backup via scripts or native DB backups to S3.
  • Restore tested into a separate subnet.

Patching and config

  • SSM Patch Manager with a maintenance window and patch baseline.
  • SSM Inventory and State Manager associations (agent updates, CloudWatch agent config).

Monitoring

  • CloudWatch agent for memory and disk (not available by default).
  • Alarms: status checks, CPU, memory, disk used %, EBS burst/throughput if relevant.

Single-instance limits (tell the customer)

Failure Result
Underlying host failure Auto recovery, minutes of downtime
Instance OS failure (StatusCheckFailed_Instance) Reboot action or manual fix
AZ outage Down until the AZ recovers, or restore from backup into another AZ
Region outage Restore from cross-region backup copy

If that downtime isn't acceptable, the next step is an Auto Scaling group across AZs behind an ALB (see the Multi-AZ post).

Related fixes