Back to Details

aws-compute

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Amazon EC2 Compute

Amazon EC2 计算服务

Best experience with the AWS MCP server; also works with the AWS CLI alone — no hard dependency on either.
在AWS MCP服务器上使用体验最佳；也可单独配合AWS CLI使用——无强制依赖。

Critical Warnings

重要警告

Launch configurations are deprecated and do not support current EC2 instance types; new accounts cannot create them. Use launch templates for every new Auto Scaling group. See auto-scaling.md.
ASGs ignore ELB health checks by default: An Auto Scaling group only uses EC2 status checks unless you set 
--health-check-type ELB
. Without it, instances failing the load balancer's health check stay in service forever. See auto-scaling.md.
IMDSv2 hop limit breaks containers: the default 
HttpPutResponseHopLimit
of 1 makes the IMDSv2 token PUT response fail to reach a containerized process (the extra hop exceeds the response TTL), so the token request times out. Set 
HttpPutResponseHopLimit=2
for bridge/awsvpc container workloads. (If IMDSv2 is required, a subsequent tokenless GET returns 
401
; if optional, it silently falls back to IMDSv1.) See provisioning.md.
T3/T3a/T4g default to unlimited mode: Unlike T2 (standard), these burst without throttling but bill surplus CPU credits when 24h-average CPU exceeds baseline — a silent cost leak. See instance-selection.md.
Instance store is ephemeral: Data on instance store volumes is lost on stop, hibernate, terminate, instance-type change, and host failure — it survives only a reboot. Put anything durable on EBS/EFS/S3. See instance-selection.md.
启动配置已被弃用，且不支持当前EC2实例类型；新账户无法创建启动配置。所有新的Auto Scaling组请使用启动模板。详见auto-scaling.md。
ASG默认忽略ELB健康检查：Auto Scaling组默认仅使用EC2状态检查，除非设置
--health-check-type ELB
。若未设置，未通过负载均衡器健康检查的实例会一直处于服务状态。详见auto-scaling.md。
IMDSv2跳数限制会导致容器故障：默认的
HttpPutResponseHopLimit
值为1，会使IMDSv2令牌PUT请求无法到达容器化进程（额外的跳数超过了响应TTL），导致令牌请求超时。对于bridge/awsvpc容器工作负载，请设置
HttpPutResponseHopLimit=2
。（如果强制要求IMDSv2，后续无令牌的GET请求会返回
401
；如果是可选模式，则会自动回退到IMDSv1。）详见provisioning.md。
T3/T3a/T4g默认采用无限制模式：与T2（标准模式）不同，这些实例可无限制突增，但当24小时平均CPU使用率超过基线时，会收取超额CPU信用费用——这是一种隐性成本损耗。详见instance-selection.md。
实例存储是临时的：实例存储卷上的数据会在停止、休眠、终止、实例类型变更或主机故障时丢失——仅重启时会保留。所有需要持久化的数据请存储在EBS/EFS/S3上。详见instance-selection.md。

Which do you need?

你需要哪个指南？

If you're deciding...Guidance
Instance family / size / Graviton / GPU / burstableinstance-selection.md — start with the workload→family table
How to define instances once and reuse (launch template)provisioning.md
How to run many instances that scale automaticallyauto-scaling.md
How to access/patch/manage instances without SSH keyssystems-manager.md
如果你正在决定...指引
实例系列/规格/Graviton/GPU/可突增实例instance-selection.md — 从工作负载→实例系列对照表开始
如何一次性定义实例并重复使用（启动模板）provisioning.md
如何运行可自动扩展的多实例集群auto-scaling.md
如何无需SSH密钥即可访问/补丁/管理实例systems-manager.md

Quick Navigation

快速导航

You want to...Go to
Pick an instance type, Graviton vs x86, burstable credits, GPU, instance store vs EBSinstance-selection.md
Create a launch template, user data, key pairs, IMDSv2, placement groups, Elastic IPsprovisioning.md
Set up or fix an Auto Scaling group, scaling policies, instance refresh, Spot, lifecycle hooksauto-scaling.md
Get SSH-less access, patch a fleet, or fix an instance not showing as a managed nodesystems-manager.md
Create, share, or retire (deprecate/disable/deregister) an AMIami-management.md
Fix something broken (can't connect, status-check fail, capacity error, stuck instances)troubleshooting.md
你想要...前往
选择实例类型、Graviton vs x86、可突增信用、GPU、实例存储 vs EBSinstance-selection.md
创建启动模板、用户数据、密钥对、IMDSv2、放置组、弹性IPprovisioning.md
搭建或修复Auto Scaling组、扩展策略、实例刷新、Spot实例、生命周期钩子auto-scaling.md
实现无SSH访问、给集群打补丁，或修复未显示为受管节点的实例systems-manager.md
创建、共享或淘汰（弃用/禁用/注销）AMIami-management.md
修复故障（无法连接、状态检查失败、容量错误、实例卡住）troubleshooting.md

Common Workflows

常见工作流

"Stand up an autoscaling web fleet" → Create a launch template (AMI, type, IMDSv2), then an ASG referencing it with 
--health-check-type ELB
and a target-tracking policy, see auto-scaling.md. For the public entry point, secure the load balancer (TLS/ACM, WAF, security response headers) per the Security Considerations below and the load-balancer notes in auto-scaling.md — the load-balancer build itself belongs to 
aws-networking
.
"Roll out a new AMI to my fleet" → New launch template version → instance refresh; pin a numeric launch-template version so rollback works, see auto-scaling.md.
"Connect to a private instance without a bastion" → Give the instance SSM permissions (an instance profile with 
AmazonSSMManagedInstanceCore
, or account-level DHMC) plus a network path, then use Session Manager, see systems-manager.md.
"Cut EC2 cost" → Right-size (burstable vs fixed-performance), Graviton where the app supports Arm64, Spot with 
price-capacity-optimized
for fault-tolerant fleets, release idle Elastic IPs, see instance-selection.md.
"搭建自动扩展的Web集群" → 创建启动模板（AMI、实例类型、IMDSv2），然后创建引用该模板的ASG，设置
--health-check-type ELB
和目标追踪策略，详见auto-scaling.md。对于公共入口点，请根据下方安全注意事项和auto-scaling.md中的负载均衡器说明，对负载均衡器进行安全配置（TLS/ACM、WAF、安全响应头）——负载均衡器的搭建本身属于
aws-networking
范畴。
"将新AMI推送到我的集群" → 创建新的启动模板版本→执行实例刷新；固定启动模板的数字版本，以便回滚操作生效，详见auto-scaling.md。
"无需堡垒机即可连接私有实例" → 为实例赋予SSM权限（带有
AmazonSSMManagedInstanceCore
的实例配置文件，或账户级DHMC）并确保网络路径可用，然后使用Session Manager，详见systems-manager.md。
"降低EC2成本" → 优化实例规格（可突增型 vs 固定性能型）、在应用支持Arm64的情况下使用Graviton、对容错集群使用
price-capacity-optimized
模式的Spot实例、释放闲置的弹性IP，详见instance-selection.md。

Troubleshooting

故障排查

SymptomLikely causeQuick fix
SSH "Connection timed out"Network path (SG/NACL/route/no public IP)Open TCP 22 from your IP; check route to IGW; verify public IP — see troubleshooting.md
SSH "Connection refused"Host: sshd down or still bootingWait for boot; check sshd/port via Session Manager or serial console
InsufficientInstanceCapacity
AWS lacks capacity of that type in the AZ (NOT a quota)Try another AZ / instance type / retry; don't request a quota increase
InstanceLimitExceeded
vCPU quota reached (this IS a quota)Request a Service Quotas increase for the instance family
ASG never replaces LB-unhealthy instancesHealth check type still EC2Set 
--health-check-type ELB
Instances stuck in 
Pending:Wait
, terminated after ~1h		Lifecycle hook never completed (heartbeat 3600s, default ABANDON)Call 
complete-lifecycle-action
CONTINUE, or set DefaultResult CONTINUE
System status check failedAWS host/hardwareStop/start to migrate to new hardware (reboot won't)
Instance status check failedInstance OS/network configReboot or fix the OS/network config
Full tables and more errors in troubleshooting.md.
症状可能原因快速修复
SSH "连接超时"网络路径问题（安全组/NACL/路由/无公网IP）从你的IP开放TCP 22端口；检查到IGW的路由；验证公网IP — 详见troubleshooting.md
SSH "连接被拒绝"主机问题：sshd未启动或仍在启动中等待启动完成；通过Session Manager或串行控制台检查sshd/端口状态
InsufficientInstanceCapacity
AWS在该可用区缺少对应类型的实例容量（不是配额问题）尝试其他可用区/实例类型/重试；不要申请配额提升
InstanceLimitExceeded
已达到vCPU配额（这属于配额问题）针对对应实例系列申请服务配额提升
ASG从未替换LB不健康的实例健康检查类型仍为EC2设置
--health-check-type ELB
实例卡在
Pending:Wait
状态，约1小时后被终止		生命周期钩子未完成（心跳超时3600秒，默认操作是ABANDON）调用
complete-lifecycle-action
并指定CONTINUE，或设置DefaultResult为CONTINUE
系统状态检查失败AWS主机/硬件问题停止/启动实例以迁移到新硬件（重启无效）
实例状态检查失败实例操作系统/网络配置问题重启实例或修复操作系统/网络配置
完整表格和更多错误信息请见troubleshooting.md。

Security Considerations

安全注意事项

  • Enforce IMDSv2 (
    HttpTokens=required
    ) on launch templates to block SSRF-based credential theft; set the account-level default per Region (applies to new launches only).
  • Prefer Session Manager over inbound SSH — no open port 22, no key management, and a CloudTrail record of session API calls; enable Session Manager session logging to CloudWatch Logs/S3 (off by default) to capture the in-session commands themselves — see systems-manager.md.
  • Use instance profiles, never embedded credentials; scope the role to least privilege.
  • Encrypt EBS/AMIs; to share an encrypted AMI cross-account, re-encrypt under a customer-managed KMS key (the default 
    aws/ebs
    key can't be shared).
  • Enable CloudTrail in all Regions to audit EC2/ASG/SSM API activity, and alarm on sensitive actions (security-group changes, 
    RunInstances
    /
    TerminateInstances
    from unexpected principals) so unauthorized changes surface.
  • For public-facing web fleets, encrypt traffic in transit with an ACM certificate on the load balancer's HTTPS listener and add AWS WAF for defense in depth against common web exploits — the load-balancer/WAF setup itself lives in 
    aws-networking
    .
  • For hardening beyond this guidance, see AWS EC2 security best practices and CIS Benchmarks for the guest OS.
  • 强制启用IMDSv2：在启动模板中设置
    HttpTokens=required
    ，以阻止基于SSRF的凭证窃取；按区域设置账户级默认值（仅适用于新启动的实例）。
  • 优先使用Session Manager而非入站SSH — 无需开放22端口，无需密钥管理，且CloudTrail会记录会话API调用；启用Session Manager会话日志到CloudWatch Logs/S3（默认关闭），以捕获会话内的命令操作 — 详见systems-manager.md。
  • 使用实例配置文件，切勿嵌入凭证；将角色权限限制为最小必要权限。
  • 加密EBS/AMI；若要跨账户共享加密AMI，请使用客户管理的KMS密钥重新加密（默认的
    aws/ebs
    密钥无法共享）。
  • 在所有区域启用CloudTrail，以审计EC2/ASG/SSM API活动，并对敏感操作（安全组变更、来自非预期主体的
    RunInstances
    /
    TerminateInstances
    操作）设置告警，以便及时发现未授权变更。
  • 对于面向公网的Web集群，在负载均衡器的HTTPS监听器上使用ACM证书加密传输中的流量，并添加AWS WAF以深度防御常见Web漏洞 — 负载均衡器/WAF的配置本身属于
    aws-networking
    范畴。
  • 如需本指南之外的加固建议，请参考AWS EC2安全最佳实践和针对客户操作系统的CIS基准。

Not Covered By This Skill

本技能未涵盖的内容

  • Launching a single hardened instance with best-practice defaults → use the 
    launching-ec2-instance-with-best-practices
    skill
  • Creating IAM roles / instance profiles for EC2 → use the 
    setting-up-ec2-instance-profiles
    skill
  • Building AMIs with an Image Builder pipeline → use the 
    creating-ec2-image-builder-pipeline
    skill
  • Lambda / serverless → 
    aws-serverless
    ; ECS/Fargate → 
    aws-containers
    ; EKS/Kubernetes → 
    kubernetes
  • VPC, subnets, ALB/NLB, endpoints → 
    aws-networking
    or built-in knowledge
  • IAM policy logic and CloudWatch dashboards/agent setup → 
    aws-iam
    , 
    aws-observability
  • 使用最佳实践默认值启动单个加固实例 → 使用
    launching-ec2-instance-with-best-practices
    技能
  • 为EC2创建IAM角色/实例配置文件 → 使用
    setting-up-ec2-instance-profiles
    技能
  • 通过Image Builder流水线构建AMI → 使用
    creating-ec2-image-builder-pipeline
    技能
  • Lambda/无服务器 → 
    aws-serverless
    ；ECS/Fargate → 
    aws-containers
    ；EKS/Kubernetes → 
    kubernetes
  • VPC、子网、ALB/NLB、端点 → 
    aws-networking
    或内置知识
  • IAM策略逻辑和CloudWatch仪表盘/代理配置 → 
    aws-iam
    、
    aws-observability