Setting the chapter. One moment.
AWS Agents For Devsecops
AWS Core
Core Skills · AWS…
Messaging And Streaming Skills
Migration And Modernization Skills
Networking And Content Delivery Skills
Security And Identity Skills
System Table Skills
Web And Mobile Development
120 chapters · 648 min
Core Skills
Chapter 30 of 120
Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates…
4 minutes · 881 words · 8 sections
Best experience with the AWS MCP server; also works with the AWS CLI alone — no hard dependency on either.
Launch configurations are deprecated and do not support current EC2 instance types; new accounts cannot create them. Use launch templates for every new Auto Scaling group. See auto-scaling.md (opens in a new tab).
ASGs ignore ELB health checks by default: An Auto Scaling group only uses EC2 status checks unless you set --health-check-type ELB. Without it, instances failing the load balancer’s health check stay in service forever. See auto-scaling.md (opens in a new tab).
IMDSv2 hop limit breaks containers: the default HttpPutResponseHopLimit of 1 makes the IMDSv2 token PUT response fail to reach a containerized process (the extra hop exceeds the response TTL), so the token request times out. Set HttpPutResponseHopLimit=2 for bridge/awsvpc container workloads. (If IMDSv2 is required, a subsequent tokenless GET returns 401; if optional, it silently falls back to IMDSv1.) See provisioning.md (opens in a new tab).
T3/T3a/T4g default to unlimited mode: Unlike T2 (standard), these burst without throttling but bill surplus CPU credits when 24h-average CPU exceeds baseline — a silent cost leak. See instance-selection.md (opens in a new tab).
Instance store is ephemeral: Data on instance store volumes is lost on stop, hibernate, terminate, instance-type change, and host failure — it survives only a reboot. Put anything durable on EBS/EFS/S3. See instance-selection.md (opens in a new tab).
| If you’re deciding… | Guidance |
|---|---|
| Instance family / size / Graviton / GPU / burstable | instance-selection.md (opens in a new tab) — start with the workload→family table |
| How to define instances once and reuse (launch template) | provisioning.md (opens in a new tab) |
| How to run many instances that scale automatically | auto-scaling.md (opens in a new tab) |
| How to access/patch/manage instances without SSH keys | systems-manager.md |
| You want to… | Go to |
|---|---|
| Pick an instance type, Graviton vs x86, burstable credits, GPU, instance store vs EBS | instance-selection.md (opens in a new tab) |
| Create a launch template, user data, key pairs, IMDSv2, placement groups, Elastic IPs | provisioning.md (opens in a new tab) |
| Set up or fix an Auto Scaling group, scaling policies, instance refresh, Spot, lifecycle hooks | auto-scaling.md (opens in a new tab) |
| Get SSH-less access, patch a fleet, or fix an instance not showing as a managed node | systems-manager.md |
“Stand up an autoscaling web fleet” → Create a launch template (AMI, type, IMDSv2), then an ASG referencing it with --health-check-type ELB and a target-tracking policy, see auto-scaling.md (opens in a new tab). For the public entry point, secure the load balancer (TLS/ACM, WAF, security response headers) per the Security Considerations below and the load-balancer notes in auto-scaling.md (opens in a new tab) — the load-balancer build itself belongs to aws-networking.
“Roll out a new AMI to my fleet” → New launch template version → instance refresh; pin a numeric launch-template version so rollback works, see auto-scaling.md (opens in a new tab).
“Connect to a private instance without a bastion” → Give the instance SSM permissions (an instance profile with AmazonSSMManagedInstanceCore, or account-level DHMC) plus a network path, then use Session Manager, see systems-manager.md (opens in a new tab).
“Cut EC2 cost” → Right-size (burstable vs fixed-performance), Graviton where the app supports Arm64, Spot with price-capacity-optimized for fault-tolerant fleets, release idle Elastic IPs, see instance-selection.md (opens in a new tab).
| Symptom | Likely cause | Quick fix |
|---|---|---|
| SSH “Connection timed out” | Network path (SG/NACL/route/no public IP) | Open TCP 22 from your IP; check route to IGW; verify public IP — see troubleshooting.md (opens in a new tab) |
| SSH “Connection refused” | Host: sshd down or still booting | Wait for boot; check sshd/port via Session Manager or serial console |
InsufficientInstanceCapacity | AWS lacks capacity of that type in the AZ (NOT a quota) | Try another AZ / instance type / retry; don’t request a quota increase |
InstanceLimitExceeded | vCPU quota reached (this IS a quota) | Request a Service Quotas increase for the instance family |
| ASG never replaces LB-unhealthy instances | Health check type still EC2 | Set --health-check-type ELB |
Instances stuck in Pending:Wait, terminated after ~1h | Lifecycle hook never completed (heartbeat 3600s, default ABANDON) | Call complete-lifecycle-action CONTINUE, or set DefaultResult CONTINUE |
| System status check failed | AWS host/hardware | Stop/start to migrate to new hardware (reboot won’t) |
| Instance status check failed | Instance OS/network config | Reboot or fix the OS/network config |
Full tables and more errors in troubleshooting.md (opens in a new tab).
HttpTokens=required) on launch templates to block SSRF-based credential theft; set the account-level default per Region (applies to new launches only).aws/ebs key can’t be shared).RunInstances/TerminateInstances from unexpected principals) so unauthorized changes surface.aws-networking.launching-ec2-instance-with-best-practices skillsetting-up-ec2-instance-profiles skillcreating-ec2-image-builder-pipeline skillaws-serverless; ECS/Fargate → aws-containers; EKS/Kubernetes → kubernetesaws-networking or built-in knowledgeaws-iam, aws-observabilityInstall this repository
npx skills add aws/agent-toolkit-for-aws/plugin marketplace add aws/agent-toolkit-for-awsSkills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.
Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools, lifecycle hooks), IMDSv2, placement groups, Elastic IPs, AMI lifecycle, and Systems Manager fleet operations (Session Manager, Run Command, Patch Manager). Applies to EC2 instance and fleet questions, InsufficientInstanceCapacity, CPU-credit/surplus charges, IMDSv2 401s, instances stuck in Pending:Wait, ASG not replacing unhealthy instances, status-check failures, SSH refused/timed out, or instances missing as SSM managed nodes. For a single secure instance launch, the launching-ec2-instance-with-best-practices skill is more appropriate; for instance profiles, see setting-up-ec2-instance-profiles; for Image Builder, see creating-ec2-image-builder-pipeline. Does NOT cover Lambda, ECS/Fargate, EKS, VPC/ALB/NLB design, or IAM policy authoring.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
skills/core-skills/aws-compute/SKILL.mdmain, last pushed 10 August 2026.SKILL.md, not by matching a directory convention. 17 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md.| Create, share, or retire (deprecate/disable/deregister) an AMI | ami-management.md (opens in a new tab) |
| Fix something broken (can’t connect, status-check fail, capacity error, stuck instances) | troubleshooting.md (opens in a new tab) |
skills/specialized-skills/storage-skills/*/SKILL.mdskills/specialized-skills/system-table-skills/*/SKILL.mdskills/specialized-skills/web-and-mobile-development/*/SKILL.mdh1 and no skipped levels:.claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree./aws/agent-toolkit-for-aws.md, and each chapter at its own .md URL.6 files · 44 KB
Everything this skill ships beside its prose. All of it is set here, as subchapters of chapter 30.
Documentation the agent loads on demand, rather than up front.