How to Launch an AWS EC2 Instance (Ubuntu) and Connect via SSH

In this guide you will launch an Ubuntu server on Amazon EC2 and log in to it. It takes about ten minutes. You need:

• An AWS account and an IAM user to sign in with. Don't use the root account for daily work.
• A terminal: Terminal on macOS or Linux, PowerShell or Command Prompt on Windows.
• The server name (my-backend-project) and key pair name (my-project) used below are examples. Use your own.

1. Sign in to the AWS Console with your IAM user.
2. Use the search bar at the top, type EC2 and open the service.

Before you create anything, check the region selector in the top-right corner and pick the region nearest to your users or your team, for example Asia Pacific (Hyderabad) ap-south-2.

On the EC2 dashboard click Launch instance.

Under Name and tags, set Name to something that tells you what the server is for, for example:

my-backend-project

This becomes the Name tag you will see in the instances list.

Under Application and OS Images (Amazon Machine Image), open the Quick Start tab and select Ubuntu. The console picks a current Ubuntu Server LTS Amazon Machine Image (AMI) for you. Keep that default.

An AMI is the template your server boots from, here the operating system. Because you chose Ubuntu, the default login user is ubuntu, which you will need when you connect.

The instance type sets how much CPU and memory your server gets. For a Node.js backend with a database and Nginx on the same machine, this guide uses t3.medium.

• vCPU is the number of virtual processor cores. RAM is the memory your app, database and operating system share.
• T3 instances are burstable. They run at a baseline CPU level and can burst higher for short periods, which suits most small web backends.
• Free tier rules depend on your account type and change over time. The console marks eligible types with a Free tier eligible label, so trust that label. t3.medium is not free, so if you only want to practise, choose an eligible type.

The key pair is how you prove who you are when you log in over SSH. AWS keeps the public half. You download the private half once.

1. Under Key pair (login) click Create new key pair.
2. Key pair name: my-project.
3. Key pair type: RSA.
4. Private key file format: .pem.
5. Click Create key pair.

The browser downloads my-project.pem. Then select that key pair in the dropdown.

Under Network settings you create the firewall rules (a security group) for the instance. You will see three checkboxes:

• Allow SSH traffic from: lets you connect to the instance. It is already checked.
• Allow HTTPS traffic from the internet: needed to serve a site or API over HTTPS. Check it.
• Allow HTTP traffic from the internet: needed to serve a site or API over HTTP. Check it.

Leave everything else on its defaults.

For now the default is fine. You will lock the rules down at the end of your deployment, once you know exactly which services your server runs.

Review the Summary panel (name, image, instance type, key pair, storage), then click Launch instance. The default storage is 8 GiB, which is enough for this walkthrough. Increase it if you plan to host a database or many uploads.

AWS shows a success message with your instance ID, for example i-0123456789abcdef0. Click it, or open EC2 → Instances, and wait:

• Instance state changes from Pending to Running.
• Status check changes from Initializing to 2/2 checks passed.

Once the instance is running and the checks pass, you can connect.

Click the instance ID to open its details page, then click Connect at the top right. There are two ways to log in.

ssh -i "my-project.pem" ubuntu@ec2-xx-xxx-xx-xxx.ap-south-2.compute.amazonaws.com

cd ~/Downloads
chmod 400 my-project.pem
ssh -i "my-project.pem" ubuntu@ec2-xx-xxx-xx-xxx.ap-south-2.compute.amazonaws.com

cd $HOME\Downloads
ssh -i "my-project.pem" ubuntu@ec2-xx-xxx-xx-xxx.ap-south-2.compute.amazonaws.com

icacls .\my-project.pem /inheritance:r
icacls .\my-project.pem /grant:r "$($env:USERNAME):(R)"

Run this in the terminal:

whoami

It should print:

ubuntu

Your Ubuntu server is up and you have shell access. You can also check the OS version and the memory it has:

lsb_release -a
free -h
nproc

• Connection timed out: port 22 is blocked for your current IP. Open the instance's security group, edit the inbound SSH rule and set the source to My IP. Your home IP changes from time to time, so update it when it does.
• Permissions 0644 for 'my-project.pem' are too open: run chmod 400 my-project.pem (macOS/Linux) or use the icacls commands from the Windows tab.
• Permission denied (publickey): you are using the wrong username or key. For Ubuntu the user is ubuntu, not ec2-user or root, and the key must be the one chosen at launch.
• No such file or directory for the key: your terminal is not in the folder that holds my-project.pem. Use cd to go there, or pass the full path to -i.
• Browser connect fails: the SSH rule is probably restricted to your IP. Use the SSH client instead.
• The address stopped working after a restart: the public DNS and public IP change when an instance is stopped and started. Copy the new address from the console, or attach an Elastic IP.

• Restrict SSH to your own /32 address once the setup is finished, and keep only the ports you actually use open.
• Attach an Elastic IP if the server needs a stable address, for example when you point a domain at it.
• Stop the instance when you don't need it, and terminate it (and delete unused storage) when you are done for good.
• Keep the .pem file private and back it up somewhere safe.

Your server is ready. The next step is installing the runtime, your app, a web server and SSL on it.