Compute & Storage: EC2 and S3

EC2 — Elastic Compute Cloud#

EC2 is AWS's core virtual server product: you rent a virtual machine ("instance") by the hour or second, choose its size, operating system, and location, and it's yours to configure however you like — install any software, run any process, keep it running 24/7 or terminate it in five minutes.

Instance types#

Instance types are grouped into families optimized for different workloads:

An instance type name like t3.medium encodes the family (t3) and size (medium) — larger sizes within the same family scale CPU, memory, and network throughput roughly proportionally. The practical takeaway: pick a family based on what your workload is actually bottlenecked on (CPU, memory, or disk I/O), and pick a size based on load testing, not guesswork — it's cheap to resize an instance later.

Security groups#

A security group is a virtual firewall attached to an EC2 instance (or other resources like RDS databases). It controls inbound and outbound traffic using allow rules — there is no explicit "deny" rule; anything not explicitly allowed is blocked by default.

A typical web server security group:

The security group is stateful — if you allow an inbound request, the matching outbound response is automatically allowed too, without needing a separate outbound rule for it. The most common real-world mistake is leaving SSH (port 22) open to 0.0.0.0/0 — restrict administrative access to known IP ranges or a bastion host, and never leave a database port open to the public internet at all (see the networking page for why databases belong in a private subnet instead).

S3 — Simple Storage Service#

S3 is AWS's object storage service. Rather than a filesystem you mount, S3 stores objects (files, effectively — of almost any size, up to 5TB per object) inside buckets (globally-unique-named containers), addressed by a key (essentially a path-like string):

Bucket: my-app-assets
 ├── images/logo.png
 ├── backups/2026-08-25-db.sql.gz
 └── uploads/user-42/avatar.jpg

Unlike an EC2 instance's disk, S3 has no server to manage, scales storage automatically without provisioning capacity ahead of time, and is designed for extremely high durability (AWS states "11 nines" of durability for S3 Standard — objects are automatically replicated across multiple Availability Zones).

Common S3 use cases#

• Static assets — images, videos, CSS/JS bundles for a website, often served through a CDN (CloudFront) in front of the bucket.
• Backups — database dumps, log archives, disaster-recovery snapshots, frequently moved to a cheaper storage class (Glacier) after an initial retention period.
• Data lake / analytics input — raw data files that analytics or machine learning pipelines read directly from S3.
• Static website hosting — S3 can serve an entire static site (HTML/CSS/JS, no backend) directly, with no EC2 instance involved at all.

A real aws s3 cp example#

# upload a local file to a bucket
aws s3 cp ./backup.sql.gz s3://my-app-backups/2026-08-25-backup.sql.gz

# download an object back down
aws s3 cp s3://my-app-backups/2026-08-25-backup.sql.gz ./restore.sql.gz

# sync an entire local directory to a bucket (only uploads changed/new files)
aws s3 sync ./dist s3://my-app-assets --delete

aws s3 sync (as opposed to repeated cp calls) is the standard way to deploy a whole directory of static assets — it only transfers files that changed since the last sync, and --delete removes objects in the bucket that no longer exist locally, keeping the two in sync exactly.

Common mistakes#

• Leaving an S3 bucket public when it should be private — a large share of real-world data leaks trace back to a misconfigured bucket policy or ACL.
• Opening a security group's SSH port to 0.0.0.0/0 instead of a known IP range.
• Picking an oversized EC2 instance "just in case" instead of load testing — this is one of the most common sources of wasted cloud spend.
• Storing large binary backups or media files on an EC2 instance's own disk instead of S3 — it doesn't scale, isn't as durable, and is harder to share across multiple instances.