Launching Ec2 Instance With Best Practices
This handles the full EC2 launch flow with opinionated defaults so you don't have to remember every security checkbox. It walks through AMI selection, instance sizing with burstable types, IAM roles with least privilege, hardened security groups, encrypted gp3 volumes, and tagging for cost tracking. The workflow includes network validation and post-launch verification steps. Honestly most useful if you're spinning up instances regularly and want guardrails against common mistakes like overly permissive security groups or unencrypted volumes. If you already have your own launch templates or infrastructure as code setup, you probably don't need this, but it's solid for ad hoc launches or teaching junior engineers the right way.
- skills.sh installs
- 6.8K
- GitHub stars
- 3.4K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add aws/agent-toolkit-for-aws --skill launching-ec2-instance-with-best-practices --agent claude-codeInstalls into .claude/skills of the current project.
Files
Launching EC2 Instances with Best Practices
Overview
Domain expertise for launching EC2 instances with sensible defaults optimized for security, cost-efficiency, and operational best practices. Covers AMI selection, instance type recommendation, network configuration, IAM role creation, security group hardening, storage configuration, tagging strategy, and post-launch verification.
Launch an EC2 instance
To launch a fully configured EC2 instance with best-practice defaults, follow the procedure exactly. See EC2 instance launch procedure.
The procedure handles:
- Intelligent defaults based on workload type and environment
- Network validation (VPC, subnet, public/private placement)
- AMI selection with architecture compatibility checks
- Least-privilege IAM roles for required AWS service access
- Hardened security groups with minimal port exposure
- Encrypted gp3 storage with environment-appropriate retention
- Comprehensive tagging for cost tracking and organization
- Post-launch verification and connection instructions
Troubleshooting
Insufficient instance capacity
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/aws/agent-toolkit-for-aws
- Categories
- Security, AI & Agent Building, Cloud & Infrastructure
- First seen
- Jun 3, 2026
More from aws/agent-toolkit-for-aws
All 56- Troubleshooting S3 Files6.7K
- Creating Api Gateway Stage6.7K
- Setting Up Ec2 Instance Profiles6.6K
- Creating Production Vpc Multi Az6.6K
- Signing In To Aws6.6K
- Aws Transform6.5K
- Connecting Vpcs With Peering6.5K
- Enabling Lambda Vpc Internet Access6.5K
- Exporting Rds To S36.5K
- Setting Up Cloudtrail Multi Region6.5K
- Routing Traffic With Route53 And Cloudfront6.5K
- Creating Amazon Aurora Db Cluster With Instances6.4K
- Troubleshooting Efs6.3K
- Aws Lambda Durable Functions6.2K
- Aws Lambda Managed Instances6.2K
- Aws Cleanrooms6.1K
- Aws Lambda Microvms6.1K
- Amazon Aurora Postgresql6K
- Querying Aws S36K
- Amazon Opensearch Service6K
- Aws Blocks5.9K
- Querying Aws Cloudwatch5.9K
- Amazon Elasticache5.9K
- Amazon Aurora Mysql5.7K
Recommended
More Security
dx-code-analyzer-runforcedotcom/sf-skillsRun Salesforce Code Analyzer to scan code for security, performance, best practice, and code style violations. Supports all engines (PMD, ESLint, CPD, RetireJS,6.7Kskills.sh installs
creating-production-vpc-multi-azaws/agent-toolkit-for-awsCreates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and s6.6Kskills.sh installsconnecting-vpcs-with-peeringaws/agent-toolkit-for-awsEstablishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it v6.5Kskills.sh installsenabling-lambda-vpc-internet-accessaws/agent-toolkit-for-awsEnables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and 6.5Kskills.sh installsexporting-rds-to-s3aws/agent-toolkit-for-awsExports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration. Handles snapshot selection or cr6.5Kskills.sh installs
insecure-defaultstrailofbits/skillsDetects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing secur6.5Kskills.sh installs