AWS Compute
AWSOfficialPublished by AWS
- Skill
- Tool integration
- Cloud and DevOps
- Apache-2.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides operational guidance for Amazon EC2, covering the full lifecycle of virtual machine workloads. It addresses instance-type selection, launch template configuration, Auto Scaling group (ASG) management, and fleet operations via AWS Systems Manager. It is designed to help users navigate common pitfalls like IMDSv2 configuration, health check settings, and cost-optimization strategies for burstable instances, while providing clear troubleshooting paths for connectivity, capacity, and status-check failures.
What it does
- Guides instance-type selection including Graviton, GPU, and burstable T-series options.
- Configures Auto Scaling groups with scaling policies, instance refresh, and lifecycle hooks.
- Manages AMI lifecycles including deprecation, disabling, and cross-account sharing.
- Facilitates fleet operations like patching and SSH-less access via Systems Manager.
- Provides troubleshooting steps for common EC2 errors like InsufficientInstanceCapacity and status-check failures.
- Enforces security best practices such as IMDSv2 and instance profile usage.
When to use it
- When designing or scaling an EC2-based compute fleet.
- When troubleshooting connectivity, capacity, or health check issues in an ASG.
- When optimizing EC2 costs through instance-type selection or Spot instance usage.
- When performing rolling updates or AMI migrations across a fleet.
- When configuring secure, SSH-less management for private instances.
Advantages
- Centralizes complex EC2 operational knowledge and common configuration pitfalls.
- Provides actionable troubleshooting tables for rapid incident resolution.
- Promotes security-first configurations like IMDSv2 and Session Manager.
- Clarifies the distinction between deprecated and modern provisioning methods.
- Offers clear guidance on cost-saving strategies like Graviton and Spot instances.
Usage examples
- “How do I ensure my Auto Scaling group replaces instances that fail my load balancer health checks?”
- The agent explains that ASGs ignore ELB health checks by default and provides the command to set --health-check-type ELB.
- “My instances are stuck in Pending:Wait state, what is happening?”
- The agent identifies that a lifecycle hook is likely waiting for a heartbeat and provides the command to complete the action.
- “How can I safely roll out a new AMI to my existing fleet?”
- The agent details the process of updating the launch template to a specific version and initiating an instance refresh.
- “Why am I getting an InsufficientInstanceCapacity error?”
- The agent clarifies that this is an AWS capacity issue in a specific AZ, not a user quota, and suggests trying a different AZ or instance type.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/aws/aws-compute/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip aws-compute.zip -d .agents/skills
Documentation by AWS
Amazon EC2 Compute
Best experience with the AWS MCP server; also works with the AWS CLI alone — no hard dependency on either.
Critical Warnings
Launch configurations are deprecated and do not support current EC2 instance types; new accounts cannot create them. Use launch templates for every new Auto Scaling group. See auto-scaling.md.
ASGs ignore ELB health checks by default: An Auto Scaling group only uses EC2 status checks unless you set --health-check-type ELB. Without it, instances failing the load balancer's health check stay in service forever. See auto-scaling.md.
IMDSv2 hop limit breaks containers: the default HttpPutResponseHopLimit of 1 makes the IMDSv2 token PUT response fail to reach a containerized process (the extra hop exceeds the response TTL), so the token request times out. Set HttpPutResponseHopLimit=2 for bridge/awsvpc container workloads. (If IMDSv2 is required, a subsequent tokenless GET returns 401; if optional, it silently falls back to IMDSv1.) See provisioning.md.
T3/T3a/T4g default to unlimited mode: Unlike T2 (standard), these burst without throttling but bill surplus CPU credits when 24h-average CPU exceeds baseline — a silent cost leak. See instance-selection.md.
Instance store is ephemeral: Data on instance store volumes is lost on stop, hibernate, terminate, instance-type change, and host failure — it survives only a reboot. Put anything durable on EBS/EFS/S3. See instance-selection.md.
Which do you need?
| If you're deciding... | Guidance |
|---|---|
| Instance family / size / Graviton / GPU / burstable | instance-selection.md — start with the workload→family table |
| How to define instances once and reuse (launch template) | provisioning.md |
| How to run many instances that scale automatically | auto-scaling.md |
| How to access/patch/manage instances without SSH keys | systems-manager.md |
Quick Navigation
| You want to... | Go to |
|---|---|
| Pick an instance type, Graviton vs x86, burstable credits, GPU, instance store vs EBS | instance-selection.md |
| Create a launch template, user data, key pairs, IMDSv2, placement groups, Elastic IPs | provisioning.md |
| Set up or fix an Auto Scaling group, scaling policies, instance refresh, Spot, lifecycle hooks | auto-scaling.md |
| Get SSH-less access, patch a fleet, or fix an instance not showing as a managed node | systems-manager.md |
| Create, share, or retire (deprecate/disable/deregister) an AMI | ami-management.md |
| Fix something broken (can't connect, status-check fail, capacity error, stuck instances) | troubleshooting.md |
Common Workflows
"Stand up an autoscaling web fleet" → Create a launch template (AMI, type, IMDSv2), then an ASG referencing it with --health-check-type ELB and a target-tracking policy, see auto-scaling.md. For the public entry point, secure the load balancer (TLS/ACM, WAF, security response headers) per the Security Considerations below and the load-balancer notes in auto-scaling.md — the load-balancer build itself belongs to aws-networking.
"Roll out a new AMI to my fleet" → New launch template version → instance refresh; pin a numeric launch-template version so rollback works, see auto-scaling.md.
"Connect to a private instance without a bastion" → Give the instance SSM permissions (an instance profile with AmazonSSMManagedInstanceCore, or account-level DHMC) plus a network path, then use Session Manager, see systems-manager.md.
"Cut EC2 cost" → Right-size (burstable vs fixed-performance), Graviton where the app supports Arm64, Spot with price-capacity-optimized for fault-tolerant fleets, release idle Elastic IPs, see instance-selection.md.
Troubleshooting
| Symptom | Likely cause | Quick fix |
|---|---|---|
| SSH "Connection timed out" | Network path (SG/NACL/route/no public IP) | Open TCP 22 from your IP; check route to IGW; verify public IP — see troubleshooting.md |
| SSH "Connection refused" | Host: sshd down or still booting | Wait for boot; check sshd/port via Session Manager or serial console |
InsufficientInstanceCapacity | AWS lacks capacity of that type in the AZ (NOT a quota) | Try another AZ / instance type / retry; don't request a quota increase |
InstanceLimitExceeded | vCPU quota reached (this IS a quota) | Request a Service Quotas increase for the instance family |
| ASG never replaces LB-unhealthy instances | Health check type still EC2 | Set --health-check-type ELB |
Instances stuck in Pending:Wait, terminated after ~1h | Lifecycle hook never completed (heartbeat 3600s, default ABANDON) | Call complete-lifecycle-action CONTINUE, or set DefaultResult CONTINUE |
| System status check failed | AWS host/hardware | Stop/start to migrate to new hardware (reboot won't) |
| Instance status check failed | Instance OS/network config | Reboot or fix the OS/network config |
Full tables and more errors in troubleshooting.md.
Security Considerations
Enforce IMDSv2 (
HttpTokens=required) on launch templates to block SSRF-based credential theft; set the account-level default per Region (applies to new launches only).Prefer Session Manager over inbound SSH — no open port 22, no key management, and a CloudTrail record of session API calls; enable Session Manager session logging to CloudWatch Logs/S3 (off by default) to capture the in-session commands themselves — see systems-manager.md.
Use instance profiles, never embedded credentials; scope the role to least privilege.
Encrypt EBS/AMIs; to share an encrypted AMI cross-account, re-encrypt under a customer-managed KMS key (the default
aws/ebskey can't be shared).Enable CloudTrail in all Regions to audit EC2/ASG/SSM API activity, and alarm on sensitive actions (security-group changes,
RunInstances/TerminateInstancesfrom unexpected principals) so unauthorized changes surface.For public-facing web fleets, encrypt traffic in transit with an ACM certificate on the load balancer's HTTPS listener and add AWS WAF for defense in depth against common web exploits — the load-balancer/WAF setup itself lives in
aws-networking.For hardening beyond this guidance, see AWS EC2 security best practices and CIS Benchmarks for the guest OS.
Not Covered By This Skill
Launching a single hardened instance with best-practice defaults → use the
launching-ec2-instance-with-best-practicesskillCreating IAM roles / instance profiles for EC2 → use the
setting-up-ec2-instance-profilesskillBuilding AMIs with an Image Builder pipeline → use the
amazon-ec2-image-builderskillLambda / serverless →
aws-serverless; ECS/Fargate →aws-containers; EKS/Kubernetes →kubernetesVPC, subnets, ALB/NLB, endpoints →
aws-networkingor built-in knowledgeIAM policy logic and CloudWatch dashboards/agent setup →
aws-iam,aws-observability
Files
- ATTRIBUTION.mdAdded by AutoGineer887 B
- LICENSELicence file added by AutoGineer9.9 KiB
- NOTICELicence file added by AutoGineer67 B
- SKILL.md8.7 KiB
- references/ami-management.md5.9 KiB
- references/auto-scaling.md10.1 KiB
- references/instance-selection.md5.7 KiB
- references/provisioning.md9.2 KiB
- references/systems-manager.md7.4 KiB
- references/troubleshooting.md5.7 KiB
references/instance-selection.md
EC2 Instance Selection
Overview
Choosing the right instance type, CPU architecture, burstable mode, and storage.
Pick a family by workload
| Workload | Family | Notes |
|---|---|---|
| Balanced web/app servers, dev | General purpose: M (steady), T (bursty) | T is cheapest for spiky/idle workloads |
| CPU-bound: batch, transcoding, HPC, game servers, ML inference | Compute optimized: C | Highest vCPU:memory ratio among the general/compute/memory (M/C/R) families |
| In-memory DBs, caches, big-data analytics | Memory optimized: R (X = extreme) | High memory:vCPU |
| High random IOPS: NoSQL, OLTP, disk-based caches | Storage optimized: I | Local NVMe SSD; see instance-store caveat below |
| Dense sequential throughput: data warehouses, HDFS, log processing | Storage optimized: D | Local HDD; see instance-store caveat below |
| Training / graphics | Accelerated: P, G (GPU) | P for training, G for graphics/inference |
| ML inference / training on AWS silicon | Inf (Inferentia), Trn (Trainium) | Lower cost per inference/training |
| Tightly coupled HPC | Hpc | Best price-performance at scale |
Within a family, size (.large, .xlarge, …) scales vCPU and memory together. Prefer current generation over previous. New families and generations ship regularly, so confirm the current roster with aws ec2 describe-instance-types --filters Name=current-generation,Values=true or the EC2 instance-types documentation rather than treating this table as exhaustive.
Graviton (Arm64) vs x86
AWS Graviton instances — the g suffix denotes Graviton/Arm64 (e.g. m7g, c7g, t4g; additional generations ship over time, so discover current ones with aws ec2 describe-instance-types --filters Name=processor-info.supported-architecture,Values=arm64 Name=current-generation,Values=true) — run the Arm64 architecture and generally deliver better price-performance than comparable x86 instances, with each generation improving on the last. Check the current Graviton generation and its published price-performance figures in the AWS documentation before sizing.
Decision: Use Graviton when your language/runtime and all dependencies support Arm64 (Go, Java, Python, Node, .NET, most containers do). Stay on x86 (Intel/AMD) for software with x86-only binaries or drivers.
Gotcha: Graviton requires an Arm64/aarch64 AMI and Arm64-compiled binaries. An x86 AMI won't launch on a *g type (the type appears disabled at launch). You can't change architecture in place — rebuild.
Burstable T instances and CPU credits
T instances provide a baseline CPU percentage and earn CPU credits while below baseline, spending them to burst above it (1 credit = 1 vCPU running at 100% for 1 minute).
| Mode | Behavior when credits run out | Default on |
|---|---|---|
standard | Throttled down to baseline | T2 |
unlimited | Keeps bursting; bills surplus credits if 24h-avg CPU > baseline | T3, T3a, T4g (also T2 opt-in) |
Defaults can differ on newer burstable generations — confirm a given type with aws ec2 describe-instance-types --instance-types <type> (and the credit-specification default) rather than assuming from this table.
Cost trap: T3/T3a/T4g default to unlimited, so a sustained-high-CPU workload silently accrues surplus charges (watch
CPUSurplusCreditsCharged). For steady high CPU, move to a fixed-performance family (M/C/R) or setstandard.Set mode at launch or with
aws ec2 modify-instance-credit-specification --instance-credit-specification InstanceId=<id>,CpuCredits=standard.Credit persistence on stop: T2 Standard loses all accrued credits (balance reset to zero, fresh launch credits on restart); T3, T3a, and T4g keep their CPU credit balance for 7 days after stop, after which the credits are lost. Restart within 7 days and no credits are lost.
T3 on a Dedicated Host is standard-only.
Instance store vs EBS
Instance store = physically attached ephemeral disk (families with the d suffix and I/D families).
Instance store data is lost on stop, hibernate, terminate, instance-type change, and underlying host failure; it survives only a reboot. It's also attach-at-launch-only. Use it for scratch/cache/replicated data. For anything durable, use EBS (persists independently), EFS, or S3. Encrypt EBS volumes by default.
Common Errors
| Error | Cause | Fix |
|---|---|---|
| Instance type disabled/greyed out at launch | AMI architecture ≠ instance architecture (x86 AMI on Graviton) | Use an Arm64 AMI for *g types; rebuild app for Arm64 |
| Unexpected CPU surplus charges on T3/T4g | Unlimited mode + sustained CPU above baseline | Switch to standard, or right-size to M/C/R |
| Scratch data gone after resize/stop | Instance store wiped on stop/type-change | Store durable data on EBS/EFS/S3 |
| Sudden throttling to baseline (standard T2) | CPU credit balance depleted | Enable unlimited (mind cost) or use fixed-performance family |
Security Considerations
Graviton (Arm64) needs Arm64 builds — before migrating, confirm all security-critical software (TLS libraries, IDS/endpoint agents, compliance tooling) ships Arm64 binaries, not just your app.
Instance store is ephemeral — never place cryptographic keys, certificates, or secrets on it; they're lost on stop/terminate and can't be reliably wiped. Keep secrets in Secrets Manager / SSM Parameter Store and durable data on encrypted EBS.
Choose EBS-capable, encryptable types for production — enable EBS encryption by default and detailed monitoring on the chosen family.
Related
provisioning.md to bake the choice into a launch template
auto-scaling.md for mixed instance types and Spot
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Node.js
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- AWS
- Publisher
- AWS (Official)
- Source
- aws/agent-toolkit-for-aws · skills/core-skills/aws-compute · commit 0a218f8
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- NOTICE (added by AutoGineer from NOTICE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- aws/agent-toolkit-for-aws
AutoGineer is not affiliated with or endorsed by AWS.
Related skills
Modal
K-Dense· Community
A serverless cloud platform for deploying and scaling Python applications, AI models, and GPU-accelerated workloads.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreApache-2.0Low riskGitHub stars of the source repository56.4k
Cloud Infrastructure Network Engineer
Seth Hobson· Community
An expert network engineer persona specializing in cloud architecture, security, and performance optimization.
Cloud and DevOpsClaude CodeMITGitHub stars of the source repository42.3k
Deployment Validation Cloud Architect
Seth Hobson· Community
Expert cloud architect for multi-cloud infrastructure, cost optimization, and resilient system design.
Cloud and DevOpsClaude CodeMITGitHub stars of the source repository42.3k
Airflow Dag Patterns
Seth Hobson· Community
Best practices and design patterns for building and maintaining production-ready Apache Airflow DAGs.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository42.3k
Cost Optimization
Seth Hobson· Community
A comprehensive framework for reducing cloud infrastructure costs across AWS, Azure, GCP, and OCI.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository42.3k
Hybrid Cloud Networking
Seth Hobson· Community
A guide to configuring secure, high-performance network connectivity between on-premises infrastructure and major cloud providers.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-compute.zip