AWS Compute
AWSOfficialPublished by AWS
- Skill
- Tool integration
- Cloud and DevOps
- Apache-2.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides operational guidance for Amazon EC2, covering the full lifecycle of virtual machine workloads. It addresses instance-type selection, launch template configuration, Auto Scaling group (ASG) management, and fleet operations via AWS Systems Manager. It is designed to help users navigate common pitfalls like IMDSv2 configuration, health check settings, and cost-optimization strategies for burstable instances, while providing clear troubleshooting paths for connectivity, capacity, and status-check failures.
What it does
- Guides instance-type selection including Graviton, GPU, and burstable T-series options.
- Configures Auto Scaling groups with scaling policies, instance refresh, and lifecycle hooks.
- Manages AMI lifecycles including deprecation, disabling, and cross-account sharing.
- Facilitates fleet operations like patching and SSH-less access via Systems Manager.
- Provides troubleshooting steps for common EC2 errors like InsufficientInstanceCapacity and status-check failures.
- Enforces security best practices such as IMDSv2 and instance profile usage.
When to use it
- When designing or scaling an EC2-based compute fleet.
- When troubleshooting connectivity, capacity, or health check issues in an ASG.
- When optimizing EC2 costs through instance-type selection or Spot instance usage.
- When performing rolling updates or AMI migrations across a fleet.
- When configuring secure, SSH-less management for private instances.
Advantages
- Centralizes complex EC2 operational knowledge and common configuration pitfalls.
- Provides actionable troubleshooting tables for rapid incident resolution.
- Promotes security-first configurations like IMDSv2 and Session Manager.
- Clarifies the distinction between deprecated and modern provisioning methods.
- Offers clear guidance on cost-saving strategies like Graviton and Spot instances.
Usage examples
- “How do I ensure my Auto Scaling group replaces instances that fail my load balancer health checks?”
- The agent explains that ASGs ignore ELB health checks by default and provides the command to set --health-check-type ELB.
- “My instances are stuck in Pending:Wait state, what is happening?”
- The agent identifies that a lifecycle hook is likely waiting for a heartbeat and provides the command to complete the action.
- “How can I safely roll out a new AMI to my existing fleet?”
- The agent details the process of updating the launch template to a specific version and initiating an instance refresh.
- “Why am I getting an InsufficientInstanceCapacity error?”
- The agent clarifies that this is an AWS capacity issue in a specific AZ, not a user quota, and suggests trying a different AZ or instance type.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/aws/aws-compute/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip aws-compute.zip -d .agents/skills
Documentation by AWS
Amazon EC2 Compute
Best experience with the AWS MCP server; also works with the AWS CLI alone — no hard dependency on either.
Critical Warnings
Launch configurations are deprecated and do not support current EC2 instance types; new accounts cannot create them. Use launch templates for every new Auto Scaling group. See auto-scaling.md.
ASGs ignore ELB health checks by default: An Auto Scaling group only uses EC2 status checks unless you set --health-check-type ELB. Without it, instances failing the load balancer's health check stay in service forever. See auto-scaling.md.
IMDSv2 hop limit breaks containers: the default HttpPutResponseHopLimit of 1 makes the IMDSv2 token PUT response fail to reach a containerized process (the extra hop exceeds the response TTL), so the token request times out. Set HttpPutResponseHopLimit=2 for bridge/awsvpc container workloads. (If IMDSv2 is required, a subsequent tokenless GET returns 401; if optional, it silently falls back to IMDSv1.) See provisioning.md.
T3/T3a/T4g default to unlimited mode: Unlike T2 (standard), these burst without throttling but bill surplus CPU credits when 24h-average CPU exceeds baseline — a silent cost leak. See instance-selection.md.
Instance store is ephemeral: Data on instance store volumes is lost on stop, hibernate, terminate, instance-type change, and host failure — it survives only a reboot. Put anything durable on EBS/EFS/S3. See instance-selection.md.
Which do you need?
| If you're deciding... | Guidance |
|---|---|
| Instance family / size / Graviton / GPU / burstable | instance-selection.md — start with the workload→family table |
| How to define instances once and reuse (launch template) | provisioning.md |
| How to run many instances that scale automatically | auto-scaling.md |
| How to access/patch/manage instances without SSH keys | systems-manager.md |
Quick Navigation
| You want to... | Go to |
|---|---|
| Pick an instance type, Graviton vs x86, burstable credits, GPU, instance store vs EBS | instance-selection.md |
| Create a launch template, user data, key pairs, IMDSv2, placement groups, Elastic IPs | provisioning.md |
| Set up or fix an Auto Scaling group, scaling policies, instance refresh, Spot, lifecycle hooks | auto-scaling.md |
| Get SSH-less access, patch a fleet, or fix an instance not showing as a managed node | systems-manager.md |
| Create, share, or retire (deprecate/disable/deregister) an AMI | ami-management.md |
| Fix something broken (can't connect, status-check fail, capacity error, stuck instances) | troubleshooting.md |
Common Workflows
"Stand up an autoscaling web fleet" → Create a launch template (AMI, type, IMDSv2), then an ASG referencing it with --health-check-type ELB and a target-tracking policy, see auto-scaling.md. For the public entry point, secure the load balancer (TLS/ACM, WAF, security response headers) per the Security Considerations below and the load-balancer notes in auto-scaling.md — the load-balancer build itself belongs to aws-networking.
"Roll out a new AMI to my fleet" → New launch template version → instance refresh; pin a numeric launch-template version so rollback works, see auto-scaling.md.
"Connect to a private instance without a bastion" → Give the instance SSM permissions (an instance profile with AmazonSSMManagedInstanceCore, or account-level DHMC) plus a network path, then use Session Manager, see systems-manager.md.
"Cut EC2 cost" → Right-size (burstable vs fixed-performance), Graviton where the app supports Arm64, Spot with price-capacity-optimized for fault-tolerant fleets, release idle Elastic IPs, see instance-selection.md.
Troubleshooting
| Symptom | Likely cause | Quick fix |
|---|---|---|
| SSH "Connection timed out" | Network path (SG/NACL/route/no public IP) | Open TCP 22 from your IP; check route to IGW; verify public IP — see troubleshooting.md |
| SSH "Connection refused" | Host: sshd down or still booting | Wait for boot; check sshd/port via Session Manager or serial console |
InsufficientInstanceCapacity | AWS lacks capacity of that type in the AZ (NOT a quota) | Try another AZ / instance type / retry; don't request a quota increase |
InstanceLimitExceeded | vCPU quota reached (this IS a quota) | Request a Service Quotas increase for the instance family |
| ASG never replaces LB-unhealthy instances | Health check type still EC2 | Set --health-check-type ELB |
Instances stuck in Pending:Wait, terminated after ~1h | Lifecycle hook never completed (heartbeat 3600s, default ABANDON) | Call complete-lifecycle-action CONTINUE, or set DefaultResult CONTINUE |
| System status check failed | AWS host/hardware | Stop/start to migrate to new hardware (reboot won't) |
| Instance status check failed | Instance OS/network config | Reboot or fix the OS/network config |
Full tables and more errors in troubleshooting.md.
Security Considerations
Enforce IMDSv2 (
HttpTokens=required) on launch templates to block SSRF-based credential theft; set the account-level default per Region (applies to new launches only).Prefer Session Manager over inbound SSH — no open port 22, no key management, and a CloudTrail record of session API calls; enable Session Manager session logging to CloudWatch Logs/S3 (off by default) to capture the in-session commands themselves — see systems-manager.md.
Use instance profiles, never embedded credentials; scope the role to least privilege.
Encrypt EBS/AMIs; to share an encrypted AMI cross-account, re-encrypt under a customer-managed KMS key (the default
aws/ebskey can't be shared).Enable CloudTrail in all Regions to audit EC2/ASG/SSM API activity, and alarm on sensitive actions (security-group changes,
RunInstances/TerminateInstancesfrom unexpected principals) so unauthorized changes surface.For public-facing web fleets, encrypt traffic in transit with an ACM certificate on the load balancer's HTTPS listener and add AWS WAF for defense in depth against common web exploits — the load-balancer/WAF setup itself lives in
aws-networking.For hardening beyond this guidance, see AWS EC2 security best practices and CIS Benchmarks for the guest OS.
Not Covered By This Skill
Launching a single hardened instance with best-practice defaults → use the
launching-ec2-instance-with-best-practicesskillCreating IAM roles / instance profiles for EC2 → use the
setting-up-ec2-instance-profilesskillBuilding AMIs with an Image Builder pipeline → use the
amazon-ec2-image-builderskillLambda / serverless →
aws-serverless; ECS/Fargate →aws-containers; EKS/Kubernetes →kubernetesVPC, subnets, ALB/NLB, endpoints →
aws-networkingor built-in knowledgeIAM policy logic and CloudWatch dashboards/agent setup →
aws-iam,aws-observability
Files
- ATTRIBUTION.mdAdded by AutoGineer887 B
- LICENSELicence file added by AutoGineer9.9 KiB
- NOTICELicence file added by AutoGineer67 B
- SKILL.md8.7 KiB
- references/ami-management.md5.9 KiB
- references/auto-scaling.md10.1 KiB
- references/instance-selection.md5.7 KiB
- references/provisioning.md9.2 KiB
- references/systems-manager.md7.4 KiB
- references/troubleshooting.md5.7 KiB
references/troubleshooting.md
EC2 Troubleshooting
Overview
Diagnosing the common EC2 failures: connectivity, status checks, capacity/quota errors, Spot interruptions, credit exhaustion, and instances that die on launch. Match the exact error string first — several look similar but have opposite fixes.
Can't SSH in: read the exact error
The error string tells you the layer.
| Error | Layer | Causes | Fix |
|---|---|---|---|
| Connection timed out | Network — packets never arrive | Security group missing inbound TCP 22 from your IP; NACL blocking; no route to internet gateway; instance has no/changed public IP; local firewall | Open 22 from your IP; verify route + public IP; note public IP changes on stop/start unless an Elastic IP is attached |
| Connection refused | Host — reachable, nothing on the port | sshd not running/listening on that port; instance still booting; sshd misconfigured | Wait for boot; check sshd via Session Manager or EC2 serial console |
| Permission denied (publickey) | Auth | Wrong username for the AMI; wrong key; key file perms; EC2 Instance Connect key expired (60s) | Use the AMI's default user (ec2-user/ubuntu/admin/root); chmod 400 key.pem; re-run send-ssh-public-key |
Keyless fallbacks: Session Manager, EC2 Instance Connect, or the serial console (Nitro instances). The serial console is not on by default — it needs account-level enablement plus IAM permissions, and on Linux requires a preconfigured password-based user (only the browser client itself is truly keyless). The AWSSupport-TroubleshootSSH runbook automates checks. Debug with ssh -vvv -i key.pem user@host. For "Connection timed out", enable VPC Flow Logs to confirm whether packets reach the ENI (ACCEPT/REJECT) — KMS-encrypt the flow-log destination (S3 bucket via SSE-KMS or CloudWatch Logs log group); add the CloudWatch agent for OS-level visibility.
Status check failed: system vs instance
| Check | Monitors | Remedy |
|---|---|---|
System (StatusCheckFailed_System) | AWS host/hardware/power/network | Stop/start an EBS-backed instance to migrate to new hardware (a reboot stays on the same host); or set a CloudWatch instance-recovery action; or wait for AWS |
Instance (StatusCheckFailed_Instance) | The instance's OS/network config | Reboot or fix the OS/network config yourself |
| Attached EBS | Attached EBS volumes | Investigate the volume; ASG replacement isn't automatic for this check — by default. Enabling the opt-in EBS health check on the ASG (Nitro instances) makes it detect attached-EBS impairment and replace the instance automatically |
Capacity vs quota errors (opposite fixes)
| Error | Meaning | Fix |
|---|---|---|
| InsufficientInstanceCapacity | AWS lacks spare capacity for that type in that AZ — NOT a quota | Try another AZ, another instance type/size, retry later, or request fewer per call. In a cluster placement group, stop/start all group instances to re-place them |
| InstanceLimitExceeded | You hit an On-Demand vCPU-based quota (grouped, e.g. the Standard family group A/C/D/H/I/M/R/T/Z; the vCPU-phrased variant is VcpuLimitExceeded) — this IS a quota | Raise it via Service Quotas for that quota and Region |
A quota increase does nothing for InsufficientInstanceCapacity.
Spot interruptions
Spot instances get a 2-minute interruption notice (via instance metadata instance-action and the EventBridge event EC2 Spot Instance Interruption Warning). An earlier, softer signal — the rebalance recommendation (EC2 Instance Rebalance Recommendation) — usually arrives earlier than (but is best-effort and can arrive together with) the two-minute interruption notice, giving more time to drain. In an ASG, enable Capacity Rebalancing to act on it automatically (see auto-scaling.md). Test interruption handling with AWS Fault Injection Service.
High CPU / sudden slowdown on burstable (T) instances
A T instance that suddenly and persistently drops to sluggish performance under sustained load has likely exhausted its CPU credits: in standard mode it throttles to baseline. Switch to unlimited (watch surplus charges) or move to a fixed-performance family. In unlimited mode the reverse symptom — a surprise bill — comes from CPUSurplusCreditsCharged. See instance-selection.md.
Instance immediately stops or terminates after launch
Encrypted root EBS volume the launch role can't decrypt — the principal/role lacks KMS key permissions; grant key access. Check the system log to confirm the OS never booted.
Hitting EBS volume quotas can block/impair launches.
Remember instance store data is gone after any stop.
Instance status check fails after changing to a Nitro type
Migrating to a Nitro-based instance type without the ENA and NVMe drivers installed causes instance status check failures — install the drivers before switching.
Security Considerations
Prefer Session Manager over SSH for diagnosis — keyless, IAM-scoped, and fully audited via CloudTrail (no key sprawl or open port 22).
Treat repeated connection failures as possible reconnaissance — enable CloudTrail and VPC Flow Logs so failed access attempts are visible.
A status-check failure can be a security event, not just hardware — before reflexively rebooting a suspect instance, review system logs and consider isolation/forensics (a reboot can destroy volatile evidence and instance-store data).
Related
auto-scaling.md — ASG health, Spot, lifecycle hooks
provisioning.md — Elastic IPs, key pairs, IMDS
systems-manager.md — keyless access as an SSH fallback
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Node.js
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- AWS
- Publisher
- AWS (Official)
- Source
- aws/agent-toolkit-for-aws · skills/core-skills/aws-compute · commit 0a218f8
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- NOTICE (added by AutoGineer from NOTICE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- aws/agent-toolkit-for-aws
AutoGineer is not affiliated with or endorsed by AWS.
Related skills
Modal
K-Dense· Community
A serverless cloud platform for deploying and scaling Python applications, AI models, and GPU-accelerated workloads.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreApache-2.0Low riskGitHub stars of the source repository56.4k
Cloud Infrastructure Network Engineer
Seth Hobson· Community
An expert network engineer persona specializing in cloud architecture, security, and performance optimization.
Cloud and DevOpsClaude CodeMITGitHub stars of the source repository42.3k
Deployment Validation Cloud Architect
Seth Hobson· Community
Expert cloud architect for multi-cloud infrastructure, cost optimization, and resilient system design.
Cloud and DevOpsClaude CodeMITGitHub stars of the source repository42.3k
Airflow Dag Patterns
Seth Hobson· Community
Best practices and design patterns for building and maintaining production-ready Apache Airflow DAGs.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository42.3k
Cost Optimization
Seth Hobson· Community
A comprehensive framework for reducing cloud infrastructure costs across AWS, Azure, GCP, and OCI.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository42.3k
Hybrid Cloud Networking
Seth Hobson· Community
A guide to configuring secure, high-performance network connectivity between on-premises infrastructure and major cloud providers.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-compute.zip