Compute: EC2, ECS & EKS
Verified against aws-cli/2.33.6, flags verified via `aws <cmd> help`, 2026-08-20 · official docs
EC2 instance lifecycle, ECS cluster/service/task management, and EKS cluster access — the compute commands you reach for while operating or debugging running infrastructure.
Listing and inspecting EC2 instances#
aws ec2 describe-instances aws ec2 describe-instances --instance-ids i-0123456789abcdef0 aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,State.Name,PublicIpAddress]' --output table
describe-instances returns nested Reservations[].Instances[] — a single call can group multiple instances under one reservation, so most useful queries need to drill through both levels.
Launching, starting, and stopping instances#
aws ec2 run-instances \ --image-id ami-0123456789abcdef0 \ --instance-type t3.micro \ --key-name my-key \ --security-group-ids sg-0123456789abcdef0 \ --subnet-id subnet-0123456789abcdef0 \ --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=my-instance}]' aws ec2 start-instances --instance-ids i-0123456789abcdef0 aws ec2 stop-instances --instance-ids i-0123456789abcdef0 aws ec2 terminate-instances --instance-ids i-0123456789abcdef0
stop-instances preserves the instance (EBS-backed data survives, you keep paying for storage); terminate-instances deletes it permanently along with any EBS volumes set to delete-on-termination. Don't confuse the two in a script.
Security groups#
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 aws ec2 describe-security-groups --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"
ECS clusters, services, and tasks#
aws ecs list-clusters aws ecs describe-clusters --clusters my-cluster aws ecs list-services --cluster my-cluster aws ecs update-service --cluster my-cluster --service my-service --desired-count 3 aws ecs update-service --cluster my-cluster --service my-service --force-new-deployment
--force-new-deployment (no argument, a flag) is the standard way to roll a service onto new task instances without changing the task definition — useful for picking up a new container image tagged :latest without bumping a revision.
ECS task inspection and one-off runs#
aws ecs list-tasks --cluster my-cluster --service-name my-service aws ecs describe-tasks --cluster my-cluster --tasks <task-arn> aws ecs run-task --cluster my-cluster --task-definition my-task:5 --launch-type FARGATE \ --network-configuration "awsvpcConfiguration={subnets=[subnet-0123456789abcdef0],securityGroups=[sg-0123456789abcdef0],assignPublicIp=ENABLED}"
Registering an ECS task definition#
aws ecs register-task-definition \ --family my-task \ --container-definitions '[{"name":"app","image":"myrepo/app:latest","memory":512,"cpu":256}]' \ --requires-compatibilities FARGATE \ --network-mode awsvpc \ --cpu "256" --memory "512"
EKS cluster access and node groups#
aws eks list-clusters aws eks describe-cluster --name my-cluster aws eks update-kubeconfig --name my-cluster --alias my-cluster # writes/merges kubeconfig context for kubectl aws eks list-nodegroups --cluster-name my-cluster aws eks create-nodegroup \ --cluster-name my-cluster --nodegroup-name workers \ --node-role arn:aws:iam::111122223333:role/EksNodeRole \ --subnets subnet-0123456789abcdef0 \ --scaling-config minSize=1,maxSize=5,desiredSize=2
eks update-kubeconfig is the bridge between the AWS CLI and kubectl — it doesn't create anything in the cluster, it just writes an entry into your local kubeconfig so kubectl can authenticate against that cluster using your AWS credentials.