Compute: EC2, Lambda & Auto Scaling

Compute: EC2, Lambda & Auto Scaling — right-sized capacity that scales itself

Mental model: you need servers, but demand swings and buying for the peak wastes money.
AWS compute is built to resize itself and let you pay for what you use.
  EC2    -> on-demand resizable virtual servers for steady, low-latency work
  Lambda -> serverless, event-driven functions for spiky bursts (no servers to manage)
  ASG    -> an Auto Scaling Group that flexes a fleet of EC2 instances to match demand

1 · EC2 — the resizable virtual server
    Every instance launches from an AMI (Amazon Machine Image): the image that fixes the
    OS and preinstalled software. You then choose an instance family sized for the job:
      general-purpose  -> balanced CPU / memory (e.g. t3, m-series)
      compute-optimized -> CPU-heavy work
      memory-optimized  -> large in-memory datasets
      storage-optimized -> high local disk throughput

    Launch one (real CLI shape):
      aws ec2 run-instances \
        --image-id ami-0abcd \
        --instance-type t3.micro \
        --count 1 \
        --iam-instance-profile Name=app-role
    # what each part does:
    #   --image-id            the AMI to boot from
    #   --instance-type       the family + size (t3.micro = general-purpose, small)
    #   --count               how many instances to launch
    #   --iam-instance-profile  the instance profile that delivers a role's credentials

2 · EC2 pricing — where the savings live
    On-Demand        -> full flexibility, pay by the second, no commitment
    Savings Plans    -> commit to a steady $/hr of usage for a big discount
    Reserved Instances (RI) -> commit to specific capacity for a discount
                                (RI is CURRENT — it is NOT deprecated; AWS recommends
                                 Savings Plans, but both are supported)
    Spot             -> bid on spare capacity for the deepest discount, but AWS can
                        reclaim it with little notice -> INTERRUPTIBLE, only for
                        fault-tolerant / restartable work
    Dedicated Hosts  -> whole physical servers (licensing / compliance)

3 · The IAM framing — get this exactly right
    When code on the instance needs AWS permissions, the instance ASSUMES an IAM role
    through an INSTANCE PROFILE and receives TEMPORARY credentials from STS via the
    instance metadata service.
      EC2 instance --(instance profile)--> assumes role --> STS temporary credentials
    - The instance does NOT "become" a role. It assumes one.
    - The role does NOT "expire." The TEMPORARY CREDENTIALS expire (default STS session
      ~1 hour, up to 12 hours) and are AUTO-ROTATED before they expire, so a valid set is
      always available. The instance never holds long-lived access keys.

    Build the role + profile the instance uses (real CLI shapes):
      aws iam create-role --role-name app-role \
        --assume-role-policy-document file://trust.json   # trust.json trusts ec2.amazonaws.com
      aws iam attach-role-policy --role-name app-role \
        --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
    # sts assume-role returns TEMPORARY Credentials:
    #   AccessKeyId, SecretAccessKey, SessionToken, Expiration

4 · Lambda — serverless, event-driven
    No servers to provision. Lambda runs your function ON EACH EVENT and you pay per
    request PLUS duration (billed in GB-seconds: memory x run time).
      cold start  -> first call spins up a new execution environment (adds latency)
      warm        -> a reused environment responds instantly
      concurrency -> one request per execution environment at a time; AWS scales out
                     environments to run many requests in parallel
    Use Lambda for spiky, event-driven bursts; use EC2 for steady, low-latency servers.

5 · Auto Scaling Groups — match capacity to demand
    An ASG launches instances from a LAUNCH TEMPLATE (which AMI, instance type, profile)
    and uses scaling policies to hold capacity where you want it.
      target tracking -> add/remove instances to hold a metric steady (e.g. CPU at 50%)
      health checks   -> the ASG replaces any impaired instance to hold desired capacity
    So a bad instance is quietly terminated and a fresh one launched from the template —
    the fleet self-heals toward the desired count.

Notes:
- Reserved Instances are NOT deprecated. On-Demand, Savings Plans, RI, Spot, and
  Dedicated Hosts are all current pricing models.
- An EC2 instance ASSUMES a role via an instance profile — it does NOT become the role,
  and the role does not expire (the temporary credentials do, and are auto-rotated).
- Spot instances are INTERRUPTIBLE: AWS can reclaim them, so only run fault-tolerant,
  restartable workloads on Spot.
- Lambda cold starts add latency only on the first call into a new environment; warm
  environments respond instantly.

Verify:
  aws ec2 describe-instances    # list instances, their state, type, and instance profile

Scope: these are documented AWS facts verified against official docs, and the CLI command
and parameter shapes are real (aws-cli). They were NOT run against live AWS infrastructure
here, so no live resource output is shown.