EC2

Amazon Elastic Compute Cloud (EC2) provides virtual machines, called instances, and the disks, network interfaces and firewall rules around them. The platform runs no standalone servers; EC2 appears as the worker nodes under Kubernetes and, optionally, as short-lived CI runners.

What it does

An instance is a virtual machine of a given instance type (CPU and memory size, such as t3.medium). Its disk is an EBS volume. A security group is a stateful firewall attached to the instance's network interface. The instance metadata service (IMDS) is the local endpoint an instance uses to learn about itself and to fetch its role credentials; IMDSv2 requires a session token, which blocks a class of credential-theft attacks. Spot instances are spare capacity at a discount that AWS can reclaim. A managed node group is an EC2 Auto Scaling group that EKS creates and upgrades for you.

How BuiltForProd uses it

Use	Where	Details
EKS baseline nodes	Web application blueprint, modules/eks, every stage	Managed node group of t3.medium instances in private subnets, carrying Kubernetes and the system components: dev minimum 2 and maximum 3 nodes, staging and prod minimum 3 and maximum 4 (minimum 3 for ArgoCD high availability); IMDSv2 required (http_tokens = required)
EKS application nodes	Web application blueprint, modules/karpenter, every stage	Launched by Karpenter when an application pod needs one and removed when it does not: Amazon Linux 2023, m6i, m7i, m6a or m7a, Spot preferred with on-demand fallback, under a per-stage vCPU ceiling; IMDSv2 required with a hop limit of 1
Self-hosted GitHub runners	AWS Baseline, units/github-runner in core-auto, off by default	Ephemeral t3.medium instances on Spot, created per job and terminated after it, in the runner VPC; reach private EKS endpoints through the Transit Gateway
NAT Gateways and Transit Gateway attachments	Hub and spoke VPCs	EC2-family networking resources that carry the platform's egress

The design keeps compute managed. Nodes belong to EKS and are replaced, not patched. Three layers scale them: the Horizontal Pod Autoscaler adds pods, Karpenter adds nodes for those pods, and Cluster Autoscaler keeps the system baseline the right size underneath, between the per-stage minimum and maximum. Runners scale to zero and use capacity-optimized Spot with on-demand failover, so an idle CI fleet costs nothing.

Two account-wide settings from modules/account-baseline shape every instance in every account. EBS default encryption is on, so every new volume is encrypted at rest without anyone asking. The ec2-instance-no-public-ip rule in the SOC 2 conformance pack alerts if any instance obtains a public IP, which none should: workload instances live in private subnets whose only route out is the Transit Gateway.

Security groups are created by the blueprints' security-group module as separate units (sg-docdb, sg-lambda) and injected into the resources that need them, so a data store never creates its own rules. Findings about open security groups from Security Hub are routed to the security alerts topic.

Inspector, when switched on, scans instances for vulnerable packages and unintended network reachability; the price beside the switch is about $1.26 per instance per month.

Terms you will see

Term	Meaning
Instance type	The size class of a virtual machine, such as t3.medium.
Managed node group	The EKS-managed Auto Scaling group that runs worker nodes.
EBS volume	Block storage attached to an instance; encrypted by default here.
IMDSv2	The token-based metadata service mode the node groups require.
Spot	Discounted, reclaimable capacity used for Karpenter nodes and CI runners.
Security group	A stateful firewall on a network interface.
Auto Scaling group	The EC2 mechanism that keeps a set number of instances running.

Where to read more

• Web App Blueprint overview for the cluster the nodes belong to.
• EKS for how the node group is managed.
• Karpenter for the instances the application runs on.
• GitHub Actions for when self-hosted runners are worth switching on.