Configuring EC2 Server Instances with AWS Elastic Beanstalk

The EC2 Instance Type drop-down list box displays the instance types available to your AWS Elastic Beanstalk application. Changing the instance type enables you to select a server with the characteristics (including memory size and CPU power) that are most appropriate to your application. For instance, applications with intensive and long-running operations may require more CPU or memory. AWS Elastic Beanstalk regularly checks your running instances to ensure they are healthy. If your application consumes 95 percent or greater of the CPU, AWS Elastic Beanstalk will fire an event. For more information about this event, see CPU Utilization Greater Than 95.00%.

For more information about the Amazon EC2 instance types available for your AWS Elastic Beanstalk application, go to Instance Families and Types in the Amazon Elastic Compute Cloud User Guide.

You can control access to your AWS Elastic Beanstalk application using an Amazon EC2 security group. A security group defines firewall rules for your instances. These rules specify which ingress (i.e., incoming) network traffic should be delivered to your instance. All other ingress traffic will be discarded. You can modify rules for a group at any time. The new rules are automatically enforced for all running instances and instances launched in the future.

You can set up your Amazon EC2 security groups using the Amazon EC2 console. You can specify which Amazon EC2 security groups control access to your AWS Elastic Beanstalk application by entering one or more Amazon EC2 security group names (delimited by commas) into the EC2 Security Groups text box. For more information on Amazon EC2 security groups, see Using Security Groups in the Amazon Elastic Compute Cloud User Guide.

AWS Elastic Beanstalk creates a default security group for you. If you are using a legacy container, the security group is elasticbeanstalk-default. If you are using a non-legacy container, then AWS Elastic Beanstalk dynamically creates a security group. You can view the security group name in the EC2 Security Group box.

You can securely log in to the Amazon EC2 instances provisioned for your AWS Elastic Beanstalk application with an Amazon EC2 key pair.

The Existing Key Pair text box lets you specify the name of an Amazon EC2 key pair you use to securely log in to the Amazon EC2 instances running your AWS Elastic Beanstalk application.

For more information on Amazon EC2 key pairs, see Using Credentials in the Amazon Elastic Compute Cloud User Guide. For more information on connecting to Amazon EC2 instances, see Connecting to Instances and Connecting to an Instance from Windows using PuTTY in the Amazon Elastic Compute Cloud User Guide.

By default, only basic Amazon CloudWatch metrics are enabled; they return data in five-minute periods. You can enable more granular one-minute CloudWatch metrics by selecting 1 minute in the Monitoring Interval drop-down list box.

You can override the default AMI used for your Amazon EC2 instances with your own custom AMI by entering the identifier of your custom AMI into the Custom AMI ID text box.

If you are using a non-legacy container, you have the option to select an instance profile. If you are using a legacy container, this option does not appear in the dialog box. Instance profiles provide applications and services access to AWS resources. For example, your application may require access to Amazon DynamoDB. Every API request made to AWS services must be signed using AWS security credentials. One way to grant applications access to AWS resources is to distribute your credentials to each instance; however, distributing long-term credentials to each instance is challenging to manage and a potential security risk. Instead, you can create an IAM role with the permissions that applications require when the application makes calls to other AWS resources. When AWS Elastic Beanstalk launches the Amazon EC2 instances, it uses the instance profile associated with that role. All applications that run on the instances can use the role credentials to sign requests. Because role credentials are temporary and rotated automatically, you don't have to worry about long-term security risks.

In addition, AWS Elastic Beanstalk requires permission to rotate your logs to Amazon S3. If you want AWS Elastic Beanstalk to rotate your logs to Amazon S3, you need to select an instance profile or have AWS Elastic Beanstalk create one for you. For more information about log rotation, see Configuring Containers with AWS Elastic Beanstalk.

The Instance Profile list displays the profiles available for your AWS Elastic Beanstalk environment. If you do not have an instance profile, you can select Create a Default Instance Profile. AWS Elastic Beanstalk creates a default instance profile and updates the Amazon S3 bucket policy to allow log rotation. If you choose to not use the default instance profile, you need to grant permissions for AWS Elastic Beanstalk to rotate logs. For more information about this policy, see Example: Granting AWS Elastic Beanstalk Permission to Rotate Logs to Amazon S3. For a list of supported non-legacy container types, see Why are some container types marked legacy?.