Compute Operations (ECS)
Instance lifecycle and families
Elastic Compute Service (ECS) instances are defined by instance family (general purpose, compute-optimized, memory-optimized, and specialized types), vCPU/memory ratio, and the image used to boot. Understand the lifecycle states: creating, running, stopped, and released. Stopping preserves the instance and its disks (billing behavior depends on the instance's charging method), while releasing destroys the instance and may destroy attached disks depending on their type. Questions love the stop-vs-release distinction and the "what survives" angle.
Images, disks, and snapshots
Images are templates (public, custom, shared, or marketplace). System disks hold the OS; data disks hold application data. Snapshots are point-in-time copies of a disk, used for backup and for creating new disks or images. Automatic snapshot policies apply to disks, not instances, and are the standard answer for scheduled backup. Note that a snapshot is incremental in nature but restores as a full disk.
Networking and access
Security groups are stateful virtual firewalls attached to instances; rules are allow-only, and default-deny applies to unmatched traffic. A key trap: security group rules are evaluated across all groups attached to an instance with an OR relationship, so a permissive rule in any attached group opens the port. Use SSH key pairs for Linux and passwords or keys for Windows.
Scaling and elasticity
Auto Scaling groups tie together a scaling group, a scaling configuration (instance template), and scaling rules or scheduled policies. Health checks replace unhealthy instances; cooldown periods prevent thrash.
Rule of thumb
For any ECS question asking "what happens to my data," trace the storage type: ephemeral vs. cloud disk, and whether the disk is set to release with the instance. That single check answers most backup and recovery items.
Worked example
You need a repeatable web tier that survives an instance failure. Use an Auto Scaling group with a custom image, a load balancer health check, and a scaling rule on CPU. Do not rely on manually configured instances-they are not replaced automatically.