CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Cloud CLIs / aws ec2

aws ec2

Find, start and stop EC2 instances from the CLI

Intermediateawscomputejmespath

aws ec2 manages virtual machines, their disks, networks and security groups. Day to day you use describe-instances with --filters and --query to find instances, and start/stop/reboot to operate them. Learning --query (JMESPath) and --output turns its huge JSON into exactly the table or list you need.

Syntaxaws ec2 describe-instances|start-instances|stop-instances|... [--instance-ids ID...] [--filters Name=,Values=] [--query EXPR] [--output json|text|table]

Watch it run

You need a quick inventory of the instances in this region: who is running, what type, which private IP.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 5
Q='Reservations[].Instances[].{ID:InstanceId,Name:Tags[?Key==`Name`]|[0].Value,State:State.Name}'

JMESPath queries get long, so keep them in a shell variable. Single quotes stop the shell from touching the brackets, the pipe and the backticks.

Anatomy of a command

$
commandaws ec2

The EC2 service: instances, AMIs, EBS volumes, security groups, VPC networking.

How it works

Every aws ec2 command is one call to the regional EC2 Query API (ec2.us-east-1.amazonaws.com), signed with SigV4 and authorised against IAM actions like ec2:DescribeInstances or ec2:StopInstances. describe-instances returns reservations (one per launch request), each with a list of instances, and the CLI follows NextToken pagination automatically. --filters is applied by EC2 on the server, so less data comes back; --query is applied by the CLI afterwards with JMESPath, so it can reshape anything. stop-instances asks EC2 to shut the guest OS down via ACPI and returns immediately with the state change (running to stopping); aws ec2 wait polls until the target state is reached. A stopped instance keeps its EBS volumes and private IP, loses its public IP and instance-store data, and stops billing for compute but not for storage.

Options you'll actually use

describe-instancesList instances (all, or --instance-ids)
--filters Name=X,Values=a,bServer-side filter: tag:Name, instance-state-name, vpc-id...
--query EXPRJMESPath: pick fields, rename them with {Name:...}, filter with [?...]
--output table|text|json|yamlFormatting for humans (table) or scripts (text, json)
start/stop-instancesChange instance state (also reboot-instances); stop --force for a stuck stop
terminate-instancesDelete the instance (and root volume if DeleteOnTermination)
wait STATEBlock until instance-running, instance-stopped... (polls every 15 s)
--dry-runCheck permissions without doing anything
--region REGIONOverride the default region for this command
describe-volumesSame patterns for disks; describe-security-groups for firewalls

Common mistakes

Parsing describe-instances JSON with grep and cut

The output is deeply nested and multi-line; field order and indentation aren't stable.

--query to select fields, --output text for shell loops, or jq on --output json
Using --query to filter thousands of instances: --query 'Reservations[].Instances[?State.Name==`running`]'

It downloads every instance first and filters on your machine; slow and throttle-prone in large accounts.

--filters Name=instance-state-name,Values=running (server side), then --query to shape
terminate-instances when you meant stop-instances

Termination is permanent: the root volume is deleted by default and the instance can't come back.

Use stop for maintenance; enable termination protection (DisableApiTermination) on important instances
Expecting the same public IP after a stop/start

Auto-assigned public IPv4 addresses are released on stop.

Use an Elastic IP, or better, a load balancer or DNS name in front

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    The sandbox has ~/data/servers.txt (name, IP, state). Without network, practise the same 'filter then project' idea: print the names of the running servers only.

  2. 2

    Turn ~/data/servers.txt into JSON with jq and select the stopped ones, the way --query would with [?State==`stopped`].

  3. 3

    List the IDs of running instances tagged env=prod as plain text.

  4. 4

    Find the stopped instance, start it, and block until it's running.

Related commands

aws configureSet up AWS CLI credentials, region and profilesaws iamInspect users, roles and policies, and debug accesssshLog in to remote servers securelyawkProcess text by columns: filter, sum, count and report
Previousaws s3Nextaws iam
Linux / Cloud CLIs / aws ec2

aws ec2

Find, start and stop EC2 instances from the CLI

Intermediateawscomputejmespath

aws ec2 manages virtual machines, their disks, networks and security groups. Day to day you use describe-instances with --filters and --query to find instances, and start/stop/reboot to operate them. Learning --query (JMESPath) and --output turns its huge JSON into exactly the table or list you need.

Syntaxaws ec2 describe-instances|start-instances|stop-instances|... [--instance-ids ID...] [--filters Name=,Values=] [--query EXPR] [--output json|text|table]

Watch it run

You need a quick inventory of the instances in this region: who is running, what type, which private IP.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 5
Q='Reservations[].Instances[].{ID:InstanceId,Name:Tags[?Key==`Name`]|[0].Value,State:State.Name}'

JMESPath queries get long, so keep them in a shell variable. Single quotes stop the shell from touching the brackets, the pipe and the backticks.

Anatomy of a command

$
commandaws ec2

The EC2 service: instances, AMIs, EBS volumes, security groups, VPC networking.

How it works

Every aws ec2 command is one call to the regional EC2 Query API (ec2.us-east-1.amazonaws.com), signed with SigV4 and authorised against IAM actions like ec2:DescribeInstances or ec2:StopInstances. describe-instances returns reservations (one per launch request), each with a list of instances, and the CLI follows NextToken pagination automatically. --filters is applied by EC2 on the server, so less data comes back; --query is applied by the CLI afterwards with JMESPath, so it can reshape anything. stop-instances asks EC2 to shut the guest OS down via ACPI and returns immediately with the state change (running to stopping); aws ec2 wait polls until the target state is reached. A stopped instance keeps its EBS volumes and private IP, loses its public IP and instance-store data, and stops billing for compute but not for storage.

Options you'll actually use

describe-instancesList instances (all, or --instance-ids)
--filters Name=X,Values=a,bServer-side filter: tag:Name, instance-state-name, vpc-id...
--query EXPRJMESPath: pick fields, rename them with {Name:...}, filter with [?...]
--output table|text|json|yamlFormatting for humans (table) or scripts (text, json)
start/stop-instancesChange instance state (also reboot-instances); stop --force for a stuck stop
terminate-instancesDelete the instance (and root volume if DeleteOnTermination)
wait STATEBlock until instance-running, instance-stopped... (polls every 15 s)
--dry-runCheck permissions without doing anything
--region REGIONOverride the default region for this command
describe-volumesSame patterns for disks; describe-security-groups for firewalls

Common mistakes

Parsing describe-instances JSON with grep and cut

The output is deeply nested and multi-line; field order and indentation aren't stable.

--query to select fields, --output text for shell loops, or jq on --output json
Using --query to filter thousands of instances: --query 'Reservations[].Instances[?State.Name==`running`]'

It downloads every instance first and filters on your machine; slow and throttle-prone in large accounts.

--filters Name=instance-state-name,Values=running (server side), then --query to shape
terminate-instances when you meant stop-instances

Termination is permanent: the root volume is deleted by default and the instance can't come back.

Use stop for maintenance; enable termination protection (DisableApiTermination) on important instances
Expecting the same public IP after a stop/start

Auto-assigned public IPv4 addresses are released on stop.

Use an Elastic IP, or better, a load balancer or DNS name in front

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    The sandbox has ~/data/servers.txt (name, IP, state). Without network, practise the same 'filter then project' idea: print the names of the running servers only.

  2. 2

    Turn ~/data/servers.txt into JSON with jq and select the stopped ones, the way --query would with [?State==`stopped`].

  3. 3

    List the IDs of running instances tagged env=prod as plain text.

  4. 4

    Find the stopped instance, start it, and block until it's running.

Related commands

aws configureSet up AWS CLI credentials, region and profilesaws iamInspect users, roles and policies, and debug accesssshLog in to remote servers securelyawkProcess text by columns: filter, sum, count and report
Previousaws s3Nextaws iam