Amazon EC2Compute Stable

AWS::EC2::Instance

Launches a single EC2 instance. Straightforward to write and unforgiving to update — over half its properties replace the instance when changed, which is why most production capacity is defined by a launch template instead.

Required properties 1 of 20

Ref returns Instance IDi-0abcdef1234567890

Fn::GetAtt 5 attributes

Replacement risk 10 10 properties force replacement

Minimal template

Every required property, nothing else

Resources:
  Jumpbox:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmazonLinuxAmi
      InstanceType: t3.micro
      SubnetId: !Ref PrivateSubnetA

{
  "Resources": {
    "Jumpbox": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": { "Ref": "LatestAmazonLinuxAmi" },
        "InstanceType": "t3.micro",
        "SubnetId": { "Ref": "PrivateSubnetA" }
      }
    }
  }
}

import { Instance, InstanceType, MachineImage, SubnetType } from 'aws-cdk-lib/aws-ec2';

new Instance(this, 'Jumpbox', {
  vpc,
  instanceType: new InstanceType('t3.micro'),
  machineImage: MachineImage.latestAmazonLinux2023(),
  vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
});

Strictly, only ImageId is required — but an instance with no SubnetId lands in the default VPC, which may not exist, and gets a security group you did not choose. Always be explicit about placement.

Overview #

AWS::EC2::Instance launches exactly one instance and manages it for the life of the stack. It is the most direct way to get a server, and the least manageable way to keep one.

The difficulty is not the resource — it is the mismatch between what the EC2 API can change on a running instance and what CloudFormation can express. EC2 can resize an EBS volume live; CloudFormation replaces the instance. EC2 can attach an instance profile to a running host; CloudFormation can too, but only for that one property. The result is that a template which looks like a small edit turns into a rebuild.

When to use this resource, and when not to

Reach for AWS::EC2::Instance when the host is genuinely singular and its identity matters: a bastion, a licence server, a legacy appliance, a build machine with a warm cache.

Reach for a launch template plus an Auto Scaling group when the host is fungible. Even at a fixed size of one, that combination gives you rolling replacement with health checks, instance refresh as a deliberate action rather than a side effect of a template edit, and a place to change user data without destroying anything.

The tell is the update behaviour. Well over half the properties on this page force replacement, and CloudFormation gives you no control over how that replacement happens — no health check, no warm-up, no draining. If losing the instance for the duration of a rebuild is not acceptable, this resource is not the right shape.

What replaces the instance #

The single most useful thing to know before editing a template. Switch the property explorer below to Table view and read the Update column, or take the summary:

Change	Effect
`InstanceType`	Stop, modify, start. Instance store contents and any non-Elastic public IP are lost.
`SecurityGroupIds`, `Monitoring`, `Tags`, `MetadataOptions`, `IamInstanceProfile`	Updates in place.
`ImageId`, `UserData`, `BlockDeviceMappings`, `SubnetId`, `KeyName`, `AvailabilityZone`, `PrivateIpAddress`, `Tenancy`	Replacement. New instance, new instance ID, old one terminated.

An instance you would actually deploy #

Parameters:
  LatestAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64

Resources:
  Jumpbox:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmi
      InstanceType: t3.micro
      SubnetId: !Ref PrivateSubnetA
      SecurityGroupIds:
        - !Ref JumpboxSecurityGroup

      # Session Manager instead of SSH: no inbound port, no key to rotate,
      # and every session is logged. Note the absence of KeyName.
      IamInstanceProfile: !Ref JumpboxInstanceProfile

      # IMDSv2 only. This is the control that turns an application-level SSRF
      # from a credential theft into an error message.
      MetadataOptions:
        HttpTokens: required
        HttpPutResponseHopLimit: 1

      BlockDeviceMappings:
        - DeviceName: /dev/xvda        # Amazon Linux; Ubuntu uses /dev/sda1
          Ebs:
            VolumeSize: 30
            VolumeType: gp3            # cheaper and faster than the gp2 default
            Encrypted: true
            DeleteOnTermination: true

      Monitoring: true
      PropagateTagsToVolumeOnCreation: true

      Tags:
        - Key: Name
          Value: acme-jumpbox
        - Key: Environment
          Value: production

{
  "Parameters": {
    "LatestAmi": {
      "Type": "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>",
      "Default": "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64"
    }
  },
  "Resources": {
    "Jumpbox": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": { "Ref": "LatestAmi" },
        "InstanceType": "t3.micro",
        "SubnetId": { "Ref": "PrivateSubnetA" },
        "SecurityGroupIds": [{ "Ref": "JumpboxSecurityGroup" }],
        "IamInstanceProfile": { "Ref": "JumpboxInstanceProfile" },
        "MetadataOptions": {
          "HttpTokens": "required",
          "HttpPutResponseHopLimit": 1
        },
        "BlockDeviceMappings": [
          {
            "DeviceName": "/dev/xvda",
            "Ebs": {
              "VolumeSize": 30,
              "VolumeType": "gp3",
              "Encrypted": true,
              "DeleteOnTermination": true
            }
          }
        ],
        "Monitoring": true,
        "PropagateTagsToVolumeOnCreation": true,
        "Tags": [
          { "Key": "Name", "Value": "acme-jumpbox" },
          { "Key": "Environment", "Value": "production" }
        ]
      }
    }
  }
}

Referencing an instance #

!Ref Jumpbox → i-0abcdef1234567890

!GetAtt Jumpbox.PrivateIp → 10.0.1.42

!GetAtt Jumpbox.PublicIp → (empty string)the attribute exists in a private subnet, and resolves to nothing

Properties

Expand a row for the full reference; nested types open in place

ImageId StringThe AMI to launch from. Required Replacement — CloudFormation creates a new resource and deletes the old one Create-only
AMI IDs are region-specific. The same image has a different ID in every region, which is why templates either carry a region map or resolve the ID at deploy time.
Type
String
Required
Yes
Update behaviour
Replacement
Pattern
^ami-[0-9a-f]{8}([0-9a-f]{9})?$
Example values
- ami-0abcdef1234567890
Resolve the AMI rather than hard-coding it
Public SSM parameters hold the current AMI ID for the common distributions, and a template can read them directly:
Parameters: LatestAmi: Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
This keeps the template region-independent and always current.
A resolved AMI parameter replaces instances silently
The convenience above has a cost. When AWS publishes a new AMI, the parameter’s value changes, and the next stack update — even one that changes something unrelated — sees a new ImageId and replaces every instance.
That is correct for an auto-scaled, stateless fleet and catastrophic for a stateful one. Pin the AMI for anything holding local state, or move it behind a launch template where the roll is deliberate.
InstanceType StringThe instance family and size. Some interruption — the resource may be briefly unavailable
Changing the type stops the instance, changes it, and starts it again. The instance keeps its EBS volumes and its private IP; it loses everything in instance store and, without an Elastic IP, its public IP.
Type
String
Required
No
Update behaviour
Some interruption
Default
m1.small
Example values
- t3.micro
- m6i.large
The documented default is from 2008
m1.small is a first-generation type that cannot be launched in most regions and is unavailable in every VPC created in the last decade. Omitting InstanceType therefore fails with an unhelpful Unsupported error rather than picking something sensible. Always set it.
Note
Not every type is available in every availability zone, and capacity is per-zone. An InsufficientInstanceCapacity failure is about the zone, not the region — retrying in a different subnet often succeeds immediately.
SubnetId StringThe subnet, which determines the VPC and the availability zone. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
Setting the subnet implies the availability zone; setting both and disagreeing fails. Moving an instance between subnets is a replacement, because an ENI cannot change subnet.
Type
String
Required
No
Update behaviour
Replacement
Example values
- subnet-0abcdef1234567890
AvailabilityZone StringThe zone to launch in. Implied by SubnetId, and must agree with it. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
The zone to launch in. Implied by SubnetId, and must agree with it.
Type
String
Required
No
Update behaviour
Replacement
Example values
- us-west-2a
Note
Zone names are shuffled per account: us-west-2a is a different physical zone in two different accounts. When placement must match across accounts, use the zone ID (usw2-az1) rather than the name.
BlockDeviceMappings Array of BlockDeviceMappingVolumes attached at launch, including the root volume's size and type. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
Volumes attached at launch, including the root volume's size and type.
Type
Array of BlockDeviceMapping
Required
No
Update behaviour
Replacement
Growing the root volume replaces the instance
Changing anything in this list — including raising the root volume from 8 GiB to 30 GiB — is a replacement. Meanwhile, EBS itself supports resizing a volume live, with no downtime.
The result is that the correct way to grow a root volume is to do it outside CloudFormation with ModifyVolume and then reconcile the template, or to move the instance behind a launch template. Editing this property is almost never what you want on a live host.
BlockDeviceMapping properties
- DeviceName StringDevice name as the OS will see it. Required Replacement — CloudFormation creates a new resource and deletes the old one
  The root device name depends on the AMI: /dev/xvda for Amazon Linux, /dev/sda1 for most Ubuntu images. Getting it wrong attaches an extra volume instead of configuring the root one, and the mistake is only visible from inside the instance.
  Type
  String
  Required
  Yes
  Update behaviour
  Replacement
  Example values
  /dev/xvda
- Ebs EbsBlockDeviceEBS volume settings for this device. Replacement — CloudFormation creates a new resource and deletes the old one
  EBS volume settings for this device.
  Type
  EbsBlockDevice
  Required
  No
  Update behaviour
  Replacement
  EbsBlockDevice properties
  Iops IntegerProvisioned IOPS. Conditional Replacement — CloudFormation creates a new resource and deletes the old one
  Provisioned IOPS.
  Type
  Integer
  Required
  ConditionalRequired for io1 and io2.
  Update behaviour
  Replacement
  Range
  100 – 256000
  VolumeSize IntegerSize in GiB. Must be at least the AMI snapshot's size. Replacement — CloudFormation creates a new resource and deletes the old one
  Size in GiB. Must be at least the AMI snapshot's size.
  Type
  Integer
  Required
  No
  Update behaviour
  Replacement
  Range
  1 – 65536
  Example values
  30
  VolumeType StringVolume type. Replacement — CloudFormation creates a new resource and deletes the old one
  gp3 is cheaper than gp2 per gigabyte, has a 3,000 IOPS baseline independent of size, and lets throughput be set separately. There is no workload where gp2 is the better choice on a new volume; the default here is simply old.
  Type
  String
  Required
  No
  Update behaviour
  Replacement
  Default
  gp2
  Allowed values
  gp2
  gp3
  io1
  io2
  st1
  sc1
  standard
  Encrypted BooleanWhether the volume is encrypted at rest. Replacement — CloudFormation creates a new resource and deletes the old one
  A volume restored from an unencrypted snapshot cannot be encrypted at launch. Enable EBS encryption by default at the account level and the question stops arising.
  Type
  Boolean
  Required
  No
  Update behaviour
  Replacement
  DeleteOnTermination BooleanWhether the volume is destroyed with the instance. Replacement — CloudFormation creates a new resource and deletes the old one
  Whether the volume is destroyed with the instance.
  Type
  Boolean
  Required
  No
  Update behaviour
  Replacement
  Default
  true
  Caution
  Defaults to true for the root volume and false for volumes created from a snapshot — a genuine asymmetry that catches people in both directions. Set it explicitly on every mapping.
  KmsKeyId StringKMS key for encryption. Requires `Encrypted`. Replacement — CloudFormation creates a new resource and deletes the old one
  KMS key for encryption. Requires `Encrypted`.
  Type
  String
  Required
  No
  Update behaviour
  Replacement
  SnapshotId StringSnapshot to create the volume from. Replacement — CloudFormation creates a new resource and deletes the old one
  Snapshot to create the volume from.
  Type
  String
  Required
  No
  Update behaviour
  Replacement
  Example values
  snap-0abcdef1234567890
  Throughput IntegerThroughput in MiB/s. Only valid for `gp3`. Replacement — CloudFormation creates a new resource and deletes the old one
  Throughput in MiB/s. Only valid for `gp3`.
  Type
  Integer
  Required
  No
  Update behaviour
  Replacement
  Range
  125 – 1000
- NoDevice JSONSuppress a device the AMI would otherwise map. Written as an empty object. Replacement — CloudFormation creates a new resource and deletes the old one
  Suppress a device the AMI would otherwise map. Written as an empty object.
  Type
  JSON
  Required
  No
  Update behaviour
  Replacement
- VirtualName StringInstance store volume name, such as `ephemeral0`. Replacement — CloudFormation creates a new resource and deletes the old one
  Instance store volume name, such as `ephemeral0`.
  Type
  String
  Required
  No
  Update behaviour
  Replacement
DisableApiTermination BooleanPrevent termination through the EC2 API. No interruption — updates in place
Prevent termination through the EC2 API.
Type
Boolean
Required
No
Update behaviour
No interruption
Default
false
Warning
This blocks the EC2 TerminateInstances call — including the one CloudFormation makes. A stack delete, or an update that would replace the instance, fails with OperationNotPermitted and leaves the stack in DELETE_FAILED.
Use a CloudFormation DeletionPolicy: Retain if the intent is to protect the resource from stack operations. Use this property only when the intent is to protect it from a human with console access, and expect to clear it before any stack change.
EbsOptimized BooleanDedicated throughput between the instance and EBS. Some interruption — the resource may be briefly unavailable
Enabled by default and not billable on current-generation types. The property exists for older families where it was optional and charged.
Type
Boolean
Required
No
Update behaviour
Some interruption
IamInstanceProfile StringName of the instance profile granting the instance a role. No interruption — updates in place
Takes an instance profile, not a role. Every role used by EC2 needs a profile wrapping it; the console creates one implicitly and CloudFormation does not, which is why AWS::IAM::InstanceProfile exists as its own resource.
Type
String
Required
No
Update behaviour
No interruption
Example values
- acme-payments-instance-profile
Attaching a profile does not immediately grant permissions
The instance metadata service caches credentials, and IAM itself is eventually consistent. A profile attached to a running instance can take a minute or two to become usable, and code that starts immediately after attachment sees AccessDenied for reasons that do not appear in any policy.
InstanceInitiatedShutdownBehavior StringWhat happens when the guest OS shuts itself down. No interruption — updates in place
What happens when the guest OS shuts itself down.
Type
String
Required
No
Update behaviour
No interruption
Default
stop
Allowed values
- stop
- terminate
Caution
With terminate, an in-guest shutdown -h now — including one issued by an unattended-upgrade reboot that goes wrong — destroys the instance and everything on volumes marked delete-on-termination. There is no confirmation and no recovery.
KeyName StringName of the EC2 key pair injected for SSH access. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
Name of the EC2 key pair injected for SSH access.
Type
String
Required
No
Update behaviour
Replacement
Example values
- acme-ops-2026
Important
Rotating a key pair by changing this property destroys and recreates the instance. The key is injected once at first boot by cloud-init and is never re-read, so replacement is the only way this property can change anything.
Use EC2 Instance Connect or SSM Session Manager instead, and leave this unset. Session Manager needs no inbound port, no key distribution, and logs every session.
LaunchTemplate LaunchTemplateSpecificationLaunch from a template, with any properties set here overriding it. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
The template supplies defaults; properties set directly on this resource win. Mixing the two is legal and consistently confusing — pick one place to define each setting.
Type
LaunchTemplateSpecification
Required
No
Update behaviour
Replacement
LaunchTemplateSpecification properties
- Version StringTemplate version, or `$Latest` / `$Default`. Required Replacement — CloudFormation creates a new resource and deletes the old one
  Template version, or `$Latest` / `$Default`.
  Type
  String
  Required
  Yes
  Update behaviour
  Replacement
  Example values
  $Latest
- LaunchTemplateId StringID of the launch template. Conditional Replacement — CloudFormation creates a new resource and deletes the old one
  ID of the launch template.
  Type
  String
  Required
  ConditionalExactly one of LaunchTemplateId or LaunchTemplateName is required.
  Update behaviour
  Replacement
- LaunchTemplateName StringName of the launch template. Conditional Replacement — CloudFormation creates a new resource and deletes the old one
  Name of the launch template.
  Type
  String
  Required
  ConditionalExactly one of LaunchTemplateId or LaunchTemplateName is required.
  Update behaviour
  Replacement
MetadataOptions MetadataOptionsInstance metadata service configuration, including IMDSv2 enforcement. No interruption — updates in place
Instance metadata service configuration, including IMDSv2 enforcement.
Type
MetadataOptions
Required
No
Update behaviour
No interruption
MetadataOptions properties
- HttpTokens StringWhether IMDSv2 session tokens are mandatory. No interruption — updates in place
  Set this to required. IMDSv1 is a plain unauthenticated GET, which means any server-side request forgery in an application on the instance can read the instance’s IAM credentials — the mechanism behind several well-known breaches.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Default
  optional
  Allowed values
  optional
  required
  Important
  Requiring tokens breaks SDK versions older than roughly 2019 and any code that curls the metadata endpoint directly. Audit with the MetadataNoToken CloudWatch metric before flipping it: it counts IMDSv1 calls, and a fleet at zero is safe to switch.
- HttpPutResponseHopLimit IntegerIP TTL for metadata responses, which limits how far a token can travel. No interruption — updates in place
  The default of 1 stops a container on the instance from reaching the metadata service, because the packet crosses the bridge and expires. Containerised workloads that legitimately need instance credentials require 2 — and a workload that needs its own identity should use a task or pod role instead.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
  Default
  1
  Range
  1 – 64
- HttpEndpoint StringWhether the metadata service is reachable at all. No interruption — updates in place
  Whether the metadata service is reachable at all.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Default
  enabled
  Allowed values
  enabled
  disabled
Monitoring BooleanEnable one-minute CloudWatch metrics instead of five-minute. No interruption — updates in place
Billed per instance per month. Worth it for anything autoscaling on CPU, where five-minute granularity means reacting to load ten minutes late.
Type
Boolean
Required
No
Update behaviour
No interruption
Default
false
PrivateIpAddress StringA specific private address within the subnet. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
The address must be inside the subnet’s CIDR and outside the five reserved addresses AWS holds in every subnet — the first four and the last.
Type
String
Required
No
Update behaviour
Replacement
Example values
- 10.0.1.42
PropagateTagsToVolumeOnCreation BooleanCopy the instance's tags onto volumes created at launch. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
Applies at launch only. Volumes attached later, and tags added later, are not propagated.
Type
Boolean
Required
No
Update behaviour
Replacement
Default
false
SecurityGroupIds Array of StringSecurity groups attached to the primary network interface. No interruption — updates in place
Use this, not SecurityGroups. The latter takes group names and only works outside a VPC, which has not been a real option since 2013.
Type
Array of String
Required
No
Update behaviour
No interruption
Example values
- ["sg-0abcdef1234567890"]
Note
Changing the attached groups updates in place with no interruption — one of the few properties on this resource that does. Prefer editing rules within a group over swapping groups, though; rule changes take effect immediately, whereas a group swap briefly reorders evaluation.
SourceDestCheck BooleanWhether the instance may send and receive traffic not addressed to it. No interruption — updates in place
Must be disabled for any instance acting as a NAT device, router, or transparent proxy. Otherwise leave it on.
Type
Boolean
Required
No
Update behaviour
No interruption
Default
true
Tags Array of TagTags applied to the instance. No interruption — updates in place
Tags applied to the instance.
Type
Array of Tag
Required
No
Update behaviour
No interruption
Items
0 – 50
Instance tags do not reach the volumes
Tags here apply to the instance only. The EBS volumes created alongside it are untagged, which breaks cost allocation and any tag-based backup policy — and the gap is invisible until the first month-end report.
Set PropagateTagsToVolumeOnCreation: true, which propagates at launch only, or tag the volumes explicitly in BlockDeviceMappings.
Tag properties
- Key StringTag key. Required No interruption — updates in place
  Tag key.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Length
  1 – 128
- Value StringTag value. Required No interruption — updates in place
  Tag value.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Length
  0 – 256
Tenancy StringWhether the instance shares hardware with other accounts. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
dedicated and host carry substantial cost premiums and exist for licensing and compliance requirements, not for performance.
Type
String
Required
No
Update behaviour
Replacement
Default
default
Allowed values
- default
- dedicated
- host
UserData StringBase64-encoded data made available to the instance at first boot. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
In CloudFormation, wrap the script in Fn::Base64; the property expects encoded content and does not encode for you.
Type
String
Required
No
Update behaviour
Replacement
Editing user data replaces the instance
User data is read once, at first boot. Because a running instance cannot be made to re-read it, CloudFormation’s only way to apply a change is to replace the instance — so a one-character fix to a bootstrap script destroys and rebuilds the host.
For anything that needs to change after launch, use a configuration management path that runs on an ongoing basis (SSM State Manager, cfn-hup) and keep user data limited to bootstrapping that agent.

Property	Type	Required	Update	Description
ImageId	`String`	Yes	Replacement	The AMI to launch from.
InstanceType	`String`	No	Some	The instance family and size.
SubnetId	`String`	No	Replacement	The subnet, which determines the VPC and the availability zone.
AvailabilityZone	`String`	No	Replacement	The zone to launch in. Implied by SubnetId, and must agree with it.
BlockDeviceMappings	`Array of BlockDeviceMapping`	No	Replacement	Volumes attached at launch, including the root volume's size and type.
BlockDeviceMappings.DeviceName	`String`	Yes	Replacement	Device name as the OS will see it.
BlockDeviceMappings.Ebs	`EbsBlockDevice`	No	Replacement	EBS volume settings for this device.
BlockDeviceMappings.Ebs.Iops	`Integer`	Conditional	Replacement	Provisioned IOPS.
BlockDeviceMappings.Ebs.VolumeSize	`Integer`	No	Replacement	Size in GiB. Must be at least the AMI snapshot's size.
BlockDeviceMappings.Ebs.VolumeType	`String`	No	Replacement	Volume type.
BlockDeviceMappings.Ebs.Encrypted	`Boolean`	No	Replacement	Whether the volume is encrypted at rest.
BlockDeviceMappings.Ebs.DeleteOnTermination	`Boolean`	No	Replacement	Whether the volume is destroyed with the instance.
BlockDeviceMappings.Ebs.KmsKeyId	`String`	No	Replacement	KMS key for encryption. Requires `Encrypted`.
BlockDeviceMappings.Ebs.SnapshotId	`String`	No	Replacement	Snapshot to create the volume from.
BlockDeviceMappings.Ebs.Throughput	`Integer`	No	Replacement	Throughput in MiB/s. Only valid for `gp3`.
BlockDeviceMappings.NoDevice	`JSON`	No	Replacement	Suppress a device the AMI would otherwise map. Written as an empty object.
BlockDeviceMappings.VirtualName	`String`	No	Replacement	Instance store volume name, such as `ephemeral0`.
DisableApiTermination	`Boolean`	No	None	Prevent termination through the EC2 API.
EbsOptimized	`Boolean`	No	Some	Dedicated throughput between the instance and EBS.
IamInstanceProfile	`String`	No	None	Name of the instance profile granting the instance a role.
InstanceInitiatedShutdownBehavior	`String`	No	None	What happens when the guest OS shuts itself down.
KeyName	`String`	No	Replacement	Name of the EC2 key pair injected for SSH access.
LaunchTemplate	`LaunchTemplateSpecification`	No	Replacement	Launch from a template, with any properties set here overriding it.
LaunchTemplate.Version	`String`	Yes	Replacement	Template version, or `$Latest` / `$Default`.
LaunchTemplate.LaunchTemplateId	`String`	Conditional	Replacement	ID of the launch template.
LaunchTemplate.LaunchTemplateName	`String`	Conditional	Replacement	Name of the launch template.
MetadataOptions	`MetadataOptions`	No	None	Instance metadata service configuration, including IMDSv2 enforcement.
MetadataOptions.HttpTokens	`String`	No	None	Whether IMDSv2 session tokens are mandatory.
MetadataOptions.HttpPutResponseHopLimit	`Integer`	No	None	IP TTL for metadata responses, which limits how far a token can travel.
MetadataOptions.HttpEndpoint	`String`	No	None	Whether the metadata service is reachable at all.
Monitoring	`Boolean`	No	None	Enable one-minute CloudWatch metrics instead of five-minute.
PrivateIpAddress	`String`	No	Replacement	A specific private address within the subnet.
PropagateTagsToVolumeOnCreation	`Boolean`	No	Replacement	Copy the instance's tags onto volumes created at launch.
SecurityGroupIds	`Array of String`	No	None	Security groups attached to the primary network interface.
SourceDestCheck	`Boolean`	No	None	Whether the instance may send and receive traffic not addressed to it.
Tags	`Array of Tag`	No	None	Tags applied to the instance.
Tags.Key	`String`	Yes	None	Tag key.
Tags.Value	`String`	Yes	None	Tag value.
Tenancy	`String`	No	Replacement	Whether the instance shares hardware with other accounts.
UserData	`String`	No	Replacement	Base64-encoded data made available to the instance at first boot.

Generated from the schema. The first pair shows only required and conditionally-required properties — a template you can paste and deploy. Property keys are ordered alphabetically here rather than required-first, because that is the order a template file conventionally uses.

Type: AWS::EC2::Instance
Properties:
  ImageId: ami-0abcdef1234567890

{
  "Type": "AWS::EC2::Instance",
  "Properties": {
    "ImageId": "ami-0abcdef1234567890"
  }
}

Every property, three levels deep:

Type: AWS::EC2::Instance
Properties:
  AvailabilityZone: us-west-2a
  BlockDeviceMappings:
  - DeviceName: /dev/xvda
    Ebs:
      DeleteOnTermination: true
      Encrypted: false
      Iops: 0.0
      KmsKeyId: String
      SnapshotId: snap-0abcdef1234567890
      Throughput: 0.0
      VolumeSize: '30'
      VolumeType: gp2
    NoDevice:
      Key: Value
    VirtualName: String
  DisableApiTermination: false
  EbsOptimized: false
  IamInstanceProfile: acme-payments-instance-profile
  ImageId: ami-0abcdef1234567890
  InstanceInitiatedShutdownBehavior: stop
  InstanceType: t3.micro
  KeyName: acme-ops-2026
  LaunchTemplate:
    LaunchTemplateId: String
    LaunchTemplateName: String
    Version: $Latest
  MetadataOptions:
    HttpEndpoint: enabled
    HttpPutResponseHopLimit: 1
    HttpTokens: optional
  Monitoring: false
  PrivateIpAddress: 10.0.1.42
  PropagateTagsToVolumeOnCreation: false
  SecurityGroupIds:
  - String
  SourceDestCheck: true
  SubnetId: subnet-0abcdef1234567890
  Tags:
  - Key: String
    Value: String
  Tenancy: default
  UserData: String

{
  "Type": "AWS::EC2::Instance",
  "Properties": {
    "AvailabilityZone": "us-west-2a",
    "BlockDeviceMappings": [
      {
        "DeviceName": "/dev/xvda",
        "Ebs": {
          "DeleteOnTermination": true,
          "Encrypted": false,
          "Iops": 0,
          "KmsKeyId": "String",
          "SnapshotId": "snap-0abcdef1234567890",
          "Throughput": 0,
          "VolumeSize": "30",
          "VolumeType": "gp2"
        },
        "NoDevice": {
          "Key": "Value"
        },
        "VirtualName": "String"
      }
    ],
    "DisableApiTermination": false,
    "EbsOptimized": false,
    "IamInstanceProfile": "acme-payments-instance-profile",
    "ImageId": "ami-0abcdef1234567890",
    "InstanceInitiatedShutdownBehavior": "stop",
    "InstanceType": "t3.micro",
    "KeyName": "acme-ops-2026",
    "LaunchTemplate": {
      "LaunchTemplateId": "String",
      "LaunchTemplateName": "String",
      "Version": "$Latest"
    },
    "MetadataOptions": {
      "HttpEndpoint": "enabled",
      "HttpPutResponseHopLimit": 1,
      "HttpTokens": "optional"
    },
    "Monitoring": false,
    "PrivateIpAddress": "10.0.1.42",
    "PropagateTagsToVolumeOnCreation": false,
    "SecurityGroupIds": [
      "String"
    ],
    "SourceDestCheck": true,
    "SubnetId": "subnet-0abcdef1234567890",
    "Tags": [
      {
        "Key": "String",
        "Value": "String"
      }
    ],
    "Tenancy": "default",
    "UserData": "String"
  }
}

updates in place some interruption replacement create-only read-only write-only

Return values

What other resources can read from this one

Ref

Returns the instance ID.

!Ref MyResource → i-0abcdef1234567890

`Fn::GetAtt` attributes

Attribute	Type	Description	Example value
AvailabilityZone	`String`	The zone the instance actually launched in.	`us-west-2a`
PrivateDnsName	`String`	Internal DNS name, resolvable within the VPC.	`ip-10-0-1-42.us-west-2.compute.internal`
PrivateIp	`String`	Primary private IPv4 address.	`10.0.1.42`
PublicDnsName	`String`	Public DNS name, if the VPC has DNS hostnames enabled.	`ec2-203-0-113-42.us-west-2.compute.amazonaws.com`
PublicIp	`String`	Public IPv4 address, if one was assigned. Empty for instances in private subnets, and it changes on stop/start unless it is an Elastic IP.	`203.0.113.42`

Required permissions

For the principal running the stack operation

create

ec2:RunInstances
ec2:DescribeInstances
ec2:CreateTags
iam:PassRole

read

ec2:DescribeInstances
ec2:DescribeInstanceAttribute
ec2:DescribeTags

update

ec2:ModifyInstanceAttribute
ec2:StopInstances
ec2:StartInstances
ec2:CreateTags
ec2:DeleteTags
ec2:ModifyInstanceMetadataOptions

delete

ec2:TerminateInstances
ec2:DescribeInstances

list

ec2:DescribeInstances

{
  "Statement": [
    {
      "Action": [
        "ec2:CreateTags",
        "ec2:DeleteTags",
        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeInstances",
        "ec2:DescribeTags",
        "ec2:ModifyInstanceAttribute",
        "ec2:ModifyInstanceMetadataOptions",
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances",
        "iam:PassRole"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "ManageResource"
    }
  ],
  "Version": "2012-10-17"
}

Statement:
- Action:
  - ec2:CreateTags
  - ec2:DeleteTags
  - ec2:DescribeInstanceAttribute
  - ec2:DescribeInstances
  - ec2:DescribeTags
  - ec2:ModifyInstanceAttribute
  - ec2:ModifyInstanceMetadataOptions
  - ec2:RunInstances
  - ec2:StartInstances
  - ec2:StopInstances
  - ec2:TerminateInstances
  - iam:PassRole
  Effect: Allow
  Resource: '*'
  Sid: ManageResource
Version: '2012-10-17'