Skip to main content
In this lesson you’ll provision a simple Amazon EC2 web server using an AWS CloudFormation template. The template adds a UserData script so the instance boots with Apache (httpd) already installed and running. This approach makes it easy to automate server provisioning and verify that the instance is serving HTTP traffic after creation. What we’ll do
  • Add a Base64-encoded UserData script to the EC2 instance so it runs on first launch.
  • Create a security group that allows HTTP (port 80) and optionally SSH.
  • Deploy the stack, confirm the instance is running, and retrieve the public IP to visit the web server.

​
What is UserData (and why Base64)?

UserData is a script that automatically runs the first time an EC2 instance boots. It’s commonly used to install packages, configure services, or run commands that prepare the instance for its role. CloudFormation expects UserData to be Base64-encoded; use Fn::Base64 (or !Base64) so CloudFormation encodes the script for you. Example: EC2 resource with UserData
Notes:
  • The shebang (#!/bin/bash) ensures the script runs with bash.
  • The commands update packages, install httpd, start it, and enable it to run on boot.

​
Configure the security group

Ensure the security group allows inbound HTTP (port 80). If you need SSH access, add a rule for port 22 — but restrict its source CIDR to known IP addresses for security. Security group example:
Quick reference: common inbound rules

​
Full example template (core parts)

This concise CloudFormation template demonstrates Metadata, Parameters, Resources, and Outputs. It provisions an EC2 instance with the UserData script and a security group, and exposes the instance ID and public IP as outputs.
Notes about the template
  • Replace the AMI (ImageId) and VpcId with values appropriate to your region/account.
  • The Outputs section makes it easy to retrieve the public IP from the CloudFormation console.

​
Deploy the CloudFormation stack

  • Upload this template when creating the stack in the CloudFormation console, or provide an S3 URL.
  • Choose an instance type (for example, t3.micro) and create the stack.
A screenshot of the AWS CloudFormation "Create Stack" page with a Windows file-open dialog overlay showing a "cf-project" folder containing two YAML files named "ec2-instance" and "s3-bucket." The browser tabs, AWS console UI, and the Windows taskbar are visible in the background.
Wait for the stack to reach CREATE_COMPLETE. Then open the EC2 console and confirm the instance status is Running and the instance status checks have passed before connecting.
A screenshot of the AWS EC2 Instances console showing one instance named "SimpleWebServer" (i-02402e29b515ac41f) in the Running state, type t3.micro. The instance shows "3/3 checks passed."

​
Find the instance public IP

You can locate the instance public IPv4 address via:
  • EC2 console: select the instance and view the Public IPv4 address, or
  • CloudFormation console: open the stack’s Outputs (InstancePublicIP).
A screenshot of the AWS CloudFormation console showing a stack named "DemoStack" with status CREATE_COMPLETE. The Outputs pane lists an EC2 InstanceId and its InstancePublicIP (18.117.112.74).
Open the public IP in a browser. If the UserData ran correctly, Apache will serve the default page and you should see the “It works!” message.
A web browser window showing a simple white page with a large "It works!" message. The address bar displays an IP address and a "Not secure" warning, with multiple tabs and the Windows taskbar visible.

​
Notes and best practices

UserData scripts run only once—on the instance’s first boot. To apply a changed UserData script to an existing instance, you must recreate the instance (for example, delete and re-create the CloudFormation stack) or use a configuration management tool (like Cloud-init, UserData-managed scripts that re-run, or systems such as Ansible) that can enforce configuration changes after boot.
Avoid leaving SSH (port 22) open to the entire internet in production. Restrict SSH access to known IP ranges or use AWS Systems Manager Session Manager for secure, auditable shell access: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
That’s it — with this CloudFormation template your EC2 instance will boot, install and start Apache, and serve a default web page so you can verify the UserData executed successfully.

Watch Video