Capstone: build a right-sized development server that stops itself when idle

Steps

1. Check the guard rails before you build. Confirm lesson 1's budget is in place, then find an Availability Zone in your Region that offers t3.micro:

aws budgets describe-budgets --account-id 111122223333 --query "length(Budgets[?BudgetName=='clf-zero-spend-budget'])" --output text
AZ=$(aws ec2 describe-instance-type-offerings --location-type availability-zone --filters Name=instance-type,Values=t3.micro --query 'InstanceTypeOfferings[0].Location' --output text)
echo "$AZ"

The first command must print 1; if it prints 0, go back to lesson 1's lab first. The last prints a zone name such as eu-west-2a. Choosing one zone is fine for a development server; lesson 1 explains why a production workload would use two or more. 2. Make the licence decision. Read how the Amazon Linux 2023 image the template will use is billed:

LNX=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query 'Parameter.Value' --output text)
aws ec2 describe-images --image-ids "$LNX" --query 'Images[0].[PlatformDetails,UsageOperation]' --output text

It reads Linux/UNIX and RunInstances: no licence is billed, so neither license-included pricing nor BYOL applies. 3. Write the template. Read it before you save it: the AllowedValues line refuses any larger size, MapPublicIpOnLaunch: false keeps a public address off the server, the security group has no rules, CPUCredits: standard stops the burstable instance from running up extra CPU charges, and the alarm stops the server after two idle five-minute periods.

cat > clf-cap05-template.yaml << 'EOF'
AWSTemplateFormatVersion: '2010-09-09'
Description: clf-cap05 - one small private instance that stops itself when idle
Parameters:
  AzName:
    Type: AWS::EC2::AvailabilityZone::Name
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t2.micro]
  LatestAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.50.0.0/16
      Tags: [{Key: Name, Value: clf-cap05-vpc}]
  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Ref AzName
      CidrBlock: 10.50.1.0/24
      MapPublicIpOnLaunch: false
      Tags: [{Key: Name, Value: clf-cap05-subnet}]
  NoInboundGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: clf-cap05-no-inbound
      GroupDescription: clf-cap05 has no inbound rules at all
      VpcId: !Ref Vpc
  Server:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmi
      InstanceType: !Ref InstanceType
      SubnetId: !Ref Subnet
      SecurityGroupIds: [!Ref NoInboundGroup]
      CreditSpecification: {CPUCredits: standard}
      PropagateTagsToVolumeOnCreation: true
      Tags:
        - {Key: Name, Value: clf-cap05-dev}
        - {Key: Environment, Value: dev}
        - {Key: CostCentre, Value: clf-cap05}
  IdleStopAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: clf-cap05-idle-stop
      AlarmDescription: Stop the server when its CPU stays under 5 percent
      Namespace: AWS/EC2
      MetricName: CPUUtilization
      Dimensions: [{Name: InstanceId, Value: !Ref Server}]
      Statistic: Average
      Period: 300
      EvaluationPeriods: 2
      Threshold: 5
      ComparisonOperator: LessThanThreshold
      TreatMissingData: ignore
      AlarmActions: [!Sub 'arn:aws:automate:${AWS::Region}:ec2:stop']
Outputs:
  InstanceId:
    Value: !Ref Server
EOF

4. Validate the template, then build the stack in the zone you found. deploy waits until the stack is complete, which takes a few minutes:

aws cloudformation validate-template --template-body file://clf-cap05-template.yaml --query 'Parameters[].ParameterKey' --output text
aws cloudformation deploy --stack-name clf-cap05-dev --template-file clf-cap05-template.yaml --parameter-overrides AzName=$AZ
IID=$(aws cloudformation describe-stacks --stack-name clf-cap05-dev --query "Stacks[0].Outputs[?OutputKey=='InstanceId'].OutputValue" --output text)
aws ec2 describe-instances --instance-ids "$IID" --query 'Reservations[0].Instances[0].[InstanceType,State.Name,PublicIpAddress]' --output text
aws ec2 describe-security-groups --filters Name=group-name,Values=clf-cap05-no-inbound --query 'length(SecurityGroups[0].IpPermissions)' --output text

The instance reads t3.micro, running and None: it has no public address. The security group has 0 inbound rules. This is a rehost in lesson 3's terms: the server moves unchanged, and the improvements come from how it is run. 5. Gather the rightsizing evidence. Wait about 15 minutes after the stack completes, then read the server's average CPU for each five-minute period and compare the two smallest sizes:

aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization --dimensions Name=InstanceId,Value=$IID --start-time $(date -u -d '30 minutes ago' +%FT%TZ) --end-time $(date -u +%FT%TZ) --period 300 --statistics Average --query 'Datapoints[].Average' --output text
aws ec2 describe-instance-types --instance-types t3.micro t3.small --query 'InstanceTypes[].[InstanceType,VCpuInfo.DefaultVCpus,MemoryInfo.SizeInMiB]' --output table

An idle server shows averages close to zero. It is already the smallest size the template allows, so the remaining saving is not a smaller size: it is not running at all when nobody uses it. 6. Watch the automation work. Within about 20 minutes of the stack completing, the alarm reaches the alarm state and stops the server:

aws cloudwatch describe-alarms --alarm-names clf-cap05-idle-stop --query 'MetricAlarms[0].StateValue' --output text
aws ec2 describe-instances --instance-ids "$IID" --query 'Reservations[0].Instances[0].State.Name' --output text
aws ec2 describe-volumes --filters Name=tag:Name,Values=clf-cap05-dev --query 'Volumes[0].State' --output text

Expect ALARM, then stopped, then in-use. The last line matters for lesson 4: a stopped instance stops billing for compute, but its EBS volume still exists and is still billed, so stopping is not the same as deleting. If the server is still running after 25 minutes, read the alarm's history with aws cloudwatch describe-alarm-history --alarm-name clf-cap05-idle-stop --output text to see why, then stop it yourself with aws ec2 stop-instances --instance-ids "$IID" and carry on. 7. Write the review. Run nano clf-cap05-review.txt and write one line for each decision below, naming the Well-Architected pillar it serves and the CAF business outcome it supports: the budget alert; the t3.micro limit in AllowedValues; the CostCentre tag; no public address and no inbound rule; the idle-stop alarm; building it all from a template. Save with Ctrl+O, leave with Ctrl+X, and compare with the Notes.