canonical: https://jentic.com/apis/amazonaws.com/aws-ec2

# AWS Amazon Elastic Compute Cloud

Jentic publishes the only available OpenAPI specification for Amazon Elastic Compute Cloud, keeping it validated and agent-ready. Amazon EC2 provides resizable compute capacity in AWS, and its API is the foundational control plane for EC2 instances, EBS volumes, VPC networking, security groups, and a broad set of related compute primitives. With more than a thousand operations, the API spans instance lifecycle, AMIs, key pairs, networking (VPC, subnets, route tables, NAT, VPN), elastic IP addresses, transit gateways, and capacity reservations. Use it when an agent needs to provision compute, manage networking, or automate any AWS infrastructure-as-API workflow.

## For AI agents

Provision and manage EC2 instances, EBS volumes, AMIs, VPC networking, security groups, and the broad surface of AWS compute and network resources.

## Scope

Does not handle Auto Scaling Groups, Elastic Load Balancing, or container orchestration - use for EC2 instances, EBS volumes, and VPC networking primitives only.

## Capabilities

- Launch and terminate EC2 instances with RunInstances and TerminateInstances at the requested instance type and AMI
- Manage EBS volumes via CreateVolume, AttachVolume, DetachVolume, and DeleteVolume tied to instances
- Define VPC networking with CreateVpc, CreateSubnet, CreateRouteTable, and CreateInternetGateway
- Control inbound and outbound traffic through CreateSecurityGroup, AuthorizeSecurityGroupIngress, and RevokeSecurityGroupEgress
- Allocate and associate Elastic IP addresses, create NAT gateways, and configure VPC endpoints
- Operate transit gateways, VPN connections, and VPC peering for multi-VPC and hybrid networking

## Use cases

### Provision a Fleet of Compute Instances

Use RunInstances to launch one or more EC2 instances of a chosen type from an AMI, attach them to a security group, and place them in a target subnet. The same call sets tags, IAM instance profiles, and user data, giving an agent everything needed to bring up workers, application servers, or batch hosts in one structured call.

Example prompt: Call RunInstances with ImageId, InstanceType t3.medium, MinCount 1, MaxCount 1, the chosen SubnetId, and a SecurityGroupIds list, then poll DescribeInstances until State.Name is running.

### Stand Up a Production VPC

Compose a production-ready network by chaining CreateVpc, CreateSubnet for each AZ, CreateInternetGateway, CreateRouteTable, CreateNatGateway, and the route association calls. The result is a fully tagged VPC with predictable CIDR layout that workloads can be deployed into without console clicks.

Example prompt: Call CreateVpc with the requested CidrBlock, CreateSubnet for each AZ, CreateInternetGateway, AttachInternetGateway, then CreateRouteTable and CreateRoute to wire up egress.

### Lock Down Inbound Access with Security Groups

Tighten access to a workload by replacing broad CIDR allow rules with narrow ones. AuthorizeSecurityGroupIngress adds the permitted port and source CIDR, RevokeSecurityGroupIngress removes outdated rules, and DescribeSecurityGroups gives an audit-friendly view of effective rules per group.

Example prompt: Call AuthorizeSecurityGroupIngress with the GroupId, IpProtocol tcp, FromPort 443, ToPort 443, and the approved CIDR ranges, then DescribeSecurityGroups to verify.

### Agent-Driven Infrastructure as API

An AI agent connected via Jentic can interpret a runbook, locate the right EC2 operations, and provision compute and networking changes - launch instances, rotate AMIs, scale Auto Scaling-friendly groups, or rebuild VPC routes - without leaving the conversation. Jentic returns the matching EC2 operation and schema across the 1000+ operation surface so the agent can pick the right call.

Example prompt: Search Jentic for 'launch an EC2 instance', load RunInstances, execute it with the requested InstanceType, ImageId, SubnetId, and SecurityGroupIds, then DescribeInstances until running.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /#Action=RunInstances | Launch one or more EC2 instances |
| POST | /#Action=TerminateInstances | Terminate one or more instances |
| POST | /#Action=DescribeInstances | Describe instances and their state |
| POST | /#Action=CreateVpc | Create a VPC with a CIDR block |
| POST | /#Action=CreateSubnet | Create a subnet in a VPC |
| POST | /#Action=AuthorizeSecurityGroupIngress | Add an inbound rule to a security group |
| POST | /#Action=AllocateAddress | Allocate an Elastic IP address |
| POST | /#Action=CreateNatGateway | Create a NAT gateway in a public subnet |

## Key resources

- **Instance** — EC2 virtual machine lifecycle: launch, stop, start, terminate.
- **VPC** — Logically isolated virtual network.
- **Subnet** — Range of IP addresses within a VPC tied to an Availability Zone.
- **Security Group** — Stateful inbound and outbound traffic rules for instances and ENIs.
- **EBS Volume** — Block storage volume attachable to instances.
- **Route Table** — Routing rules controlling subnet traffic flow.
- **Elastic IP** — Static public IPv4 address that can be remapped between resources.
- **Transit Gateway** — Hub-and-spoke connectivity across VPCs and on-premises networks.

## Why Jentic

- **Setup:** Wiring Amazon EC2 by hand means building SigV4 request signing, resolving the regional ec2.{region}.amazonaws.com host, and handling the query-style Action dispatch across a large operation surface plus AWS retries yourself. Through Jentic you install once, import EC2 from the API Directory, store the AWS access keys once, and your agent calls it.
- **Permission scoping:** EC2 dispatches every action through a single endpoint with the operation named in the request, so scope the agent to the operations it needs, such as describing instances or authorizing a security group ingress rule. Destructive operations like terminating instances stay out of that set unless you add them.
- **Credential handling:** Your AWS access keys for EC2 are stored once, encrypted, by your own Jentic One instance and injected at execution time when the request is signed. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'launch an EC2 instance' or 'create a security group rule', and Jentic returns the matching EC2 operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Amazon Elastic Block Store** — Block-level snapshot APIs for the volumes EC2 attaches.
- **AWS Auto Scaling** — Auto Scaling Groups that orchestrate EC2 instance fleets.
- **AWS Lambda** — Run code without managing instances or VPCs.

## FAQ

### Why is there no official OpenAPI spec for Amazon Elastic Compute Cloud?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Amazon Elastic Compute Cloud via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Amazon EC2 API use?

EC2 uses AWS Signature Version 4 (HMAC) signing with an AWS access key ID and secret access key. Through Jentic, those credentials live encrypted in your Jentic One instance and are injected into signed requests at execution time, so the agent never sees the raw secret access key.

### Can I launch and tag instances in one call?

Yes. RunInstances accepts a TagSpecifications parameter that applies tags to the instance and any volumes created by the launch. There is no need to call CreateTags separately for instances launched this way.

### What are the rate limits for the Amazon EC2 API?

EC2 enforces per-account, per-region request limits that vary by operation; describe operations have higher limits than write operations such as RunInstances. Specific numbers are not in the spec; the AWS user guide documents them, and ThrottlingException responses should trigger exponential backoff.

### How do I launch an instance through Jentic?

Search Jentic for 'launch an EC2 instance', load RunInstances, then execute it with ImageId, InstanceType, MinCount, MaxCount, SubnetId, and SecurityGroupIds. Run pip install jentic and use the async search and execute pattern.

### Does this API include Auto Scaling and Elastic Load Balancing?

No. EC2 covers instances, volumes, AMIs, and VPC networking. Auto Scaling Groups and Elastic Load Balancers live in their own AWS APIs (autoscaling and elasticloadbalancingv2) and require separate operations to manage.

### Can I limit what my agent is allowed to do with the AWS EC2 API?

Yes. Because Jentic One is self-hosted, your own rules decide which EC2 operations and AWS credentials the agent may use. EC2 dispatches every action through a single endpoint with the operation named in the request, so you can scope the agent to only the calls it needs, such as DescribeInstances or AuthorizeSecurityGroupIngress. Destructive operations like TerminateInstances stay out of that set unless you explicitly add them.