Lightsail: the simple, fixed-price option

A serviced apartment for websites

In Lesson 1's places to live, EC2 is the apartment: you choose and pay for each part separately, the walls, the heating, the parking space. Lightsail is the same building, sold as a furnished flat at one monthly rent. It runs on EC2 underneath, but you pick a plan and get a server, a disk, a public address and a data allowance, all at one price.

It suits small, predictable things: a shop's website, a blog, a test server, a small app. When you need the full menu of EC2's sizes and networking, you move up, and Lightsail can export a server to EC2 when that day comes.

Plans and prices

In the console: Lightsail > Create instance lists the same plans and prices near the bottom of the page.

(Your machine)

cd ~/Apps/aws-practice/lesson-07
chmod +x lightsail-lab.sh
./lightsail-lab.sh fence

== The cheapest Lightsail Linux plans in this Region (from AWS, prices a month)
  plan              a month  an hour  CPUs  memory   disk  transfer  public IPv4
  nano_ipv6_3_0    $   3.50 $ 0.0048     2   0.5GB   20GB    1024GB  no, IPv6 only
  micro_ipv6_3_0   $   5.00 $ 0.0068     2     1GB   40GB    2048GB  no, IPv6 only
  nano_3_0         $   5.00 $ 0.0068     2   0.5GB   20GB    1024GB  yes
  micro_3_0        $   7.00 $ 0.0096     2     1GB   40GB    2048GB  yes
  small_ipv6_3_0   $  10.00 $ 0.0137     2     2GB   60GB    3072GB  no, IPv6 only
  small_3_0        $  12.00 $ 0.0164     2     2GB   60GB    3072GB  yes
  medium_ipv6_3_0  $  20.00 $ 0.0274     2     4GB   80GB    4096GB  no, IPv6 only
  medium_3_0       $  24.00 $ 0.0329     2     4GB   80GB    4096GB  yes
== What the lab would use
  plan:  nano_3_0
  image: debian_12
  zone:  us-east-2a

This step creates nothing: it asks AWS for the plans, also called bundles, and picks the cheapest one with a public IPv4 address, plus a current Debian Linux image. Three things to notice:

• Each IPv4 plan costs more than its IPv6-only twin: $1.50 more at the small end, $4.00 at the top. That's the public IPv4 address, the same charge Lesson 1 found on EC2, folded into the price. An IPv6-only plan is fine behind a load balancer or a CDN (content delivery network), but some visitors' networks still can't reach IPv6 directly.
• The hourly price is the monthly price over 730 hours. You pay by the hour, so a server that runs for 15 minutes costs a fraction of a cent.
• The transfer allowance covers data in and out. Going over it costs $0.09 a GB out of Ohio; data coming in is never charged.

Lightsail against EC2

Lesson 1 priced the bakery's shop on EC2. The same size of server on Lightsail:

For a small, steady site, Lightsail wins on price and on simplicity. What you give up comes later in this lesson.

Put the bakery's page online

In the console: Lightsail > Create instance: Linux/Unix, OS Only, Debian, then Add launch script and paste the script below, then pick a plan.

(Your machine)

./lightsail-lab.sh create

== Created jr-lesson7-shop: plan nano_3_0, image debian_12, zone us-east-2a
   Billing has started. Run ./lightsail-lab.sh delete when you're done.

Under the hood, that's one CLI call:

aws lightsail create-instances --instance-names jr-lesson7-shop --availability-zone us-east-2a \
  --blueprint-id debian_12 --bundle-id nano_3_0 \
  --user-data file:///tmp/jr-lesson7-userdata.sh \
  --tags key=lesson,value=7 key=owner,value=juniper-rye

| Part | What it does | |---|---| | --blueprint-id debian_12 | The image: what's installed when the server starts. Lightsail calls images blueprints. | | --bundle-id nano_3_0 | The plan, from the price list above | | --availability-zone us-east-2a | A Lightsail server lives in one zone | | --user-data file://... | A launch script that runs once, as the administrator, the first time the server starts | | --tags ... | Labels, so it's obvious what this is and who it belongs to |

The launch script is what puts the bakery online without anyone logging in:

#!/bin/bash
# Runs once, as root, the first time the server starts.
if command -v apt-get >/dev/null; then
  apt-get update -y && apt-get install -y nginx
  root=/var/www/html
else
  dnf install -y nginx && systemctl enable --now nginx
  root=/usr/share/nginx/html
fi
cat > "$root/index.html" <<'HTML'
<!doctype html>
<html lang="en"><head><meta charset="utf-8"><title>Juniper &amp; Rye</title></head>
<body><h1>Juniper &amp; Rye</h1><p>Sourdough, rye and morning buns. Open 7 to 3.</p></body></html>
HTML
systemctl restart nginx

It installs nginx, a web server, writes the bakery's page, and restarts nginx. It works on Debian and on Amazon Linux, which use different package tools. A server that sets itself up like this can be deleted and recreated in minutes, and that's the habit the rest of the track builds on.

Visit it

In the console: The instance's page shows its state and public IPv4 address. Open the address in a browser.

(Your machine)

./lightsail-lab.sh status

== Waiting for jr-lesson7-shop to run
  state: running
  public address: 3.147.238.182
== Fetching the page (the web server installs itself at first boot, so this can take a few minutes)
  after about 10 seconds:
    <!doctype html>
    <html lang="en"><head><meta charset="utf-8"><title>Juniper &amp; Rye</title></head>
    <body><h1>Juniper &amp; Rye</h1><p>Sourdough, rye and morning buns. Open 7 to 3.</p></body></html>

The script waited for the server to report running, then fetched http://3.147.238.182/ with curl until the page appeared: the launch script had already finished by then. curl shows the raw HTML. Now open the address from your own run in a browser, with http:// in front, while the server is still running:

Enlarge (opens the diagram full size)

Close

That's a real website: anyone, anywhere, could open it. Two things give away that it's not finished. It's an IP address, not a name like juniperandrye.com, and the browser says Not Secure because there's no HTTPS (HyperText Transfer Protocol Secure) certificate. Lesson 14 adds both. The address belonged to this server only while it existed; it went back to AWS when the server was deleted, which is why the second run, in the screenshot, got a different one.

The door left open

In the console: The instance > Networking tab > IPv4 Firewall: delete the SSH rule.

(Your machine)

./lightsail-lab.sh firewall

== Ports open on jr-lesson7-shop, as created
  tcp  80     open    from 0.0.0.0/0, ::/0
  tcp  22     open    from 0.0.0.0/0, ::/0
== After closing everything except the website (port 80)
  tcp  80     open    from 0.0.0.0/0, ::/0

Lightsail's firewall started with two ports open: 80, for the website, and 22, for SSH. Both are open from 0.0.0.0/0, ::/0, which means from every IPv4 and IPv6 address on the internet. Lightsail does that so its browser-based SSH works out of the box; it also means automated scanners start trying to log in within minutes of a server appearing.

This server never needs SSH, because the launch script did the setup. So the lab replaced the rules with just the website:

aws lightsail put-instance-public-ports --instance-name jr-lesson7-shop \
  --port-infos fromPort=80,toPort=80,protocol=tcp,cidrs=0.0.0.0/0,ipv6Cidrs=::/0

put-instance-public-ports replaces the whole list, so anything not in it is closed. If you do need SSH, open port 22 only from your own address, not the world.

Take it down, and check

In the console: The instance's menu (the three dots) > Delete. The Networking and Snapshots tabs on the Lightsail home page list static IPs, load balancers and snapshots.

(Your machine)

./lightsail-lab.sh delete

== Deleted jr-lesson7-shop. Billing for it stops now.
== Left over in this Region
  servers:          0
  static IPs:       0
  extra disks:      0
  snapshots:        0
  load balancers:   0

Why check five kinds of thing, not just servers? Because these are the ways a "deleted" Lightsail site keeps billing:

All five at zero means nothing from this lab is billing.

When to use Lightsail, and when not to

Lightsail's plans run on burstable CPUs: fine for a shop's site, which is quiet most of the time, but not for something busy all day. And it's still a server you run: in Lesson 5's terms, you patch its operating system, just as on EC2.

Spot the problem

Work out what's wrong before you read the explanation.

"I stopped it, so it's free." A student finishes a Lightsail lab, clicks Stop on the server, and takes a snapshot "just in case". Two months later the bill shows $10 for Lightsail, plus a little for storage. What happened? A stopped Lightsail server still bills its full plan price, and the snapshot bills for its storage. Stopping only turns the server off; it still holds its disk and its place. The fix: delete the server, delete the snapshot unless it's really needed, and release any static IP. Then check: does ./lightsail-lab.sh check, or the console's Lightsail home page, show nothing left?

Where you are now

The bakery's page went live on AWS from one command, set itself up without anyone logging in, had its open SSH port closed, and was deleted with nothing left billing, for well under a cent. You can read Lightsail's prices, compare them with EC2's, and say when each fits. Lightsail hid the network from you; Lesson 8 opens it up: VPCs, subnets and route tables, the network every EC2 server and database in the rest of the track lives in.

Check yourself

Key terms

• Amazon Lightsail: AWS's simple hosting, with flat monthly plans.
• Plan, or bundle: a Lightsail size and price: CPUs, memory, disk, transfer allowance, and whether there's a public IPv4 address.
• Blueprint: a Lightsail image: the operating system, and sometimes an app, that a server starts from.
• Launch script, or user data: a script that runs once, as root, the first time a server starts.
• nginx: a popular web server.
• Port: a numbered door on a server; 80 is the web, 22 is SSH.
• SSH (Secure Shell): a way to log in to a server remotely.
• 0.0.0.0/0, ::/0: every IPv4 address, and every IPv6 address.
• Static IP: a public address you keep, even if you replace the server. Free while attached; charged when not.
• Snapshot: a saved copy of a server's disk, billed for its storage.
• Data transfer allowance: the data in and out a plan includes each month; only extra data out is charged.

Go deeper

• AWS: Amazon Lightsail pricing (opens in a new tab), including any free trial for new Lightsail users.
• AWS: Data transfer in Lightsail (opens in a new tab), what counts against the allowance and what doesn't.
• Try: change pick_bundle in lightsail-lab.sh to choose the cheapest IPv6-only plan, run the lab again, and see whether status can reach the page from your network. What does that tell you about your own internet connection?