EC2, or Amazon Elastic Compute Cloud, is AWS’s virtual machine service. It lets customers launch and control cloud hosts with their own operating systems, software, and network settings. Unlike more abstract managed runtimes, EC2 gives the customer direct control over the instance, which usually means better visibility into processes, logs, network connections, and system behavior.
That control matters in cyber security. Defenders can use EC2 hosts for deeper monitoring, endpoint detection, kernel telemetry, and response tooling because they can inspect the machine itself. Attackers also target EC2 instances when they are exposed through weak credentials, vulnerable services, or misconfigurations, using them for persistence, data theft, or cryptomining. In cloud security reviews, EC2 often marks the boundary between workloads that can be instrumented at the host level and workloads where the provider hides more of the underlying environment.