Cloud Vms

---
name: cloud-vms
description: "Cloud virtual machine management across AWS EC2, Azure VMs, and Google Compute Engine: instance lifecycle (create, start, stop, resize, terminate), CLI tooling (aws ec2, az vm, gcloud compute), storage (EBS, Managed Disks, Persistent Disks), networking (VPCs, security groups, NSGs, firewall rules), monitoring (CloudWatch, Azure Monitor, Cloud Logging), remote execution (SSM, Run Command, SSH/IAP), images (AMIs, custom images, image galleries), auto-scaling, and cross-platform operational mapping. Use for \"EC2\", \"aws ec2\", \"Azure VM\", \"az vm\", \"Compute Engine\", \"gcloud compute\", \"cloud VM\", \"cloud instance\", \"AMI\", \"managed disk\", \"persistent disk\". Do NOT use for overall cloud account/landing-zone architecture, multi-service design, or cloud strategy — that's the `cloud-platforms` plugin; this skill is instance-level VM service operations only."
license: MIT
---

# Cloud Virtual Machines

This skill covers VM management across all three major cloud providers: AWS EC2, Azure Virtual Machines, and Google Compute Engine. It covers:

- Instance lifecycle management across all three clouds
- CLI tooling: `aws ec2`, `az vm`, `gcloud compute`
- Instance type families and sizing (general purpose, compute, memory, GPU, storage optimized)
- Storage: EBS volumes (AWS), Managed Disks (Azure), Persistent Disks (GCP)
- Networking: VPCs, subnets, security groups, NSGs, firewall rules, static IPs
- Images: AMIs (AWS), Marketplace images and galleries (Azure), public image projects (GCP)
- Monitoring: CloudWatch (AWS), Azure Monitor (Azure), Cloud Logging/Monitoring (GCP)
- Remote execution: SSM/Run Command (AWS), Run Command (Azure), SSH/IAP (GCP)
- Auto-scaling: ASGs (AWS), VMSS (Azure), MIGs (GCP)
- Key management, metadata services, and instance identity

## Cross-Platform Quick Reference

| Operation | AWS CLI | Azure CLI | GCP CLI |
|-----------|---------|-----------|---------|
| Create VM | `aws ec2 run-instances` | `az vm create` | `gcloud compute instances create` |
| List VMs | `aws ec2 describe-instances` | `az vm list` | `gcloud compute instances list` |
| Start | `aws ec2 start-instances` | `az vm start` | `gcloud compute instances start` |
| Stop | `aws ec2 stop-instances` | `az vm deallocate` | `gcloud compute instances stop` |
| Restart | `aws ec2 reboot-instances` | `az vm restart` | `gcloud compute instances reset` |
| Delete | `aws ec2 terminate-instances` | `az vm delete` | `gcloud compute instances delete` |
| Resize | `modify-instance-attribute` | `az vm resize` | `set-machine-type` |
| SSH | SSM `start-session` | `az ssh vm` | `gcloud compute ssh` |
| Snapshot | `aws ec2 create-snapshot` | `az snapshot create` | `gcloud compute disks snapshot` |
| Remote exec | SSM `send-command` | `az vm run-command invoke` | `gcloud compute ssh --command` |
| Console log | `get-console-output` | `boot-diagnostics get-boot-log` | `get-serial-port-output` |

## How to Approach Tasks

When you receive a request:

1. **Identify the cloud provider** -- Determine which cloud (AWS, Azure, GCP, or multi-cloud) from the user's context. If unclear, ask.

2. **Classify** the request type:
   - **Architecture** -- Load `references/architecture.md` for cross-cloud concepts
   - **AWS operations** -- Load `references/aws-ec2-cli.md`
   - **Azure operations** -- Load `references/azure-vm-cli.md`
   - **GCP operations** -- Load `references/gce-cli.md`
   - **Cross-platform comparison** -- Load `references/cross-platform.md`
   - **Troubleshooting** -- Load the provider-specific CLI reference and architecture

3. **Load context** -- Read the relevant reference file for detailed CLI examples.

4. **Analyze** -- Apply cloud-specific reasoning. Account for provider differences (Azure requires deallocate to stop billing; GCP stop always deallocates; AWS stop always deallocates for EBS-backed).

5. **Recommend** -- Provide actionable CLI commands with real flags and options.

6. **Verify** -- Suggest validation commands (describe, list, wait, status checks).

## Core Concepts Across Clouds

### Instance Types

| Category | AWS | Azure | GCP |
|----------|-----|-------|-----|
| General Purpose | t3, m5, m6i, m7g | D-series (D2s_v5) | e2, n2, n4 |
| Compute Optimized | c5, c6i, c7g | F-series (F4s_v2) | c3, c3d |
| Memory Optimized | r5, r6i, x2idn | E-series (E8s_v5), M-series | m3, n2-highmem |
| GPU / Accelerated | p4, g5, inf2 | N-series (NC, NV, ND) | a2, a3, g2 |
| Storage Optimized | i3, i4i, d3 | L-series (L8s_v3) | n2-standard + local SSD |

### Storage

| Feature | AWS (EBS) | Azure (Managed Disks) | GCP (Persistent Disks) |
|---------|-----------|----------------------|----------------------|
| Default type | gp3 (SSD) | Premium SSD (LRS) | pd-balanced (SSD) |
| High IOPS | io2 (256K IOPS) | Ultra Disk (160K IOPS) | pd-extreme (120K IOPS) |
| HDD | st1, sc1 | Standard HDD | pd-standard |
| Ephemeral | Instance store (NVMe) | Temp disk (local SSD) | Local SSD (375 GB each) |
| Online resize | Yes (expand only) | Yes (expand only) | Yes (expand only) |
| Snapshots | EBS snapshots | Disk snapshots | Disk snapshots |

### Networking

| Feature | AWS | Azure | GCP |
|---------|-----|-------|-----|
| Virtual network | VPC (regional) | VNet (regional) | VPC (global) |
| Subnets | AZ-scoped | Regional | Regional |
| Firewall | Security Groups (per-ENI) | NSGs (per-NIC or subnet) | Firewall rules (per-network, tag-targeted) |
| Static IP | Elastic IP | Public IP (Standard SKU) | Static external address |
| Internal DNS | Route 53 Resolver | Azure DNS Private | Cloud DNS |

### HA and Auto-Scaling

| Feature | AWS | Azure | GCP |
|---------|-----|-------|-----|
| Placement | Placement Groups | Availability Sets, AZs | Zones, sole-tenant nodes |
| Auto-scaling | Auto Scaling Groups (ASG) | VM Scale Sets (VMSS) | Managed Instance Groups (MIG) |
| Health checks | EC2 status + ELB | Extension + LB probes | Autohealer + health checks |
| Templates | Launch Templates | VMSS model / ARM templates | Instance Templates |

### Key Billing Differences

- **AWS**: `stop-instances` always deallocates compute. EBS charges continue. Spot instances can be interrupted.
- **Azure**: `az vm stop` halts the OS but keeps the VM allocated (billing continues). Must use `az vm deallocate` to stop compute billing. Managed disk charges always apply.
- **GCP**: `gcloud compute instances stop` always deallocates compute. Persistent disk charges continue. Preemptible/Spot VMs can be reclaimed.

### Instance Metadata

All three clouds expose instance metadata via a link-local HTTP endpoint:

```bash
# AWS (IMDSv2)
TOKEN=$(curl -sX PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
  http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/instance-id

# Azure
curl -s -H "Metadata:true" \
  "http://169.254.169.254/metadata/instance?api-version=2023-07-01"

# GCP
curl -s -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/name
```

## Per-Cloud CLI Quick Start

### AWS EC2

```bash
# Launch instance
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.medium \
  --key-name my-key \
  --security-group-ids sg-0abc \
  --subnet-id subnet-0abc \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=my-server}]' \
  --metadata-options HttpTokens=required \
  --count 1

# List running instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].[Tags[?Key==`Name`].Value|[0],InstanceId,InstanceType,PublicIpAddress]' \
  --output table

# Stop / start / terminate
aws ec2 stop-instances --instance-ids i-0abc
aws ec2 start-instances --instance-ids i-0abc
aws ec2 terminate-instances --instance-ids i-0abc

# SSM remote shell (no SSH port needed)
aws ssm start-session --target i-0abc

# SSM run command on tagged instances
aws ssm send-command \
  --document-name AWS-RunShellScript \
  --targets 'Key=tag:Env,Values=prod' \
  --parameters commands=["uptime","df -h"]
```

### Azure VMs

```bash
# Create VM
az vm create \
  --resource-group myRG \
  --name myVM \
  --image Ubuntu2204 \
  --size Standard_D4s_v5 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --tags env=production

# List with power state
az vm list --show-details \
  --query "[].{Name:name, State:powerState, Size:hardwareProfile.vmSize}" \
  --output table

# Deallocate (stops billing), then start
az vm deallocate --resource-group myRG --name myVM
az vm start --resource-group myRG --name myVM

# Remote script execution (no SSH needed)
az vm run-command invoke \
  --resource-group myRG --name myVM \
  --command-id RunShellScript \
  --scripts "uptime && df -h"
```

### Google Compute Engine

```bash
# Create instance
gcloud compute instances create my-instance \
  --zone=us-central1-a \
  --machine-type=n2-standard-4 \
  --image-family=debian-12 \
  --image-project=debian-cloud \
  --boot-disk-size=50GB \
  --boot-disk-type=pd-ssd \
  --labels=env=production

# List instances
gcloud compute instances list --filter="status=RUNNING"

# Stop / start / delete
gcloud compute instances stop my-instance --zone=us-central1-a
gcloud compute instances start my-instance --zone=us-central1-a
gcloud compute instances delete my-instance --zone=us-central1-a --quiet

# SSH (gcloud manages keys)
gcloud compute ssh my-instance --zone=us-central1-a

# SSH through IAP (no public IP required)
gcloud compute ssh my-instance --zone=us-central1-a --tunnel-through-iap
```

## Key Conceptual Differences

| Concept | AWS | Azure | GCP |
|---------|-----|-------|-----|
| Resource grouping | Tags (optional) | Resource Groups (mandatory) | Projects + labels |
| Billing stop | `stop` always deallocates | Must use `deallocate` | `stop` always deallocates |
| SSH keys | Key pairs (RSA/ED25519) | Keys at creation or extension | OS Login (IAM) or metadata |
| Network scope | VPC regional | VNet regional | VPC global |
| Firewall model | Security Groups per ENI | NSGs per NIC or subnet | Firewall rules per network, tag-targeted |
| Instance identity | IAM Instance Profile | Managed Identity (MSI) | Service Account |
| Marketplace images | AMI (owner + region-scoped) | Publisher/offer/SKU | Public image projects |
| Auto-scale | Auto Scaling Group | VM Scale Set | Managed Instance Group |
| Preemptible/Spot | Spot Instances (~70% off) | Spot VMs (~80% off) | Spot VMs (~60-80% off) |
| Sustained use discount | None (use RI/SP) | None (use RI) | Automatic |

## Common Pitfalls

**1. Azure: stopping without deallocating**
`az vm stop` halts the OS but the VM remains allocated and billing continues. Always use `az vm deallocate` to release compute resources and stop billing.

**2. AWS: termination protection not enabled**
Accidental `terminate-instances` is permanent and irreversible. Enable `--disable-api-termination` on production instances.

**3. GCP: forgetting --zone on every command**
Most `gcloud compute` commands require `--zone`. Set a default with `gcloud config set compute/zone us-central1-a` to avoid repetition.

**4. Using default security groups / NSGs / firewall rules**
Default rules are overly permissive. Create explicit, least-privilege rules for each workload.

**5. Not enforcing IMDSv2 on AWS**
IMDSv1 is vulnerable to SSRF attacks. Set `--metadata-options HttpTokens=required` on all instances.

**6. Ignoring ephemeral storage**
Instance store (AWS), temp disk (Azure), and local SSD (GCP) data is lost on stop/terminate. Never store persistent data on ephemeral storage.

**7. Not tagging/labeling resources**
Untagged resources are impossible to manage at scale. Apply consistent tags/labels at creation for cost allocation, automation, and cleanup.

**8. Skipping snapshots before resize or maintenance**
Always snapshot critical disks before changing instance types, OS updates, or destructive operations.

**9. Running without auto-scaling for variable workloads**
Fixed instance counts waste money during low demand and fail under high demand. Use ASGs/VMSS/MIGs with health checks.

**10. Not using launch templates / instance templates**
Launching instances manually with ad-hoc parameters causes configuration drift. Use templates for repeatable, versioned deployments.

**11. Leaving unattached disks and unassociated IPs**
Detached EBS volumes, unattached Managed Disks, and reserved static IPs all incur charges. Audit and clean up orphaned resources regularly.

**12. Not using committed/reserved pricing for steady-state workloads**
On-demand pricing for instances running 24/7 wastes significant budget. Use Reserved Instances (AWS), Reserved VM Instances (Azure), or Committed Use Discounts (GCP) for predictable workloads.

## Reference Files

Load these when you need deep knowledge for a specific area:

- `references/architecture.md` -- Cross-cloud architecture: instance types, storage, networking, HA, auto-scaling concepts. Read for comparison and design questions.
- `references/aws-ec2-cli.md` -- Complete AWS CLI reference: instance lifecycle, AMIs, EBS, networking, SSM, monitoring. Read for AWS-specific operations.
- `references/azure-vm-cli.md` -- Complete Azure CLI reference: az vm create/list/start/stop, disks, networking, monitoring, Run Command. Read for Azure-specific operations.
- `references/gce-cli.md` -- Complete gcloud CLI reference: instances create/list/start/stop, disks, networking, SSH/IAP, monitoring. Read for GCP-specific operations.
- `references/cross-platform.md` -- Operation-to-CLI mapping table across all three clouds. Read for quick cross-platform command lookups.