EC2 Instance Tagging

Mr. Raph

3 min read

·

Oct 22, 2026

--

Listen

Share

This exercise was a demonstration in starting and stopping EC2(Elastic Cloud Compute) instances utilizing scripts. When instances are tagged, it makes finding and grouping them easier.

The provided IP did not allow connection to the CLI via SSH. I went into the AWS Console, noted the public IP of the instance named “Command Host”

This command noted every instance involved with ERPSystem:
aws ec2 describe-instances — filter “Name=tag:Project,Values=ERPSystem”

ERPSystem is Enterprise Resource Planning System.

I then narrowed down the overwhelming output with:
aws ec2 describe-instances — filter “Name=tag:Project,Values=ERPSystem” — query ‘Reservations[*].Instances[*].InstanceId’

The query option narrowed it down to simply InstanceID which was significantly more manageable.

I then ran this command to return back Availability Zone(areas within AWS Regions that support remote cloud infrastructure)
aws ec2 describe-instances — filter “Name=tag:Project,Values=ERPSystem” — query ‘Reservations[*].Instances[*].{ID:InstanceId,AZ:Placement.AvailabilityZone}’

The next command returned tag giving the information I was seeking. What instances do I have and how are they tagged?

aws ec2 describe-instances --filter "Name=tag:Project,Values=ERPSystem" --query 'Reservations[*].Instances[*].{ID:InstanceId,AZ:Placement.AvailabilityZone,Project:Tags[?Key==`Project`] | [0].Value}'

This command expanded the information returned with Environment, Production and which version of the instance was running. Versioning allows identification of changes and the ability to rollback in the instance of errors or corruption:
aws ec2 describe-instances — filter “Name=tag:Project,Values=ERPSystem” — query ‘Reservations[*].Instances[*].{ID:InstanceId,AZ:Placement.AvailabilityZone,Project:Tags[?Key==`Project`] | [0].Value,Environment:Tags[?Key==`Environment`] | [0].Value,Version:Tags[?Key==`Version`] | [0].Value}’

Properly tagging instances I was able to use the next command to find instances in the Development stage:
aws ec2 describe-instances — filter “Name=tag:Project,Values=ERPSystem” “Name=tag:Environment,Values=development” — query ‘Reservations[*].Instances[*].{ID:InstanceId,AZ:Placement.AvailabilityZone,Project:Tags[?Key==`Project`] | [0].Value,Environment:Tags[?Key==`Environment`] | [0].Value,Version:Tags[?Key==`Version`] | [0].Value}’

I used this command to create a new tag grouping instances that were part of ERPSystem, but also in development:

#!/bin/bash

ids=$(aws ec2 describe-instances --filter "Name=tag:Project,Values=ERPSystem" "Name=tag:Environment,Values=development" --query 'Reservations[*].Instances[*].InstanceId' --output text)

aws ec2 create-tags --resources $ids --tags 'Key=Version,Value=1.1'

I then used a Stopinator script to start and restart the instances under the Development tag:

require ‘vendor/autoload.php’;
use Aws\Ec2\Ec2Client;

date_default_timezone_set(‘UTC’);

# Obtain the profile name.
$profile = “default”;
$opts = getopt(‘p::t::e::s::’);
if (array_key_exists(‘p’, $opts)) { $profile = $opts[‘p’]; }

$excludeID = “”;
if (array_key_exists(‘e’, $opts)) {
$excludeID = $opts[‘e’];
}

$start = false;
if (array_key_exists(‘s’, $opts)) {
$start = true;
}

$ec2DescribeArgs = array();
if (array_key_exists(‘t’, $opts))
{
$tagArray = array();
foreach (explode(“;”, $opts[‘t’]) as $pair) {
$nameVal = explode(“=”, $pair);
array_push($tagArray, array(
‘Name’ => “tag:” . $nameVal[0],

./stopinator.php -t"Project=ERPSystem;Environment=development"

By adding -t to the stopinator, I was able to specify instances tagged with ERPystem in the Development environment stage.

I was unable to run the stopinator due to IAM policies on the lab environment. This illustrates best practices to not allow the stopping of instances by unauthorized users:

AWS Error Message: You are not authorized to perform this operation. Role: `arn:aws:sts::111111111111:assumed-role/aaaaaabbbbbbccccccddddddeeeeeeee-RootRole-XXXXXXXXXXXX/i-0aaabbbcccdddeeee`

Not authorized to perform: ec2:DescribeInstances

Reason: Explicit deny in Service Control Policy

SCP ARN: arn:aws:organizations::111111111111:policy/o-aaaaaaaaaa/service_control_policy/p-aaaaaaaaaa

Interestingly enough, I was able to run a terminate-instances.php which gave the following:
./terminate-instances.php -<region> -subnetid <privatesubnetid>

Checking i-0aaaabbbbccccdddd
Checking i-0eeeeffffgggghhh
Checking i-0iiiijjjjkkkkllll
Checking i-0mmmmnnnnoooopp
Checking i-0qqqqrrrrssssttt
Checking i-0uuuuvvvvwwwwxxxx
Checking i-0yyyyzzzzaaaabbbb
Terminating instances…
Instances terminated.

As they use different APIs, despite insufficient lab permissions I was able to terminate instances matching the region and private subnet.