# Build AWS EC2 Instance

## Before we begin

Please make sure you created your SSH key pairs prior to starting these steps.

{% content-ref url="/pages/SZ8YBbmpjJILqGWxrmx5" %}
[SSH Remote Access](/run-a-node/references/ssh-remote-access.md)
{% endcontent-ref %}

## VPS Build Procedure

Creating your account on AWS is a simple process similar to all other SaaS model services. At the current time, we will leave this process up to you.

{% stepper %}
{% step %}

### Sign Up for an AWS account

[AWS Sign Up Page](https://aws.amazon.com/)

<div align="left"><figure><img src="/files/eck4Fy1BeV8CqSxyYXyl" alt="" width="312"><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/IQ8HVSQV1WEjSimIfTtV" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

## Create SSH Keys

If you have not yet created your SSH keys, please follow the instructions at the link below to generate your public and private key pair:

### [SSH Remote Access](/run-a-node/references/ssh-remote-access.md)

Once you have successfully generated your SSH keys, return here and continue to the next step.
{% endstep %}

{% step %}

### Navigate to EC2 Console

* Enter in `ec2` in the search bar at the top left
* Rest your mouse over `EC2 Virtual Services in the Cloud`&#x20;
* Click on `Dashboard` in the top features section.

<figure><img src="/files/iF3gX7qbYNaI4eC8AQqA" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Access Key Pair Console

Choose `Key Pairs` from the `Network & Security` section

<div align="left"><figure><img src="/files/i9vOYCAKZlbSUfW0VV5u" alt=""><figcaption></figcaption></figure></div>

Choose `Actions` and `Import key pair`

<div align="left"><figure><img src="/files/BCFUkbCADFlkVZmtFFtj" alt=""><figcaption></figcaption></figure></div>

* Decide on a key pair name that you will use to identify your key pair later.
* You should have already created your [SSH KEYS](/run-a-node/references/ssh-remote-access/create-ssh-keys.md), if not, please do so and return to this step.
* Click the `Browse` to navigate to your public key on your local system, select that key and choose `Open`&#x20;

<figure><img src="/files/GJNge0HKqBQ9NknPIUAl" alt=""><figcaption></figcaption></figure>

* Import key pair&#x20;

<div align="left"><figure><img src="/files/IGxOn5K65zTujYkLQEkU" alt=""><figcaption></figcaption></figure></div>

You will be returned to the `Key pairs` console and should see your key pair in the list (table) of the console with details about the key.
{% endstep %}

{% step %}

### Access Security Groups Console

From the same `Network & Security` section choose `Security Groups` .

<div align="left"><figure><img src="/files/RcoW0o6SZVLF0KoqoSqk" alt=""><figcaption></figcaption></figure></div>

* Create a new security group.

<div align="left"><figure><img src="/files/eMyZs1jo0gfZoT0dAMwS" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/G5ZwCyV36BUJn7X9zm6v" alt=""><figcaption><p>Give your security group a name and description</p></figcaption></figure></div>

Leave the `VPC` at the default.
{% endstep %}

{% step %}

### Create your rules

From the `Inbound rules` select `Add rule`&#x20;

<div align="left"><figure><img src="/files/UiiXYBtj4hzG8KIsvsAi" alt=""><figcaption></figcaption></figure></div>

* Select *Type* `SSH`&#x20;

  * **Please refer to** [**Wide Open SSH Access**](/run-a-node/references/ssh-remote-access/securing-ssh-access.md) **document for details on the security implications of allowing any system that is connected to the internet to have access to your `SSH` port.  This document contains instructions on how to determine your local IP address for entry in this section.**
  * Destination choose `Custom`
  * We will assume you decided to use a static IP address, in this example our static IP address i**s 13.13.13.13/32  (** <mark style="color:red;">Do NOT use this address, it is an example only.</mark> **)** Type in `13.13.13.13/32` into the box and the <mark style="color:blue;">blue</mark> CIDR block item will auto-populate, select it.

  <figure><img src="/files/kobcJoYBIhvz79GzXSAL" alt=""><figcaption></figcaption></figure>

* Choose the `Add rule` again.&#x20;

This rule is designed for both a Hypergraph hybrid layer validator DAG layer1 and a Dor data layer 1 nodes.

* Select *Type* `Custom TCP`&#x20;

  * Port Range `9010-9011`
  * Destination `Anywhere-IPv4`&#x20;

  <figure><img src="/files/ppeLq79kcaUFPuYu5eHL" alt=""><figcaption></figcaption></figure>
* <mark style="color:red;">**Hypergraph Hybrid Nodes ONLY**</mark>

This rule is designed for validator Hypergraph layer0 nodes.

* Choose the `Add rule` again
* Select Type `Custom TCP`
  * &#x20;Port Range `9000-9001`&#x20;
  * Destination `Anywhere-IPv4`&#x20;
* Click the `Create security group` button

<div align="left"><figure><img src="/files/TUnKVmdvJTYiAnKrEqyl" alt=""><figcaption></figcaption></figure></div>

You will be returned to the security group console and you should see your security group in the list table.
{% endstep %}

{% step %}

### Enter EC2 instances console

Click on the `Instances` from the `Instances` section on the left side panel.

<div align="left"><figure><img src="/files/ztrxEOUhDl0Wodx6PMKW" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Enter Launch Instances Wizard

Click on `Launch instances` on the top right of the screen.

<div align="left"><figure><img src="/files/KKTPFTRFE4nlcVfFftID" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Name your VPS

In the `Name and tags` section enter the name you would like to call your VPS.

<div align="left"><figure><img src="/files/h4r55VmBg00HTsp5ELXs" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Choose your Application and OS Image

Choose `Ubuntu`

The [`AMI`](#user-content-fn-1)[^1] will auto populate.

Ubuntu Server `24.04`&#x20;

Leave the default options

<figure><img src="/files/KtXAkeAUlHRMLym1y71h" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Choose your Instance Type

Click the drop down and type in the search:

**Hypergraph Validator**:   `m7i.2xlarge` or `t2.2xlarge`&#x20;

**Dor Data Layer 1 Validator**: `t2.medium`

<div align="left"><figure><img src="/files/E74hGnMuiLVuKHs6QUDf" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Choose your key pair (SSH)

Click on the drop down inside the `Key pair` section and choose the key pair you uploaded in <mark style="color:green;">step 4</mark>.

<div align="left"><figure><img src="/files/BviguthMTpDf2UJBSvRJ" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### From the Network Settings section

Select the `Select existing security gruop` and select your security group (firewall policy) from the list.

<div align="left"><figure><img src="/files/X10bPLufFCYzbPPkWJuu" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### From the Configure Storage section

Set the size to `320` GiB `gp3`&#x20;

<div align="left"><figure><img src="/files/YgsgaXgu0lZJbNiUjVc4" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Launch instance

Click Launch instance from the left side **Summary** section.

<div align="left"><figure><img src="/files/UykMz3hYKLNgOMC5eEbO" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Success Confirmation

Select the link to the instance ID from the green success box.

<div align="left"><figure><img src="/files/jOSoEnVcdfa1L7GsYYY1" alt=""><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Enter the details of your new VPS

Select the link to the instance ID from the list table

<figure><img src="/files/P6N9Rv2J6Mww4Hw2jSY7" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Record the IP address of your VPS

<div align="left"><figure><img src="/files/MqgK5QL9712jYzSRYzL5" alt=""><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}

## Complete

### You have successfully launched a VPS instance in AWS, Congratulations

You are now ready to continue to connect to your node for the first time, install nodectl and turn your EC2 instance (VPS) into a Constellation Network Validator Node!

[^1]: Amazon Machine Image


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.constellationnetwork.io/run-a-node/validator-node-guides/build-your-node/cloud-provider-specific/build-aws-ec2-instance.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.