I received a amazon email saying that i have to terminate my instance because of attacks but worked really hard to install and setup everything on the instance. So how can i create another instance with the stuff that i installed on the current instance?


2 Answers 2


I guess the key word here is TERMINATE. You might be able to get away with stopping and starting your instance again immediately. If it's EBS backed it will be a new instance and will be EXACTLY the same, other than the external IP address. Note that in this case you need to STOP your instance, NOT terminate. Terminate deletes the EBS disk.

To be safe, or if you need to actually terminate, take a snapshot of your EBS volume so you can restore it if you mess things up. It's relatively easy to restore a snapshot to a new VM.

You possibly need to look at why you're being attacked and try to mitigate that before you make your instance available on the internet.

  • thank's worked. sorry but jesus how the hell can i mitigate that? @Tim could you please spare a hint?
    – dcalixto
    Feb 4, 2016 at 3:38
  • It depends what the problem is. Do you have any more details about what kind of attacks? If they're random then there's nothing much you can do, changing public IPs is probably about it. That could be done by changing your elastic IP, if you use one. You can run security scans against your website (Google "free website security scan") but that probably won't help.
    – Tim
    Feb 4, 2016 at 4:34
  • the email that i received is this: Dear Amazon EC2 Customer, We've received a report that your instance(s): Instance Id: i-xxxxxxxx IP Address: has been making Denial of Service attacks against remote hosts on the Internet; check the information provided below by the abuse reporter.
    – dcalixto
    Feb 4, 2016 at 4:40
  • Ah. Well it could be that your server has been hacked and someone is in control of it. I'd be doing as many virus and malware scans as I could, and watching CPU and network activity.
    – Tim
    Feb 4, 2016 at 5:34

If the EBS volume that backed the terminated instance is still around, you have a chance at restoring the data. Otherwise, all is lost.

This is reason number 2,274,738 to: 1) Never deploy things outside of your configuration management system and 2) Always have backups.

  • please could you say how?
    – dcalixto
    Feb 4, 2016 at 3:25
  • We're not here to teach you how to be a sysadmin. Crack open some books and study.
    – Magellan
    Feb 4, 2016 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .