AWS Lightsail Reference

What Lightsail actually gives you

A Lightsail instance is a small VPS with a fixed monthly price that bundles in the things you'd otherwise configure separately on raw EC2: a static IP, a fixed amount of data transfer, an SSD volume, and simple point-and-click firewall rules. Pricing tiers are based on RAM/vCPU/storage, not the finer-grained EC2 instance catalogue, which is the trade-off for the simpler dashboard — fewer decisions, less flexibility.

Creating an instance

From the Lightsail console: Create instance → pick a region → pick a blueprint (an OS image, or an "app + OS" blueprint like WordPress or LAMP if you want the stack pre-installed) → pick a plan (RAM/storage tier) → name it → create. A key pair is generated (or reused) automatically and is required to SSH in later.

Static IP

A new instance gets a public IP that changes if the instance is stopped and started. Attaching a static IP (Lightsail → Networking → Create static IP) fixes that — free while attached to a running instance, billed only if left unattached. Point DNS at the static IP, not the instance's default public IP, or a stop/start cycle will silently break the domain.

Firewall (networking tab)

Rule	When you need it
SSH (22)	Open by default. Restrict to your own IP where possible instead of leaving it open to 0.0.0.0/0.
HTTP (80)	Serving a website over plain HTTP, or for the ACME HTTP-01 challenge when issuing a Let's Encrypt certificate.
HTTPS (443)	Serving over TLS — almost always needed alongside 80.
Custom TCP/UDP	Anything else the app listens on directly (a queue dashboard, a websocket port not proxied through 80/443, etc.).

These rules apply to the whole instance, similar to an EC2 security group but scoped to one instance rather than reusable across several.

Connecting

The console has a browser-based SSH terminal (Lightsail → instance → Connect) which needs nothing installed locally — useful for a quick check or when the local SSH key isn't handy. For a real terminal session, download the default key pair (or use your own uploaded key) and connect normally:

chmod 400 LightsailDefaultKey-region.pem
ssh -i LightsailDefaultKey-region.pem ubuntu@STATIC_IP

The default username depends on the blueprint — ubuntu for Ubuntu images, bitnami for Bitnami app stacks, ec2-user for Amazon Linux.

Snapshots

A snapshot is a point-in-time image of the instance's disk, taken manually or on an automatic daily schedule (Lightsail → instance → Snapshots). It's the basis for two separate things: restoring the instance to an earlier state, and creating a brand new instance from that exact state — the standard way to "resize" an instance to a bigger plan, since you can't resize in place.

# Typical resize flow:
# 1. Take a manual snapshot of the running instance
# 2. Create a new instance "from a snapshot" on a larger plan
# 3. Re-attach the static IP to the new instance
# 4. Delete the old instance once the new one is verified

Load balancers and attaching a domain

Lightsail's own load balancer can front a single instance (or several) and handles free-managed TLS certificates without touching certbot directly — the simplest path to HTTPS for a single Lightsail app. For DNS, either use Lightsail's own DNS zone feature or point records at the static IP from an external registrar/DNS provider; see the DNS reference for record types and propagation.