Write the firewall rule yourself this time — port 80, open to the world, exactly what a public web server needs.
A running instance still needs one more thing before anyone can reach it over the web: permission. Every instance is protected by a security group — a virtual firewall — and by default a freshly created one allows nothing in.
SecurityGroup starts locked down — no inbound rules at all — until you call addIngressRule. Peer.anyIpv4() means "any IP address" (0.0.0.0/0); Port.tcp(80) means "TCP port 80," the HTTP port. Opening a security group this wide is a genuine tradeoff worth naming, not a mistake to avoid — a public web server is supposed to be reachable by anyone.
On the right, the starter creates a security group and wires it to the instance, but never opens it up. Call addIngressRule with Peer.anyIpv4() and Port.tcp(80) on webServerSg, then run the synthesizer. Peer and Port are new names the starter doesn't import yet —
add them to the existing multi-line import list from
aws-cdk-lib/aws-ec2, alongside SecurityGroup.
Locked
This exercise builds on Launching an EC2 instance — run synth & validate there until every assertion passes, then this code will unlock.
Go to Launching an EC2 instance