# Connect to and manage your Lightsail instance
<a name="managing-your-instance-using-lightsail"></a>

This guide covers the following topics related to managing and connecting to your Amazon Lightsail instances:

**Topics**
+ [Start, stop, or reboot your Lightsail instance](lightsail-how-to-start-stop-or-restart-your-instance-virtual-private-server.md)
+ [Force stop stuck Lightsail instances](amazon-lightsail-force-stop-instance.md)
+ [Enable enhanced networking for Amazon EC2 instances](amazon-lightsail-updating-ec2-instances.md)
+ [Extend the file system of your Windows Server instance in Lightsail](extending-windows-server-storage-space-in-amazon-lightsail.md)
+ [Configure Linux/Unix instances with launch scripts in Lightsail](lightsail-how-to-configure-server-additional-data-shell-script.md)
+ [Configure Windows Lightsail instances with PowerShell and batch scripts](create-powershell-script-that-runs-when-you-create-windows-based-instance-in-lightsail.md)
+ [Secure Windows Server instances on Lightsail](best-practices-for-securing-windows-based-lightsail-instances.md)

# Start, stop, or reboot your Lightsail instance
<a name="lightsail-how-to-start-stop-or-restart-your-instance-virtual-private-server"></a>

When Amazon Lightsail creates your instance, your machine goes into a **Pending** state before it starts **Running**. After your instance is running, you can reboot it or stop and then start it. The cycle looks like this:

![\[Instance states\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-instance-state-cycle.png)


You can see the instance state when you manage your instance or view your instance on the home page.

**Important**  
The default public IPv4 address that is assigned to your instance when you create it will change when you stop and start your instance. You can optionally create and attach a static IPv4 address to your instance. The static IPv4 address replaces the default public IPv4 address of your instance, and it stays the same when you stop and start your instance. For more information, see [Create a static IP and attach it to an instance](lightsail-create-static-ip.md).

## Reboot your instance while it's running
<a name="lightsail-instance-restart"></a>
+ On the home page, choose the instance you want to reboot, or choose **Reboot** from the manage instance menu.  
![\[Reboot your instance from the manage instance menu\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-restart-instance-from-manage-instance-menu.png)

  If you're viewing your instance from the instance management page, choose **Reboot**, and then choose **Confirm** when prompted.
**Note**  
To **Reboot** your instance, it must be in a **Running** state.

## Stop a running instance
<a name="lightsail-instance-stop"></a>
+ On the home page, choose the instance you want to stop, or choose **Stop** from the manage instance menu.  
![\[Stop your instance from the manage instance menu\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-stop-instance-from-manage-instance-menu.png)

  If you're viewing your instance from the instance management page, choose **Stop**, and then choose **Confirm** when prompted.
**Note**  
To **Stop** your instance, it must be in a **Running** state.

## Start your instance after it's stopped
<a name="lightsail-instance-start"></a>
+ On the home page, choose the instance you want to start, or choose **Start** from the manage instance menu.  
![\[Start your instance from the manage instance menu\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-start-instance-from-manage-instance-menu.png)

  If you're viewing your instance from the instance management page, choose **Start**.
**Note**  
To **Start** your instance, it must be in a **Stopped** state.

# Force stop stuck Lightsail instances
<a name="amazon-lightsail-force-stop-instance"></a>

Rarely, an instance can get stuck in the `Stopping` state. If this happens, there might be an issue with the underlying hardware that hosts your Amazon Lightsail instance. In this guide, you’ll learn how to force stop an instance that's stuck in the `stopping` state. For more information about instance states, see [Start, Stop, or Restart your Lightsail instance](lightsail-how-to-start-stop-or-restart-your-instance-virtual-private-server.md). 

## How to force stop an instance
<a name="force-stop"></a>

You can use the Lightsail console to force stop your instance, but only while the instance is in the `stopping` state. Alternatively, you can use the AWS Command Line Interface (AWS CLI) to force stop an instance while the instance is in any state except `shutting-down` and `terminated`. A force stop can take a few minutes to complete. If the instance hasn’t stopped after 10 minutes, force stop it again.

When an instance is forced to stop, it doesn't have an opportunity to flush file system caches or file system metadata. After you force stop an instance, you should perform file system checks and repair procedures.

The following procedure explains the different ways that you can force stop a Lightsail instance.

**Force stop an instance in the Lightsail console**

1. Sign in to the [Lightsail console](https://lightsail.aws.amazon.com/).

1. Choose the **Instances** tab.

1. Locate the instance that's stuck in the `Stopping` state. Then, choose the actions menu icon (⋮) displayed next to the instance name.  
![\[Lightsail instance actions menu.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-force-stop-actions-menu.png)

1. Choose **Force stop** in the dropdown list that appears.  
![\[Lightsail instance actions menu force stop option.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-force-stop-choose-am-option.png)

   Alternatively, you can choose the instance name to access the instance management page. Then, choose the **Force stop** button.  
![\[Lightsail instance management page force stop button.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-force-stop-button-instance.png)

1. Review the considerations for this operation. To proceed, choose **Force stop**.  
![\[Lightsail instance management page force stop button.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-force-stop-considerations-modal.png)

**Force stop an instance with the AWS CLI**

1. Before you begin, you need to install the AWS CLI. To learn more, see [Installing the AWS Command Line Interface](http://docs.aws.amazon.com/cli/latest/userguide/installing.html). Be sure to [configure the AWS CLI](lightsail-how-to-set-up-and-configure-aws-cli.md) after you install it.

1. Use the [stop-instance](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lightsail/stop-instance.html) command and the `--force` parameter as follows:

   `aws lightsail stop-instance --instance-name Wordpress-1 --force`

# Enable enhanced networking for Amazon EC2 instances
<a name="amazon-lightsail-updating-ec2-instances"></a>

Some Lightsail instances are incompatible with the current generation EC2 instance types (T3, M5, C5, or R5) because they are not enabled for enhanced networking. If your source Lightsail instance is incompatible, you will need to choose a previous generation instance type (T2, M4, C4, or R4) when creating an EC2 instance from your exported snapshot. These instance type options are presented to you when creating an EC2 instance using the **Create an Amazon EC2 instance** page in the Lightsail console.

**Note**  
For more information about enhanced networking, see [Enhanced Networking on Linux](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking.html) or [Enhanced Networking on Windows](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/enhanced-networking.html) in the Amazon EC2 documentation.

To use the latest generation EC2 instance types when the source Lightsail instance is incompatible, you need to create the new EC2 instance using a previous generation instance type (T2, M4, C4, or R4), update the networking driver on your instance, and then upgrade the instance to the desired current generation instance type.

## Prerequisites
<a name="updating-ec2-instances-prerequisites"></a>

You must create an Amazon EC2 instance from an exported Lightsail snapshot. If your Lightsail instance is incompatible, you’ll choose a previous generation instance type (T2, M4, C4, or R4) when creating the Amazon EC2 instance. To learn more, see [Creating Amazon EC2 instances from exported snapshots in Lightsail](amazon-lightsail-creating-ec2-instances-from-exported-snapshots.md).

After your new EC2 instance is up and running, continue to the [Enable Enhanced Networking with the Elastic Network Adapter](#enabling-enhanced-networking-with-elastic-network-adapter) section of this guide to learn how to enable enhanced networking.

## Enable Enhanced Networking with the Elastic Network Adapter
<a name="enabling-enhanced-networking-with-elastic-network-adapter"></a>

After your new instance is up and running, see one of the following guides in the Amazon EC2 documentation to enable enhanced networking with the Elastic Network Adapter (ENA):
+ [Enabling Enhanced Networking with the ENA on Linux Instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking-ena.html)
+ [Enabling Enhanced Networking with the ENA on Windows Instances](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/enhanced-networking-ena.html)

## Upgrade your instance type
<a name="upgrade-your-instance-type"></a>

After you have enabled enhanced networking, you can upgrade the instance type by following the instructions in one of the following guides:
+ For Windows Server instances — [Migrating to Latest Generation Instance Types](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/migrating-latest-types.html)
+ For Linux or Unix instances — [Changing the Instance Type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html)

# Extend the file system of your Windows Server instance in Lightsail
<a name="extending-windows-server-storage-space-in-amazon-lightsail"></a>

After you use a snapshot to create a new Windows Server instance with a larger plan, you may see that the available storage space is lower than that specified by the plan. This is typically because the additional storage space provided by the larger plan has not been allocated; therefore, it’s not being used by the active volume. The steps in this topic show you how to extend the file system of your Windows Server instance to use the maximum storage space available.

**Note**  
This scenario happens only when you create a Windows Server instance using a snapshot that was created before running the System Preparation (Sysprep) utility. For more information, see [Create a snapshot of your Windows Server instance](prepare-windows-based-instance-and-create-snapshot.md).

**To extend the file system for a Windows Server instance**

1. Sign in to the [Lightsail console](https://lightsail.aws.amazon.com/).

1. On the Lightsail home page, choose the RDP client icon for the instance you want to connect to.  
![\[Open the browser-based RDP client with quick connect.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/connect-to-windows-instance-using-rdp-connection-shortcut.png)

   The browser-based RDP client window opens, as shown in the following example:  
![\[Browser-based RDP client in Lightsail.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-web-based-rdp-client.png)

1. On the taskbar, choose the Windows icon, then choose one of the following options:

   1. On Windows Server 2022, Windows Server 2019 and Windows Server 2016 instances, choose **Start**, then choose **Windows Administrative Tools**.

1. Choose **Computer Management**.

1. In the left pane of the Computer Management console, choose **Disk Management**.

1. On the **Actions** menu, choose **Rescan Disks**.

   You may see unallocated space associated with a disk. Extend the active volume on the disk to use the unallocated space.  
![\[Unallocated disk space in Windows Disk Management\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-windows-unallocated-space.png)

1. Right-click the active volume on the same disk as the unallocated space, then choose **Extend Volume**.  
![\[Extend volume in Windows Disk Management\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-windows-extend-volume.png)

1. When the Extend Volume wizard opens, choose **Next**.

1. In the **Select the amount of space in MB** field, enter the number of megabytes by which to extend the volume. Normally, you set this to the maximum unallocated space. The value you enter is the amount of space that you are adding, not the final size of the volume.  
![\[Select unallocated space in the Windows Extend Volume wizard\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-windows-select-unallocated-space.png)

1. Complete the Extend Volume wizard.

   The active volume is extended to use the unallocated space that you specified. The following example shows all of the unallocated space chosen.  
![\[Allocated disk space in Windows Disk Management\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-windows-allocated-space.png)

# Configure Linux/Unix instances with launch scripts in Lightsail
<a name="lightsail-how-to-configure-server-additional-data-shell-script"></a>

When you create a Linux or Unix-based instance, you can add a launch script to add or update software, or configure your instance in some other way. To configure a Windows-based instance with additional data, see [Configure your new Lightsail instance using Windows PowerShell](create-powershell-script-that-runs-when-you-create-windows-based-instance-in-lightsail.md).

**Note**  
Depending on the machine image you choose, the command to get software on your instance varies. Amazon Linux uses `yum`, while Debian and Ubuntu both use `apt-get`. WordPress and other application images use `apt-get` because they run Debian as their operating system. FreeBSD and openSUSE require additional user configuration to use custom tools such as `freebsd-update` or `zypper` (openSUSE).

## Example: Configure an Ubuntu server to install Node.js
<a name="example-configure-ubuntu-using-apt-get-install-node-js"></a>

The following example updates the package list and then installs Node.js through the `apt-get` command.

1. On the **Create an instance** page, choose **Ubuntu** on the **OS Only** tab.

1. Scroll down and choose **Add launch script**.

1. Type the following:

   ```
   # update package list
   apt-get update -y
   # install some of my favorite tools
   apt-get install nodejs -y
   ```
**Note**  
Commands you send to configure your server are run as root, so you don't need to include `sudo` before your commands.

1. Choose **Create instance**.

## Example: Configure a WordPress server to download and install a plugin
<a name="example-configure-wordpress-install-plugins"></a>

The following example updates the package list, and then downloads and installs the [BuddyPress plugin](https://wordpress.org/plugins/buddypress/) for WordPress.

1. On the **Create an instance** page, choose **WordPress**.

1. Choose **Add launch script**.

1. Type the following:

   ```
   # update package list
   apt-get update
   # download wordpress plugin
   wget "https://downloads.wordpress.org/plugin/buddypress.14.0.0.zip"
   apt-get install unzip
   # unzip into wordpress plugin directory
   unzip buddypress.14.0.0.zip -d /bitnami/wordpress/wp-content/plugins
   ```

1. Choose **Create instance**.

# Configure Windows Lightsail instances with PowerShell and batch scripts
<a name="create-powershell-script-that-runs-when-you-create-windows-based-instance-in-lightsail"></a>

When you create a Windows-based instance, you can configure it using a Windows PowerShell script or any other batch script. This is a one-time script that runs right after your instance launches. This topic shows the syntax of the scripts and provides an example to get you started. We also show you how to test your script to see if it ran successfully.

## Create an instance that launches and runs a PowerShell script
<a name="windows-powershell-create-instance"></a>

The following procedure installs a tool called *chocolatey* on a new instance, right after the instance launches.

1. In the left navigation pane, choose **Create instance**.

1. Choose the AWS Region and Availability Zone where you want to create your instance.

1. Under **Select a platform**, choose **Microsoft Windows**.

1. Choose **OS Only**, and then choose **Windows Server 2022**, **Windows Server 2019**, **Windows Server 2016**.

1. Choose **Add launch script**.

1. Type the following:

   ```
   <powershell>
   iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
   </powershell>
   ```
**Note**  
You must always wrap your PowerShell scripts in `<powershell></powershell>` tags. You can enter non-PowerShell commands or batch scripts using `<script></script>` tags or without any tags at all.

1. Enter a name for your instance.

   Resource names:
   + Must be unique within each AWS Region in your Lightsail account.
   + Must contain 2 to 255 characters.
   + Must start and end with an alphanumeric character or number.
   + Can include alphanumeric characters, numbers, periods, dashes, and underscores.

1. (Optional) Choose **Add new tag** to add a tag to your instance. Repeat this step as needed to add additional tags. For more information on tag usage, see [Tags](amazon-lightsail-tags.md).

   1. For **Key**, enter a tag key.  
![\[A tag with only the tag key specified in the Lightsail create instance workflow.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-instance-key-name-only-tags.png)

   1. (Optional) For **Value**, enter a tag value.  
![\[A tag with the tag key and tag value specified in the Lightsail create instance workflow.\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/amazon-lightsail-instance-key-name-and-value-tags.png)

1. Choose **Create instance**.

## Verify that your script ran successfully
<a name="windows-powershell-verify-script-ran-successfully"></a>

You can log in to your instance to verify that the script ran successfully. It can take up to 15 minutes for a Windows-based instance to be ready to accept RDP connections. Once it's ready, log in using the browser-based RDP client or configure your own RDP client. For more information, see [Connect to your Windows-based instance](connect-to-your-windows-based-instance-using-amazon-lightsail.md).

1. Once you can connect to your Lightsail instance, open a command prompt (or open Windows Explorer).

1. Change to the `Log` directory by typing the following:

   ```
   cd C:\ProgramData\Amazon\EC2-Windows\Launch\Log
   ```

1. Open `UserdataExecution.log` in a text editor, or type the following: `type UserdataExecution.log`.

   You should see the following in your log file.

   ```
   2017/10/11 20:32:12Z: <powershell> tag was provided.. running powershell content
   2017/10/11 20:32:13Z: Message: The output from user scripts: iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
   
   2017/10/11 20:32:13Z: Userdata execution done
   ```

# Secure Windows Server instances on Lightsail
<a name="best-practices-for-securing-windows-based-lightsail-instances"></a>

In this article, we provide tips and tricks to help you avoid security risks when using your Lightsail instance running Windows Server.

## About Lightsail passwords
<a name="best-practices-windows-security-about-passwords"></a>

When you create a Windows Server-based instance, Lightsail randomly generates a long password that is hard to guess. You use this password uniquely with your new instance. You can use the default password to connect quickly to your instance using remote desktop (RDP). You are always logged in as the **Administrator** on your Lightsail instance.

## Manage your password
<a name="best-practices-windows-security-password-management"></a>

You can change the password on your Windows Server-based instance. This might be useful if you want to use a remote desktop client to access your Lightsail instance. Lightsail never stores a password you generate.

**Note**  
You can use either the Lightsail-generated password or your own custom password with the browser-based RDP client in Lightsail. If you use a custom password, you will be prompted for your password every time you log in. It's easier to use the Lightsail-generated default password with the browser-based RDP client if you want quick access to your instance. 

Use the Windows Server password manager to change your password securely. Press `Ctrl` \$1 `Alt` \$1 `Del`, and then choose **Change a password**. Be sure to keep a record of your password, because Lightsail doesn't store your password. If you need to retrieve your password, see the following: [Change the Administrator password for a Windows-based instance](use-non-default-key-with-windows-based-instance-in-lightsail.md).

If you change your password from the unique, default password, be sure to use a strong password. You should avoid passwords that are based on names or dictionary words, or repeating sequences of characters.

## Security patching
<a name="best-practices-windows-security-security-patching"></a>

We recommend keeping your Windows Server-based Lightsail instances updated with the latest security patches. Be sure your server is configured to download and install updates. The following procedure tells you how to do this directly on your Lightsail instance running Windows Server.

1. On your Windows Server-based instance, open a command prompt.

1. Type `sconfig`, and then press `Enter`.

   Windows Update Settings (number 5) are at `Automatic` by default.  
![\[Server configuration in Windows Server 2016\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/configure-server-windows-based-lightsail.png)

1. To download and install new updates, type `6`, and then press `Enter`.

1. Type `A` to search for **(A)ll updates** in the new command window, and then press `Enter`.

1. Type `A` again to install **(A)ll updates**, and then press `Enter`.

   When finished, you see a message with the installation results and more instructions (if those apply).  
![\[Successfully downloaded and updated Windows Server 2016 security patch\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/download-install-updates-configure-server-windows-based-lightsail.png)

## Enable the Account Lockout Policy in Windows Server
<a name="best-practices-windows-security-enable-lockout"></a>

You can configure Windows Server to temporarily or indefinitely disable accounts when a certain number of unsuccessful login attempts has been reached. For example, you can lock out someone who attempts to log in to your instance using three unsuccessful passwords.

For more information, see [Account Lockout Policy](https://technet.microsoft.com/en-us/library/hh994563(v=ws.11).aspx) in the *Windows Server documentation*.

## Ports and firewall settings
<a name="best-practices-windows-security-ports-firewall"></a>

By default, we open the following ports on your Windows Server-based instances.

![\[Firewall settings\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/windows-ports-firewall-open-by-default.png)


The ports you enable are exposed to the world and can't be restricted by source IP. To restrict access to your instance, you can turn off these ports and only enable them when you need to access your instance. Here's how:

1. Find the instance you want to manage in Lightsail, and then choose **Manage**.

1. Choose **Networking**.

1. On the **Networking** page for your instance, choose **Edit rules**.

1. Delete the RDP/TCP/3389 rule by choosing the orange "x" next to the rule.  
![\[Close your RDP port by deleting this rule\]](http://docs.aws.amazon.com/lightsail/latest/userguide/images/windows-ports-firewall-delete-rdp-port.png)

1. Choose **Save**.

Follow the step-by-step instructions to learn how to control the state of your instances, force stop instances that are stuck, update instances for enhanced networking, extend the file system of Windows Server instances, configure instances at launch using scripts, and secure your Windows Server instances.

The guide covers both Linux or Unix and Windows Server instances, providing tips and best practices for tasks such as installing software, updating configurations, managing passwords, enabling security patches, and configuring firewall settings. By following this guide, you can effectively manage and secure your Lightsail instances, ensuring optimal performance, security, and customization for your specific use case.