Terminate is final, and an id typed into the wrong window is all it takes. Machines that matter carry a lock.
Termination protection
sh
aws ec2 modify-instance-attribute --instance-id $ID --disable-api-terminationWith the attribute on, a terminate fails:
sh
aws ec2 terminate-instances --instance-ids $IDtext
An error occurred (OperationNotPermitted) when calling the TerminateInstances operation: The instance 'i-0a1b2c3d4e5f67890' may not be terminated. Modify its 'disableApiTermination' instance attribute and try again.terminate-instancesthe wrong id, by mistake
refused
protectiondisableApiTermination is on
untouched
instancestill running
Turning it off is a deliberate step (--no-disable-api-termination) before a deliberate terminate. Stop still works: protection guards only against deletion, and a stopped instance keeps its disk.
Health, in short
EC2 also runs two status checks on every running instance:
sh
aws ec2 describe-instance-status --instance-ids $ID --query "InstanceStatuses[0].[SystemStatus.Status,InstanceStatus.Status]" --output textok ok means the machine is up. The system check is AWS's side, the hardware under the machine; if it fails, a stop and start moves the instance to a healthy host. The instance check is your side, the operating system; if it fails, look inside. Neither says your web server works: only a request to it can tell you that.