Virtual Machines — EC2 vs Compute Engine vs Azure VMs

Virtual machines are the original cloud primitive — the thing that made "renting someone else's computers" practical. A hypervisor (software like Xen, KVM, or Nitro) sits on a physical server and carves it into isolated virtual machines, each with its own OS, CPU allocation, memory, and network interface. You get root access to what feels like a dedicated server, but you're sharing physical hardware with other tenants. This is the foundation of IaaS.

Instance Families and Sizing

Providers organize VMs into instance families optimized for different workloads. General-purpose instances (AWS m6i, GCP e2, Azure D-series) balance CPU, memory, and networking. Compute-optimized instances (c6i, c2, F-series) have high CPU-to-memory ratios for batch processing or gaming servers. Memory-optimized (r6i, n2-highmem, E-series) give you lots of RAM for databases and caches. There are also storage-optimized, GPU, and accelerator families.

A critical detail: vCPU does not equal a physical core. A vCPU is typically a hyper-thread — half a physical core. Two vCPUs usually means one physical core. This matters when benchmarking or sizing workloads with expectations from bare metal.

Burstable instances (AWS t3, GCP e2-micro, Azure B-series) are cheaper because they give you a baseline CPU allocation and accumulate CPU credits when idle. You can burst above baseline using those credits. Great for dev environments and low-traffic workloads. Terrible for sustained high-CPU workloads — you'll burn through credits and get throttled.

Images and Boot

You launch a VM from an image: AMI (Amazon Machine Image), Machine Image (GCP), or VM Image (Azure). This is a snapshot of a disk containing the OS, pre-installed software, and configuration. Providers offer stock images (Ubuntu, Amazon Linux, Windows Server), and you can create custom images with your application baked in for faster boot times.

Storage

VMs get block storage attached as virtual disks. EBS (AWS), Persistent Disk (GCP), and Managed Disks (Azure) are network-attached storage that persists independently of the VM — you can stop the VM and the data stays. You choose volume types based on IOPS and throughput needs: SSD-backed for databases, HDD-backed for sequential workloads.

Some instance types also offer instance store (also called local SSD or ephemeral disk) — physically attached NVMe drives with extremely high IOPS. The catch: when the VM stops, that data is gone. Use it for caches, temp files, and scratch space. Never for anything you can't afford to lose.

Networking and Security

Each VM gets a private IP within your VPC. You can optionally assign a public IP for internet access. Security groups (AWS, Azure NSGs) or firewall rules (GCP) act as virtual firewalls controlling inbound and outbound traffic. Default-deny inbound is the right starting posture.

The metadata service is an HTTP endpoint (typically 169.254.169.254) accessible from within the VM that provides instance details and, critically, temporary credentials. This is a significant SSRF risk: if an attacker can make your application issue HTTP requests, they can hit the metadata service and steal credentials. AWS addressed this with IMDSv2, which requires a PUT request to get a session token first — always enforce IMDSv2 and disable v1.

AWS Implementation

EC2 is the most mature VM service. Key features: placement groups for low-latency clustering, Nitro-based instances with hardware-level isolation, and Elastic Network Interfaces for multi-homed networking. Launch templates define your instance configuration as code. User data scripts run at boot for initial setup.

# Launch an EC2 instance
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.medium \
  --key-name my-key \
  --security-group-ids sg-12345 \
  --metadata-options HttpTokens=required  # Enforce IMDSv2

GCP Implementation

Compute Engine offers custom machine types — you can specify exact vCPU and memory combinations rather than picking from a fixed menu. This avoids overpaying for a shape that doesn't match your workload. GCP also supports live migration: your VM moves to different physical hardware during maintenance events without downtime (enabled by default).

# Launch a Compute Engine instance
gcloud compute instances create my-vm \
  --machine-type=e2-medium \
  --image-family=ubuntu-2204-lts \
  --image-project=ubuntu-os-cloud \
  --metadata=enable-oslogin=TRUE

Azure Implementation

Azure VMs integrate deeply with Active Directory and support hybrid licensing — if you already own Windows Server or SQL Server licenses, you can bring them to Azure at reduced cost (Azure Hybrid Benefit). Azure also offers Dedicated Hosts for compliance scenarios requiring physical isolation.

# Launch an Azure VM
az vm create \
  --resource-group myRG \
  --name myVM \
  --image Ubuntu2204 \
  --size Standard_D2s_v5 \
  --admin-username azureuser \
  --generate-ssh-keys

Side-by-Side Comparison

Aspect	AWS (EC2)	GCP (Compute Engine)	Azure (VMs)
Custom sizing	Fixed instance types	Custom machine types	Fixed VM sizes
Burstable	t3, t4g	e2 (shared-core)	B-series
Local SSD	Instance store (select types)	Local SSD (attachable)	Temp disk (most sizes)
Live migration	Not by default	Default on	Supported
Metadata security	IMDSv2 (session token)	Requires headers	IMDS with headers
Spot name	Spot Instances	Preemptible / Spot VMs	Spot VMs
Max spot discount	Up to 90%	Up to 91%	Up to 90%

Pricing Models

On-demand: pay by the second (or hour), no commitment. The default but most expensive option.

Reserved Instances / Committed Use: commit to 1-3 years of a specific instance type or spend level for 30-60% off. AWS has Reserved Instances and Savings Plans; GCP has Committed Use Discounts (plus automatic Sustained Use Discounts); Azure has Reservations.

Spot / Preemptible: use the provider's spare capacity at 60-90% off. The provider can reclaim the instance with short notice (2 minutes on AWS, 30 seconds on GCP). Perfect for batch processing, CI/CD, and stateless workers. Terrible for databases.

Autoscaling groups let you automatically add and remove VMs based on metrics (CPU, request count, custom metrics). This is how you match capacity to demand and avoid paying for idle resources. All three providers offer this: AWS Auto Scaling Groups, GCP Managed Instance Groups, Azure VM Scale Sets.

When VMs Still Win

Containers and serverless get the hype, but VMs are still the right choice when you need full OS control, run legacy software that can't be containerized, need GPU access, require specific kernel modules, or have workloads with predictable steady-state resource needs where the overhead of container orchestration adds no value.

Key Takeaways

• VMs are the foundational IaaS primitive — a hypervisor slices physical hardware into isolated virtual machines you control from the OS up
• vCPU is a hyper-thread, not a core — size accordingly and don't trust benchmarks that assume otherwise
• Instance store is ephemeral; if you stop the VM, that data is gone forever
• Always enforce IMDSv2 (or equivalent) to close the metadata service SSRF vector
• Spot/preemptible instances save 60-90% but can be reclaimed — use them for stateless, fault-tolerant workloads only
• GCP's custom machine types and live migration are genuine differentiators; Azure's hybrid licensing advantage matters if you're in the Microsoft ecosystem

Next, we'll look at storing files in the cloud with object storage — the infinitely scalable alternative to file systems.