Idempotent EC2 launcher by Name tag. Reuses an existing non-terminated instance when possible and otherwise creates a new one.
awslaunch.py <name> [instance_type] [--ami AMI_ID] [--region REGION] [--profile PROFILE] [--spot]
Ensures a per-host keypair exists in AWS and under ~/.ssh/<name>.pem.
Looks up an existing instance by Name tag in pending, running, stopping, or stopped state. If found, it starts the instance when needed and waits for a public IP.
If no instance exists, it launches a new one with the configured AMI, instance type, root volume settings, and optional one-time spot market options.
Prints a Hosts: line containing IP, host names, and instance id. Other tooling and playbooks parse that line to update inventory and hosts state.
• Security-group ingress only touched at launch, not on reuse. The awslaunch-ssh security group's tcp/22 allowlist is only updated by ensure_security_group on the fresh-launch path; reusing an existing instance skips it. The calling host's public egress IP also changes between sessions (kelp is ephemeral), so stale /32s accumulate and the live IP can go missing — a provisioning run then times out at 'Wait for SSH' against a perfectly healthy instance. Diagnose by comparing curl -s https://checkip.amazonaws.com against the SG's port-22 CIDRs. As of 2026-09-09 ensure_security_group runs on the reuse path too and prunes stale /32s — verify this is still true before assuming it. Port 15901 (delayrepay's stunnel) is intentionally left world-open, since mTLS protects it.
• IAM profile matters. See aws/workspace — the provision profile (user computer) can launch; computer2 can only describe.