I have an instance that acts as both and SFTP server and a NFS shared drive to our internal network.
The instance has a public IP to receive data over SFTP. That data is saved to a volume that is shared inside my internal network.
I use a security group that allows white listed port 22 traffic, and white lists all ports to my internal network.
The data is sensitive, and since this instance has a Public IP, it's one security group slip up from being opened to everyone.
I would like to remove the public IP from the instance, but it requires SFTP access from the Internet.
The solution I came up with is to create a public load balancer that forwards traffic on port 22 to my instance, add the security group it and remove the public ip from my instance, therefore even if I screw up, the instance is not publicly reachable.
I know ELBs were not meant for this, but in theory it should work. Are there problems with this solution? Is there a better/more preferred way for implementing something like this?