I have followed a tutorial how to create "typical" aws configuration see the picture.

At the picture NAT instance is actually NAT Gateway.

My question is, how can and where to add ELB and autoscaling group to this configuration? What to do with EIP, how it should I do with it since I would add ELB? If I add ELB do I still need EIP? Very confused about what is going on here...

Also, I am aware that I need Bastion instance in order to access to these instances, but to be honest don't know where to add it without violating security of security groups?

Please sorry if I am asking generic question, I am newbie with AWS and trying to learn/understand how and when to use these services.

Thanks :)


You should put the ELB in the public subnets, and the EC2 instances in the private Subnets. You do not need an EIP for that.

If you are not using any type of private connection to the VPC (i.e. DirectConnect or VPN) you probably need a Bastion host, which resides typically in the public subnets (and may habe an EIP attached).

To ensure security on your instances, allow access to the bastion host only from your public static IP, and SSH access to the EC2 instances in your Autoscaling group only from your bastion instance.

  • Thanks Glatki :) – svarog Mar 20 '19 at 11:40
  • can you please tell me what traffic should I enable in private subnet? I mean how will ELB communicate with instance in private subnet? Thanks – svarog Mar 21 '19 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.