Imagine you have some EC2 servers which are fronted by a load balancer (ELB).

Say they're in a public VPC - i.e. each EC2 instance has a public IP address and each instance is firewalled using Security Groups (SG) so only the ELB has direct access to the instances.

Assume the servers do require outgoing public internet access.

We're aware that the AWS recommended approach is to instead use a private VPC + NAT to improve security.

But, what is the practical benefit of doing this versus the above?

From my understanding, no-one can connect directly to the instances anyway in the above scenario because of the SG rules, and since this is handled in AWS's infrastructure, it's not like our servers can get flooded with connections - the packets won't ever reach us.

So what harm is there is having a public IP address if AWS firewalls you off anyway?

Am I missing some other benefit from a private VPC? Am I wrong in one of my above assertions?


It's really a matter of the "defense in depth" concept. With public addresses, you're relying solely on the security group configuration to protect your servers -- that you've done it right, that no one accidentally modifies it, etc.

You could turn the question around and ask yourself why you want public addresses when private ones will suffice?

| improve this answer | |
  • 1
    This answer makes sense, but it seems a bit abstract. Couldn't the same argument be made about NAT? If i've set that up wrong or someone accidentally modifies it, isn't that the same argument? (Though I admit this is probably harder to do than a simple SG change...) WRT turning it around... Hah - yes good question - I should have included this in my question. The trade-off seems to be more complexity in setting things up, and the $500 a year costs to run a 3xNAT servers (not a huge amount in the big scheme of things, but maybe too much for an abstract extra level of security?). – John Apr 3 '19 at 8:51
  • AWS nat gateways are pretty inexpensive $32/mo – Ron Trunk Apr 3 '19 at 10:44

I would say the private VPC + NAT option has less administrative overhead and less chances of leaving access open due to a mistake (e.g. not assigning the SG or some pretty open rule).

Also, without knowing the internals of the platform I can make an educated guess and say that VPC + NAT is a better use of the platform resources. If you have public IPs, inbound traffic that will be rejected has to probably traverse AWS' network down to your VM. If you don't have public IPs, there's no inbound traffic coming to your VMs :)

| improve this answer | |
  • 1
    I'm almost certain that the traffic will not reach the VM as Security Groups are handled at AWS' infrastructure level. i.e., they're not software firewalls running on the servers. Sure, the packets are being handled "somewhere" but that's AWS's problem ;-) – John Apr 3 '19 at 8:50
  • I didn't explain myself very well. What I meant to say is that they'll go down the infrastructure in the direction of the VM. They'll probably stop at the SDN layer on the physical host where the VM is deployed. And I agree it's AWS's problem :-) but at the end of the day you can do something to help making the underlying infra more stable (-: – Pedro Perez Apr 3 '19 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.