Imagine you have some EC2 servers which are fronted by a load balancer (ELB).
Say they're in a public VPC - i.e. each EC2 instance has a public IP address and each instance is firewalled using Security Groups (SG) so only the ELB has direct access to the instances.
Assume the servers do require outgoing public internet access.
We're aware that the AWS recommended approach is to instead use a private VPC + NAT to improve security.
But, what is the practical benefit of doing this versus the above?
From my understanding, no-one can connect directly to the instances anyway in the above scenario because of the SG rules, and since this is handled in AWS's infrastructure, it's not like our servers can get flooded with connections - the packets won't ever reach us.
So what harm is there is having a public IP address if AWS firewalls you off anyway?
Am I missing some other benefit from a private VPC? Am I wrong in one of my above assertions?