Launching AWS EC2 instances in public subnet

Question

What is the security concern in launching AWS EC2 instances in public subnet. I assume when an EC2 instance is launched in public subnet , it will have access to outside world provided security groups allow it. Is all traffic from internet allowed to public subnet? I assume even this could be restricted via NACLs.

Answer 1

• About launching the ec2 instance in public subnet, it is recommended that EC2 instances which need direct Internet access need to be placed in the public subnet, else instances that need direct access to internal networks must be placed in a private subnet with routes to a virtual private gateway.
  
• About NACL, you can control incoming and outgoing traffic at subnet level through NACL.
  
• By default, NACL allows all inbound and outbound traffic.
  
• Can customize NACL with required rules in order to provide the extra security at the subnet level.