title: Amazon EC2: instace in public subnetwork without public IP vs instance in private subnetwork
body: <p>I have a VPC created according to scenario 2: <a href="http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html" rel="nofollow">http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html</a></p>
  
  <p>When creating an instance in the public subnet, I'm given the choice of:</p>
  
  <p>1- Not associating a public IP to the instance</p>
  
  <p>2- Associating a public IP that can change when the instance is restarted</p>
  
  <p>3- Associating an Elastic IP</p>
  
  <p>My question is: what is the difference, security-wise, between creating an instance in the public subnet but without a public IP (option 1) and creating the instance in the private subnet? I know that private instances are behind a NAT, but does this really add a relevant layer of security? Wouldn't I be as protected with a public instance without a public IP belonging to a sound security group?</p>