Decide who needs to connect
Imagine a web server talking to a database. Visitors need access to the website, but that does not mean they should connect directly to the database. I would draw the connections first and assign addressing around those needs.
Check the complete path
For internet connectivity, check addressing, routes, gateways and access controls together. A public IP does not bypass security groups. Opening a port cannot fix a missing route. Treat each connection as a chain of requirements.
Plan address changes
Automatically assigned public IPv4 addresses can change during the instance lifecycle. Understand the behaviour before depending on an address in application configuration. Prefer suitable DNS or managed endpoints, and include current public IPv4 charges in your lab estimate.
Try it yourself
Draw a browser, web server and database. Mark which component needs public reachability and how the internal connection works.
A common question
Does a public IP expose every port?
No. Routing, access rules and a listening service are also required for a successful connection.
References & video notes
Use the video to follow the topic with me. Console screens and older offers can change, so check the current AWS documentation before performing a lab.
Keep learning
- EC2 security groups: allow the right connections
- Elastic IP addresses: when a stable public address helps
- Amazon VPC: draw your network before creating it