A public IPv4 address is an address reachable over the internet. An EC2 virtual machine can have one so visitors can reach its web server. In the EC2 console, find it in the instance details under IPv4 Public IP. section 2.2.1
Open a web server by address
After starting Apache on an EC2 instance and allowing inbound HTTP traffic, find the instance’s public IPv4 address in the console. Enter it in a browser, for example, http://52.54.202.9. From the instance, you can also retrieve the address with `curl http://169.254.169.254/latest/meta-data/public-ipv4`. section 3.5
An automatically assigned address is not a permanent endpoint: stopping and starting the instance can give it a new one. For a fixed address, allocate an Elastic IP in the EC2 console, then associate it with the instance. You can associate that address with a replacement virtual machine to keep the application’s public endpoint unchanged. A fixed address is useful when clients cannot resolve a DNS name, firewall rules depend on an IP address, or DNS updates would take time to reach clients. section 3.5 section 3.6
Public and private addresses serve different purposes. Devices on a local network can use private addresses while sharing their internet gateway’s public address. If an EC2 security group should accept HTTP only from your current public address, find that address at https://checkip.amazonaws.com/ and allow it as a `/32` source. Because your address may change, pass it as a configuration parameter instead of hardcoding it. section 5.4.4
Listing 5.4 Security group allows traffic from source IP
Parameters:
WhitelistedIpAddress: #1
Description: 'Whitelisted IP address'
Type: String
AllowedPattern: '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$'
ConstraintDescription: 'Enter a valid IPv4 address'
Resources:
SecurityGroup:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: 'Learn how to protect your EC2 Instance.'
VpcId: !Ref VPC
# [...]
SecurityGroupIngress:
# [...]
- Description: 'allowing inbound HTTP traffic'
IpProtocol: tcp
FromPort: '80'
ToPort: '80'
CidrIp: !Sub '${WhitelistedIpAddress}/32' #2
The security-group template uses a `WhitelistedIpAddress` parameter and appends `/32`, restricting inbound HTTP on port 80 to that exact IPv4 address. section 5.4.4
Giving clients a web server’s public address also ties them to that endpoint. A load balancer offers another arrangement: clients contact the load balancer, which forwards requests to a server without exposing that target as the address clients must know. section 14.0
