EC2 Public, Private, and Elastic IP Addresses – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

Amazon EC2 networking uses several address types with different lifecycles and failover characteristics. The key architectural distinction is whether an address is private and instance-local, public and temporary, or public and static.

These concepts affect internet connectivity, recovery design, DNS strategy, subnet placement, and how an application can be moved between instances or Availability Zones.

Key Concepts

Elastic Network Interfaces

Every EC2 instance has at least one Elastic Network Interface (ENI), normally identified as eth0 or ens5 depending on the operating system and instance configuration. An ENI is a virtual network interface that exists independently from the compute instance.

An ENI can have:

A primary private IPv4 address.
Additional secondary private IPv4 addresses.
A public IPv4 address mapping.
An Elastic IP address mapping.
Security group associations.
A subnet and Availability Zone association.

Because the ENI is a separate resource, it can sometimes be detached from one compatible EC2 instance and attached to another instance in the same Availability Zone. This can preserve network identity, private IP addresses, and security group associations during recovery.

An ENI cannot be moved directly to another Availability Zone. For cross-AZ recovery, use an Elastic IP, DNS, or another deliberately designed service-discovery mechanism instead.

Private IPv4 Addresses

A private IPv4 address is assigned to an ENI from the subnet’s CIDR range. It is the address used for communication within the VPC and connected networks, such as:

Other EC2 instances.
Internal load balancers.
Databases and caches.
VPC peering or Transit Gateway-connected VPCs.
On-premises networks connected through VPN or Direct Connect, subject to routing.

Every EC2 instance has at least one private IP address. Its primary private IP address normally remains associated with the ENI when the instance is stopped and started.

Private IP addresses are available in both public and private subnets. A subnet is not made public merely because an instance has a public IP; its routing table must provide a route to an Internet Gateway for it to be considered public.

Public IPv4 Addresses

A public IPv4 address allows an EC2 instance to communicate with the internet through an Internet Gateway, provided that routing, security groups, network ACLs, and the operating system firewall also permit the traffic.

Important properties include:

It is associated with the instance’s primary network interface and private IP mapping.
It is generally assigned dynamically when the instance is launched or started with automatic public IP assignment enabled.
It is released when the instance is stopped or terminated.
A replacement public IPv4 address may be assigned after a subsequent start.
It is not a stable endpoint for an application.
It is intended for public connectivity, but the instance still retains its private IP address.

The public IPv4 address is implemented as an external mapping through the VPC Internet Gateway. Consequently, the operating system normally sees the private address on its network interface, not the mapped public address. Applications should usually discover their public identity through AWS metadata or control-plane mechanisms rather than assuming the public address is configured directly on the operating system interface.

AWS charges for public IPv4 addresses, including public IPv4 addresses associated with running resources and Elastic IP addresses. Cost and address conservation should be considered in architecture decisions.

Elastic IP Addresses

An Elastic IP address (EIP) is a static public IPv4 address allocated to an AWS account in a specific Region. It can be associated with an ENI and remapped to another compatible resource when required.

An EIP is useful when:

A legacy integration requires a fixed public IP address.
A partner has allowlisted a source or destination IP.
A short-term instance replacement must retain the same public endpoint.
A failover design needs to move a public IPv4 address to a replacement instance.

An EIP is not tied permanently to one EC2 instance. It is associated with an ENI and its private IP mapping, so it can be reassigned to another instance or interface. This reassignment is normally performed with the AWS Management Console, CLI, SDK, or automation such as AWS Lambda and Systems Manager.

EIPs are Regional resources. They can be moved between Availability Zones in the same Region, but not directly between Regions. An EIP that is allocated but not associated can still incur charges, so unused addresses should be released.

For most modern application architectures, a DNS name, load balancer, or managed service endpoint is preferable to exposing an instance through a single EIP.

Public and Private Subnets

A public subnet has a route in its route table pointing to an Internet Gateway. An EC2 instance in that subnet needs a public IPv4 address or EIP for direct internet communication.

A private subnet does not have a direct route to an Internet Gateway. Instances there generally use a NAT Gateway or another controlled egress design for outbound internet access. They should not receive public IPv4 addresses for normal private-tier operation.

A public IP alone does not guarantee connectivity. The following must align:

The subnet route table must provide the required route.
The Internet Gateway must be attached to the VPC.
Security groups must allow the traffic.
Network ACLs must allow the traffic.
The instance operating system and service must be listening and permit the traffic.

Address Lifecycle Comparison

Address type	Scope and purpose	Retained after stop/start?	Movable to another instance?	Typical use
Primary private IPv4	VPC-internal identity on an ENI	Yes, normally	With the ENI, subject to AZ constraints	Internal communication
Auto-assigned public IPv4	Temporary internet-facing mapping	No	No; it is released and replaced	Simple, non-static public access
Elastic IP	Static public IPv4 in one Region	Yes, while allocated and associated	Yes, including across AZs in the Region	Fixed IP requirements and controlled failover
ENI	Virtual network interface and identity	Resource-dependent	Often, within the same AZ	Preserve private IPs, security groups, and interface identity

Exam-Relevant Takeaways

EC2 instances always have a private IP address on at least one ENI.
Private IP addresses are used in both public and private subnets.
An automatically assigned public IPv4 address is released when an instance is stopped or terminated.
An Elastic IP is a static public IPv4 address that can be remapped to another resource.
EIPs are Regional, not global; they can move across Availability Zones within the same Region.
A public subnet is defined by its route to an Internet Gateway, not simply by the presence of public IP addresses.
An Internet Gateway performs the public-to-private address mapping; the instance operating system generally sees its private IP.
Moving an ENI can preserve private network identity, but an ENI is tied to its subnet and therefore cannot be moved across Availability Zones.
Use DNS or a load balancer instead of an EIP when the requirement is application availability rather than a fixed IP allowlist.
Public IPv4 addresses and Elastic IPs have associated charges; avoid allocating unnecessary addresses.

Architecture Decision Guide

Requirement	Preferred approach	Reason
Internal service-to-service communication	Private IPs or private DNS	Avoids public exposure and reduces dependency on internet routing
Public web application with multiple instances	Application Load Balancer or Network Load Balancer plus DNS	Provides health checks, distribution, and multi-AZ support
One legacy server requires a fixed public IPv4	Elastic IP, with restrictive security controls	Provides a stable address that can be remapped
Instance replacement in the same AZ while preserving network identity	Reattach a secondary ENI	Preserves private IPs, security groups, and interface-level configuration
Instance failover across AZs with a fixed public IPv4	Remap an EIP, if the design truly requires an IP endpoint	EIPs are Regional and can move between AZs
Outbound internet access from private instances	NAT Gateway in a public subnet	Keeps instances private while enabling egress
Partner requires a stable endpoint but supports DNS	Route 53 name, load balancer, or service endpoint	Better availability and less dependence on one instance

Common Exam Traps

Confusing a public subnet with a subnet containing a public IP: The route table determines whether the subnet is public.
Assuming a public IPv4 address survives a stop/start: Automatically assigned public IPv4 addresses do not remain stable.
Assuming an EIP follows an instance automatically: An EIP must be explicitly associated or remapped.
Assuming an EIP is global: It is allocated in one Region and cannot be directly moved to another Region.
Assuming an ENI can be moved between AZs: An ENI is associated with a subnet, and subnets belong to one AZ.
Using an EIP for every highly available service: A load balancer or DNS-based design is usually more resilient and scalable.
Thinking a public IP replaces a private IP: The public address is a mapping; the instance still communicates through its private interface address.
Ignoring security controls: Public reachability still depends on routes, security groups, network ACLs, and host-level firewalls.
Forgetting IPv4 charges: Allocated or associated public IPv4 addresses can create ongoing cost.

Real-World Engineer Notes

Prefer stable DNS names over hard-coded IP addresses. DNS makes it easier to change instances, load balancers, Regions, or deployment strategies later.
Treat an EIP as a compatibility mechanism for fixed-IP requirements, not as the primary high-availability strategy.
If using EIP-based failover, automate health detection, instance provisioning, EIP association, validation, and alerting. Manual reassignment creates unnecessary recovery time.
A secondary ENI can be useful for preserving a private address or separating management and application traffic, but it does not provide cross-AZ portability.
Design security groups around private application paths where possible. Publicly exposed instance addresses should be minimized and tightly restricted.
For internet-facing workloads, use a load balancer across multiple AZs and keep application instances private whenever the workload allows it.
Verify the exact source address seen by downstream systems. Traffic can be translated by an Internet Gateway, NAT Gateway, load balancer, or other network component.

Quick Reference Summary

Private IP: VPC address assigned to an ENI; retained across stop/start in normal EC2 operation.
Auto-assigned public IP: Temporary public IPv4 mapping; released on stop or termination.
Elastic IP: Static, Regional public IPv4 address that can be remapped between instances or ENIs.
ENI: Independent virtual network interface containing private addresses and security associations.
Public subnet: Subnet with a route to an Internet Gateway.
Private subnet: Subnet without a direct Internet Gateway route; NAT is commonly used for outbound access.
Best practice: Use private addressing internally and DNS/load balancers for durable application endpoints.

Flashcards

Q: What address does every EC2 instance have at minimum?

A: At least one private IPv4 address associated with its primary ENI.

Q: What happens to an automatically assigned public IPv4 address when an instance is stopped?

A: It is released and may be different when the instance starts again.

Q: What is an Elastic IP?

A: A static public IPv4 address allocated to an account in a specific AWS Region.

Q: Can an EIP be moved between Availability Zones?

A: Yes, within the same Region, by associating it with a resource in another AZ.

Q: Can an ENI be moved between Availability Zones?

A: No. It is tied to its subnet, and a subnet belongs to one AZ.

Q: What defines a public subnet?

A: A route table route to an Internet Gateway.

Q: Does the EC2 operating system normally see its mapped public IPv4 address?

A: No. It normally sees the private address configured on the network interface.

Q: When is an EIP preferable to an auto-assigned public IP?

A: When a stable public IPv4 address is required for allowlisting, legacy integrations, or controlled failover.

Q: What is usually preferable to an EIP for a scalable public application?

A: A load balancer and DNS-based endpoint.

Q: Where are private IP addresses used?

A: In both public and private subnets for VPC and connected-network communication.

Q: What resource actually owns the private IP configuration?

A: The ENI, rather than the EC2 instance as an independent networking object.

Q: What additional controls are required for an instance with a public IP to be reachable?

A: Appropriate routes, Internet Gateway attachment, security group rules, network ACL rules, and host/service configuration.

Practice Questions

Question 1

An application runs on one EC2 instance. A business partner allowlists its public IPv4 address. The instance may need to be replaced during recovery. Which design best preserves the allowlisted address?

A. Enable automatic public IP assignment on the replacement instance
B. Allocate an Elastic IP and associate it with the active instance
C. Use the instance’s primary private IP address
D. Assign a secondary private IP address to the instance

Correct answer: B

An Elastic IP is a static public IPv4 address that can be reassociated with a replacement instance. An automatically assigned public address is released when the instance stops or is terminated.

Question 2

An EC2 instance in a private subnet needs outbound access to download operating system updates, but it must not be directly reachable from the internet. Which architecture is most appropriate?

A. Assign an Elastic IP directly to the instance
B. Assign an automatic public IP and route through the Internet Gateway
C. Route the private subnet through a NAT Gateway in a public subnet
D. Attach a second Internet Gateway to the VPC

Correct answer: C

A NAT Gateway provides controlled outbound internet access for private-subnet resources without assigning them public IP addresses. The NAT Gateway itself is placed in a public subnet and uses an Internet Gateway route.

Question 3

A recovery process must move an EC2 instance’s private IP address and security group associations to a replacement instance in the same Availability Zone. Which resource should the architect consider moving?

A. The subnet
B. The Internet Gateway
C. The ENI
D. The route table association only

Correct answer: C

The ENI is the network interface resource that contains private IP configuration and security group associations. It can generally be detached and attached to another compatible instance in the same AZ.

Question 4

An architect claims that a subnet is public because one EC2 instance in the subnet has a public IPv4 address. Which response is correct?

A. Correct; any public IP makes the entire subnet public
B. Correct; public subnets do not require route table changes
C. Incorrect; the subnet must have a route to an Internet Gateway
D. Incorrect; only a NAT Gateway can make a subnet public

Correct answer: C

A public subnet is determined by its routing configuration. The subnet’s route table must include a route to an Internet Gateway. An individual public IP does not define the subnet.

Question 5

A highly available web application runs across multiple AZs. The architect proposes assigning one EIP to each EC2 instance and placing those IPs in client configuration. Which recommendation best improves the design?

A. Replace the EIPs with automatically assigned public IPv4 addresses
B. Use an internet-facing load balancer and a DNS name
C. Attach every instance ENI to every Availability Zone
D. Use one private IP address across all instances

Correct answer: B

A load balancer provides a stable service endpoint, health checks, and multi-AZ distribution. Individual EIPs create unnecessary operational coupling to specific instances and do not provide the same scalable failover model.