Elastic IPs & Network ACLs
~15 min read
A static public IP you control, and a stateless, subnet-wide firewall layered underneath Security Groups.
An Elastic IP (EIP) is a static, public IPv4 address you allocate to your account and can attach to (or move between) EC2 instances or NAT Gateways. Without one, an instance's public IP changes every time it's stopped and restarted — an EIP gives you a fixed address that survives a stop/start cycle, which matters for anything referenced by a DNS record or a hardcoded client config. AWS charges for an EIP specifically when it's allocated but NOT attached to a running resource — the idea is to discourage hoarding a scarce IPv4 address you aren't actually using.
A Network ACL (NACL) is a second firewall layer that operates at the subnet level, evaluated BEFORE a request ever reaches a Security Group. The two differ in a way that trips people up constantly: Security Groups are stateful (allow the response to an allowed inbound request automatically) and can only ALLOW traffic (no explicit deny rules); NACLs are stateless (you must explicitly allow both the inbound request AND the outbound response as separate rules) and support explicit ALLOW and DENY rules, evaluated in numbered order until a match is found. Every subnet has a NACL — if you don't create one, it uses the VPC's default, which allows all traffic by default.
In practice, NACLs are used far less often than Security Groups — most teams leave the default NACL as-is and do all their access control at the Security Group level, reaching for a custom NACL specifically when they need a subnet-wide, IP-range-based block (e.g., blocking a specific malicious IP range at the subnet boundary, before it even reaches any instance's Security Group).
In the AWS Console
- 1
VPC → Elastic IPs → Allocate Elastic IP address
Allocate a new Elastic IP address.
An allocated-but-unattached EIP starts incurring an hourly charge — attach it or release it promptly.
- 2
VPC → Elastic IPs → [your EIP] → Actions → Associate Elastic IP address
Associate the Elastic IP with a running EC2 instance or a NAT Gateway.
Re-associating an EIP to a different instance takes effect within seconds — useful for a manual failover.
- 3
VPC → Network ACLs → [select NACL] → Inbound rules / Outbound rules
Review or edit a subnet's Network ACL rules, noting that both inbound AND outbound rules need entries for two-way traffic.
Rules are evaluated in ascending rule-number order; the first matching rule wins, so ordering matters.
💬 Deep Dive with AI
Key points
- •An Elastic IP is a static public IP that survives an instance stop/start — you pay specifically when it's allocated but not attached to anything running.
- •NACLs are stateless (inbound and outbound rules are independent) and subnet-wide; Security Groups are stateful and instance-level.
- •NACLs support explicit DENY rules; Security Groups can only ALLOW.
- •Most real-world access control happens at the Security Group level — NACLs are reached for specifically when a subnet-wide IP block is needed.