&gt; Which basically would mean that they are incompetent. A private IP address doesn&#x27;t really do anything for you security-wise.<p>And yet is a requirement for many compliance policies.<p>For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet.<p>That&#x27;s the sort of thing that private subnets and NAT in Amazon&#x27;s VPC was really made to cover.<p>Could you give your database with millions of credit card records a public IP, and just firewall it to be secure? Sure. But you don&#x27;t need to, and a core part of compliance is not taking risks you don&#x27;t need to take. You can accidentally add a bad firewall rule, you can leave some sort of hole that makes it easy to punch through. It&#x27;s much harder to accidentally make your database accessible from the public internet through a NAT.<p>What this new service means is that, instead of having a server in every region whose sole job it is to accept outgoing connection requests for package upgrades, I can use this service.<p>Why do I not just have those connections go through the web server? Because PCI requires one role per server.<p>Why do I not just use a micro instance instead of this more expensive service? Because then I have one more server I have to maintain and test for compliance.<p>For people that have security policies and compliance requirements to meet, this service makes life a small amount simpler, and is worth the price.