For a network with several hundred instances where each instance has a public IP, the borders of your network become quite wide. You now need to audit several dozen security groups.<p>When you setup a private subnet, there are a lot less security groups, and access points in general, which makes it much easier to audit and maintain reasonable security for.<p>This is especially true where unprofessional people start and stop instances (say developers) and don&#x27;t have the same security mind-set, making it a risk of human-error that causes services which normally should be protected to be open to the world.