Ctrl K
Course outline

3.6

Public, Private and Elastic IPs

Which address an instance gets and when it changes, Elastic IPs, the public IPv4 charge, and better alternatives.

20 min Reading + animations

Tip: tap or hover any dotted-underlined term to see what it means.

By the end of this lesson you will be able to

  • Name the three kinds of IPv4 address an EC2 instance can have and what each is used for.
  • Predict what happens to each address on reboot, stop/start and termination.
  • Use an Elastic IP correctly, including to mask an instance failure, and know its limits.
  • Explain the public IPv4 charge and avoid paying for forgotten Elastic IPs.
  • Choose a better design than a fixed IP when the exam (or a real system) offers one.

#Three kinds of address

An instance in a VPC can have three kinds of IPv4 address:

AddressComes fromReachable fromChanges when
Private IPThe subnet’s CIDR range (lesson 3.2)Inside the VPC (and networks connected to it)Never while the instance exists; released at termination
Public IP (auto-assigned)AWS’s pool, if the subnet’s “auto-assign public IPv4” is on (or you ask at launch)The internetStop/start (released on stop, a new one on start) and termination
Elastic IP (EIP)Allocated to your account, then associated with an instance or network interfaceThe internetOnly when you move or release it

Remember from lesson 3.3 that the public and Elastic IPs live in the internet gateway’s one-to-one mapping. The operating system only ever sees the private address.

What each is for:

  • Private IP: everything inside the VPC. Servers, databases and load balancers talk to each other with private addresses: faster, cheaper (no internet path) and never exposed.
  • Public IP: a throwaway address so an instance can be reached from the internet, or reach it directly, without paying for or managing a fixed address.
  • Elastic IP: a public address that must never change, because something outside depends on it (a partner’s firewall allow-list, a DNS record you cannot update quickly).

What happens to an instance’s addresses

Follow the private IP, the auto-assigned public IP and an Elastic IP through reboots, stops, failures and termination.

Scenario

VPC
Public subnet10.0.0.0/24
Customer
Server A10.0.0.10public 203.0.113.25
→ 203.0.113.25
Step 1 of 4
1

Server A was launched in a public subnet with auto-assign on. It has a private IP, 10.0.0.10, and AWS also gave it a public IP from its pool: 203.0.113.25. Customers use the public one.

#Elastic IPs

An Elastic IP is a static public IPv4 address that you allocate to your account in a Region and then associate with an instance (or a network interface). Facts to know:

  • It stays yours until you release it, independent of any instance’s life.
  • It is associated with one instance or network interface at a time, but you can move it in seconds.
  • Default quota: 5 Elastic IPs per Region per account (you can request more).
  • It is a Regional resource: it cannot be moved to another Region.

Masking a failure. Because it can be remapped quickly, an Elastic IP lets you swap a failed instance for a standby without clients noticing: disassociate from the broken instance, associate with the healthy one. Clients keep using the same address. (The animation’s “Mask a failure” scenario.)

#Why AWS says to avoid them

AWS itself recommends using Elastic IPs sparingly. A fixed IP on a single instance usually means a fragile architecture: one server, manual failover, no scaling. Better options:

  • Give the instance (or a load balancer) a DNS name in Route 53, and change the record instead of pinning an address (Chapter 8).
  • Put instances behind a load balancer (Chapter 6): clients use the load balancer’s DNS name; instances can be private and come and go freely.
  • When fixed public IPs are genuinely required (partners allow-listing your addresses), a Network Load Balancer can have one Elastic IP per AZ, and AWS Global Accelerator gives two static anycast IPs for a whole application (Chapter 11).

#Public IPv4 costs money

IPv4 addresses are scarce, and since 1 February 2024 AWS charges for every public IPv4 address, about $0.005 per hour (roughly $3.60 per month) each:

  • in use (attached to a running instance) or idle (allocated but unattached, or attached to a stopped instance);
  • auto-assigned public IPs and Elastic IPs alike;
  • public IPs on load balancers, NAT gateways and other AWS resources too.

The AWS Free Tier includes some public IPv4 hours for new accounts during the first year.

Self-checkQuestion

An instance with an auto-assigned public IP is stopped for maintenance and started again. Users now cannot reach it at the old address. What happened, and what prevents it?

#Try it yourself

# Allocate an Elastic IP and attach it to an instance
ALLOC=$(aws ec2 allocate-address --domain vpc --query AllocationId --output text)
aws ec2 associate-address --allocation-id $ALLOC --instance-id i-0123456789abcdef0

# Find Elastic IPs that are allocated but attached to nothing (paying for nothing)
aws ec2 describe-addresses --query "Addresses[?AssociationId==null].[PublicIp,AllocationId]" --output table

# Stop paying: disassociate, then release
aws ec2 disassociate-address --association-id eipassoc-0abc123
aws ec2 release-address --allocation-id $ALLOC

# On a Linux instance: the OS only knows its private address
ip -4 addr show eth0

Amazon VPC IP Address Manager (IPAM) includes a free public IP insights view that lists every public IPv4 address in your accounts and shows which are idle.

#Summary

Key takeaways

  • Private IP: from the subnet range, used inside the VPC, kept until termination.
  • Public IP (auto-assigned): from AWS’s pool, changes on stop/start (not on reboot), released at termination.
  • Elastic IP: a static public IP allocated to your account until you release it; one instance or interface at a time, remappable in seconds to mask a failure; 5 per Region by default.
  • The operating system sees only the private address; the internet gateway maps public ↔ private.
  • All public IPv4 addresses cost about $0.005/hour since February 2024, attached or idle. Terminating an instance does not release its Elastic IP: release it to stop paying.
  • Prefer DNS names and load balancers over fixed IPs; when static IPs are required, consider an NLB’s Elastic IPs or Global Accelerator.