# Best Practices for Securing AWS Instances Behind a Firewall **URL:** \ **Category:** Data Ingestion\ **Tags:** aws\ **Created:** [December 4, 2025, 10:37pm UTC](https://community.observeinc.com/t/best-practices-for-securing-aws-instances-behind-a-firewall/371 "2025-12-04T22:37:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Allen\_3453](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@Allen\_3453](https://community.observeinc.com/u/Allen_3453)\ **Post date:** [December 4, 2025, 10:37pm UTC](https://community.observeinc.com/t/best-practices-for-securing-aws-instances-behind-a-firewall/371/1 "2025-12-04T22:37:56Z")
Hey, I have a number of AWS EC2 instances that I need to keep safe while still being able to access them for my apps. I’m having trouble with things that happen to a lot of people, and I would love to hear your best tips: How to set up firewalls (on-premises or in the cloud) so that AWS instances are safe without losing connectivity. When hosting apps on EC2, which ports and services should be open and which should be closed? The best ways to keep an eye on and stop attacks like DoS, brute-force attempts, or strange traffic. For AWS environments, here are some good IDS/IPS rule sets, logging, and alerting strategies. I’m looking for useful tips from anyone who has successfully protected AWS workloads. What mistakes should I avoid, and what worked best for you? Thanks in advance! ---
**Author:** ![nikhil.dua](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.observeinc.com/nikhil.dua/32/10_2.png) [@nikhil.dua](https://community.observeinc.com/u/nikhil.dua)\ **Post date:** [December 4, 2025, 10:41pm UTC](https://community.observeinc.com/t/best-practices-for-securing-aws-instances-behind-a-firewall/371/3 "2025-12-04T22:41:04Z")
Hey Allen! Welcome to the community. To clarify, is this in regards to AWS Observe Integration or are you generally interested in learning about securing AWS Instances? Nikhil ---
**Author:** ![Allen\_3453](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@Allen\_3453](https://community.observeinc.com/u/Allen_3453)\ **Post date:** [December 5, 2025, 5:42am UTC](https://community.observeinc.com/t/best-practices-for-securing-aws-instances-behind-a-firewall/371/4 "2025-12-05T05:42:27Z")
Hey Thank you for welcoming me to the community! My main question is about how to keep AWS EC2 instances safe in general. This includes things like firewalls, which ports to open or close, monitoring for attacks, and best practices. I’m not only interested in the Observe integration, but I’d also like to hear about any tips that have to do with monitoring tools or dashboards. ---
**Author:** ![nikhil.dua](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.observeinc.com/nikhil.dua/32/10_2.png) [@nikhil.dua](https://community.observeinc.com/u/nikhil.dua)\ **Post date:** [December 5, 2025, 6:43pm UTC](https://community.observeinc.com/t/best-practices-for-securing-aws-instances-behind-a-firewall/371/5 "2025-12-05T18:43:57Z")
Got it. Regarding AWS EC2 instances in general, AWS blogs would be a good place to get specific updated info. Here’s one of the better articles: [https://medium.com/@tahirbalarabe2/best-security-practices-for-amazon-ec2-1362d0c3b428](https://medium.com/@tahirbalarabe2/best-security-practices-for-amazon-ec2-1362d0c3b428) I’ve gathered some information from AWS best practices along with combining with Observe monitoring. To summarize: - **Network segmentation & least privilege** - **Ports & services (what to open / close)** - **Admin access patterns (avoid public SSH/RDP)** - **Identity & credentials** - **Patching & hardening** - **Logging, observability & dashboards (with Observe)** - **General Gotchas** ---
**Author:** ![Allen\_3453](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@Allen\_3453](https://community.observeinc.com/u/Allen_3453)\ **Post date:** [January 29, 2026, 7:46am UTC](https://community.observeinc.com/t/best-practices-for-securing-aws-instances-behind-a-firewall/371/6 "2026-01-29T07:46:47Z")
1. For firewalls and network segmentation, use Security Groups to control instances and NACLs to block at the subnet level. Share apps that can be seen by everyone in public subnets and private subnets for private services like databases and administrative tools. 1. Port Hardening : Only open the ports you need to (for example, 80/443 for the web). Only let certain IPs use SSH (22) or use a defense host. Keep empty ports closed. 2. (Monitoring and IDS) Turn on CloudWatch, CloudTrail, and VPC Flow Logs. Connect to a monitoring tool like Observe to get reports when there are large amounts of traffic, failed logins, or changes to security groups. 3. IAM & Secrets: Use IAM roles, change your keys often, and don’t put passwords inside instances. For private information, use AWS Secrets Manager. 4. Patching and Hardening: Make AMIs more secure, set up automatic patching, and think about using an approach to infrastructure that can’t be changed (rebuild instances from safe AMIs).