How insecure is it to publish my direct EC2 URL?

Question

I have a domain resembling the following from EC2:

http://ec2-55-55-55-555.us-east-2.compute.amazonaws.com/

How problematic is it to publish this to the public with regards to security?

Answer 1

The only information in the URL is the IP address, the fact you are running on AWS and the region you are running in. None of that is a secret as this information can be trivially discovered anyway.

However if you are going to use the domain for a publicly accessible service it's better to create an Elastic IP, assign it to the server and point a canonical DNS name for the service at the IP address.

Otherwise the address will keep changing for users if you move the service to another instance, or even stop and restart the server if you are not in a Virtual Private Cloud.

Answer 2

I'd be fairly certain that AWS is being scanned constantly by attackers, so running a webserver on port 80 shouldn't be considered a secret. This is true in general for any publicly available service.

25 years ago people hooked up services on dialup modems with little or no security (default passwords). They believed that the obscurity of the phone number was enough to protect them if they didn't publish the phone number, unaware of wardialers that had existed since the early 80s, the name stemming from the 1983 movie Wargames.

This sort of practice is called security through obscurity, and has been highly frowned upon for decades. Essentially if you think you're safe because nobody will visit an IP address unless they're explicitly told about it, think again.