An auto-assigned AWS public IPv4 address changes when an EC2 instance is stopped and started. An Elastic IP is a static public IPv4 address allocated to your account that you can reassociate with another network interface. AWS charges for both types of public IPv4 address.
Elastic IP vs public IP at a glance
| Question | Auto-assigned public IPv4 | Elastic IP address |
|---|---|---|
| Is it public? | Yes | Yes |
| Is it static? | No | Yes, until you release it |
| What happens on EC2 stop/start? | The old address is released and a new one is normally assigned on start | The allocated address remains yours and can remain associated |
| Can you move it to another instance or ENI? | No | Yes, by reassociating it |
| Is it allocated to your account independently? | No | Yes |
| Is it regional? | Yes | Yes |
| Does AWS charge for it? | Yes | Yes |
| Best fit | A workload that does not require a stable public address | A controlled failover or allowlist use case that genuinely requires stable IPv4 |
Both address types are public IPv4 endpoints. Neither creates or overrides a security-group rule, network ACL, host firewall, authentication control, or TLS configuration.
What is an auto-assigned public IP address?
An EC2 instance can receive a public IPv4 address when its primary network interface is created in a subnet whose public-addressing setting is enabled, or when the launch request explicitly enables it. AWS maps that public address to the interface’s primary private IPv4 address through network address translation.
The address is tied to that running-instance lifecycle. When an EBS-backed instance is stopped, its auto-assigned public IPv4 address is released. Starting the instance normally assigns a new public IPv4 address.
Use DNS rather than embedding the address in application configuration. If clients require a fixed source or destination address, an auto-assigned public IP is the wrong contract.
What is an Elastic IP address?
An Elastic IP address is a static public IPv4 address allocated to your AWS account in a specific Region. You explicitly associate it with an elastic network interface or supported resource, and it remains allocated until you release it.
The key feature is reassociation. During a failover, you can move the address to a replacement network interface without asking every external system to accept a new IP. That convenience also creates operational risk: an accidental reassociation can redirect traffic, and an allocated but forgotten address continues to incur cost.
AWS public IPv4 pricing
AWS charges hourly for all public IPv4 addresses, including auto-assigned public IPv4 addresses attached to running resources and Elastic IP addresses whether in use or idle. The old advice that the first in-use Elastic IP on an EC2 instance is free is no longer correct.
Rates, free-tier allowances, and service-specific treatment can change. Use the current Amazon VPC public IPv4 pricing for estimates, and use Public IP Insights, Cost Explorer, and the Cost and Usage Report to inventory and attribute usage.
Bring Your Own IP addresses are treated differently from Amazon-provided public IPv4 addresses; confirm the current BYOIP terms before modeling cost.
When should you use an Elastic IP?
Use an Elastic IP only when a stable public IPv4 address is a real interface requirement, for example:
- A third party allowlists a fixed source IP
- A legacy protocol cannot use DNS-based failover
- A small appliance or instance needs controlled address reassociation during recovery
- A migration requires a stable endpoint while the backing network interface changes
Do not choose an Elastic IP merely because it feels more reliable. For web applications, an Application Load Balancer, Network Load Balancer, Global Accelerator, or managed edge service often provides a better availability boundary. For outbound access, evaluate NAT gateways, egress proxies, IPv6, or service-specific private connectivity.
Security differences
The exposure risk is broadly the same: both addresses can make a resource reachable from the internet when routing and network controls allow it.
Check:
- Whether the resource needs any public address at all
- Internet gateway and route-table configuration
- Security-group ingress and egress rules
- Network ACLs and host firewall rules
- Authentication and TLS on the listening service
- DNS records and certificate names
- Flow logs, service logs, and ownership tags
- Unused or unexpectedly reassociated Elastic IPs
A static address can make allowlists easier, but it also creates a durable target. Treat stability as an operational property, not a security control.
Five operational rules for Elastic IP addresses
1. Release addresses you no longer need
Disassociating an Elastic IP does not return it to AWS. Release it explicitly after confirming that no DNS record, allowlist, failover plan, or dependent resource still references it.
2. Tag ownership and purpose
Record the service, owner, environment, data classification, and expiry or review date. An unowned address is difficult to assess and easy to leave billable.
3. Track every reassociation
Restrict ec2:AssociateAddress and ec2:DisassociateAddress, log the API calls through CloudTrail, and alert on unexpected changes. Reassociation can redirect live traffic.
4. Keep DNS and allowlists synchronized
Document who consumes the address. Update or remove DNS records and third-party allowlists during migration or release so traffic does not fail or later reach a different AWS customer.
5. Prefer IPv6 or managed front doors where practical
Public IPv4 addresses are scarce and billed. IPv6, load balancers, Global Accelerator, CloudFront, private endpoints, and service-specific connectivity can remove instance-level public IPv4 dependencies.
How to find public IP addresses in an AWS account
An account-wide inventory should cover more than Elastic IP allocations. Public IPv4 addresses can be associated with EC2, load balancers, RDS, EKS, NAT gateways, Global Accelerator, and other services.
Start with How to get all public IP addresses in your AWS account and reconcile the result with VPC IP Address Manager’s Public IP Insights.
This is where CSPM adds value: a point-in-time address list becomes useful when it is joined to routing, exposure, security-group, ownership, and evidence. Kloudle’s self-hosted posture layer keeps that configuration evidence in your infrastructure.
Official AWS references
- IP addressing for VPCs and subnets
- Elastic IP addresses
- How EC2 stop and start changes public IPv4 addresses
- Amazon VPC pricing
- Public IP Insights
Updated August 2026.
