> Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise. And yet is a requirement for man

> Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise. And yet is a requirement for many compliance policies. For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet. That's the sort of thing that private subnets and NAT in Amazon's VPC was really made to cover. Could you give your database with millions of credit card records a public IP, and just firewall it to be secure? Sure. But you don't need to, and a core part of compliance is not taking risks you don't need to take. You can accidentally add a bad firewall rule, you can leave some sort of hole that makes it easy to punch through. It's much harder to accidentally make your database accessible from the public internet through a NAT. What this new service means is that, instead of having a server in every region whose sole job it is to accept outgoing connection requests for package upgrades, I can use this service. Why do I not just have those connections go through the web server? Because PCI requires one role per server. Why do I not just use a micro instance instead of this more expensive service? Because then I have one more server I have to maintain and test for compliance. For people that have security policies and compliance requirements to meet, this service makes life a small amount simpler, and is worth the price.