I guess I wasn't necessarily talking just about EC2, but network setups in general, where more distributed firewalls might often be a good choice, were it not f

I guess I wasn't necessarily talking just about EC2, but network setups in general, where more distributed firewalls might often be a good choice, were it not for the problems that NAT brings. Actually having a packet filter per machine would be an extreme case, obviously, but the same problem occurs when you have multiple gateways to different networks, or maybe you are multihomed, or you have multiple locations with their own internet uplinks ... having to maintain NAT state and generally ensuring reachability despite the NAT tends to get complicated fast if you have multiple independent filters/NAT gateways, while that's reasonably easy to maintain without NAT.