Yup but if you terminate tls at the ec2 side (as in a reverse proxy) the tradeoff is less privacy since the upload/download data is fully observable from the ec

Yup but if you terminate tls at the ec2 side (as in a reverse proxy) the tradeoff is less privacy since the upload/download data is fully observable from the ec2 instance. (Correct me if I’m wrong here, this is my memory from when I decided on my own setup years ago.) Some people might not care about this which is fine. Personally I’d rather take on slightly more overheard in setup (nftables vs nginx or whatever) and get the privacy in the bargain.