I don't know much about Elastic Beanstalk but bare EC2 instances connected to the Internet should fill anyone with dread. Securing the O/S and the network is no

I don't know much about Elastic Beanstalk but bare EC2 instances connected to the Internet should fill anyone with dread. Securing the O/S and the network is not trivial and AWS will gladly let you do the wrong thing out of the box. IaC doesn't magically solve any of those problems but if you make a mistake once you can fix it once instead of fixing it N times.