A VPC with a public subnet that's locked down largely via security groups is probably fine for a project that can't justify a $35/month spend.

edit: Apparently not. See below, my mistake.