aws has security groups as well. using NAT for a firewall is overkill.