Tiered subnets
Application, data and management tiers live on separate subnets; the data tier has no way out.
Every server boots on an isolated private network. A public address is a separate choice, and a default-deny firewall sits in front of it.

Application, data and management tiers live on separate subnets; the data tier has no way out.
Firewall rules bind to servers; which resource opened which port is visible on one screen.
An address comes from the pool, attaches to the server you choose, and returns when you are done.
You manage egress through a single door and reach your private network over Zero Trust.
This product has no separate fee: usage is metered hourly and drawn from your plan. The multipliers and the calculator are on the pricing page.