Is it okay to use an Elastic Load Balancer for ssh/sftp traffic?

Question

I have an instance that acts as both and SFTP server and a NFS shared drive to our internal network.

The instance has a public IP to receive data over SFTP. That data is saved to a volume that is shared inside my internal network.

I use a security group that allows white listed port 22 traffic, and white lists all ports to my internal network.

The data is sensitive, and since this instance has a Public IP, it's one security group slip up from being opened to everyone.

I would like to remove the public IP from the instance, but it requires SFTP access from the Internet.

The solution I came up with is to create a public load balancer that forwards traffic on port 22 to my instance, add the security group it and remove the public ip from my instance, therefore even if I screw up, the instance is not publicly reachable.

I know ELBs were not meant for this, but in theory it should work. Are there problems with this solution? Is there a better/more preferred way for implementing something like this?

Solution

An ELB is the wrong way to do this. Your question isn't as clear as it could be, but I'll answer as best I can. I think you need a private subnet with a DMZ.

I suspect you may be best off with a t2.nano instance (or larger) as your SFTP server, with scripts to move the data to where it needs to go onto your internal server. You could use that instance as a bastion host, so you can ssh to it, and then on to your server in a private subnet. This basically makes a DMZ. If you need outgoing internet access then use a NAT Instance.

If you can replace sftp with S3 then you could eliminate the need for an incoming proxy server, which could be cheaper. You could keep all your data on S3, which is cheaper than EBS.

If you can clarify and expand on your use case you may get better responses.