Use security groups to restrict access to your streaming instances. Security groups also isolate traffic between your streaming instances and AppStream 2.0 management services. Security groups that belong to your VPC let you control the network traffic between AppStream 2.0 streaming instances and VPC resources such as license servers, file servers, and database servers. For more information, see Configure a VPC with Private Subnets and a NAT Gateway. To provide internet access to your streaming instances in a private subnet, use a NAT gateway. Instances in a private subnet if they should not be accessible from the internet. When you launch an Amazon AppStream streaming instance, you launch it into a subnet in your VPC.