Cloud-hosted On-Prem Security

Hi,

My evaluation system is as follows:

I have an on-prem instance of retool hosted by AWS/EC2.
It uses a database hosted at Supabase.
I intend to enable 2-stage authentication for users.
https is currently not enabled.
Access is via the AWS instance's public ip address.

Please could you comment on the security of the current configuration and make suggestions regarding what security measures should be implemented.

Many thanks...