If you put all of your services behind a reverse-proxy CDN/WAF service like CloudFlare it greatly reduces your attack surface because the public has no access to your origin IPs.