It is recommended to install Administration Console on a private subnet to restrict the access to Config data store. To protect Administration Console in a cloud environment, see Deploying Access Manager on Public Cloud in the NetIQ Access Manager 4.4 Installation and Upgrade Guide.