Comment by spang

You can, but remember the sync engine doesn't provide any authentication layer by default, since people use it in so many different ways. You'll want to run it proxied behind some sort of authentication service. (With AWS, you can do this with different subnets via VPC.)