Once we have secured the instance with the AWS services, we shouldn't forget the operating system firewall. For example, instances in the same security group are unable to communicate with each other, which means a lot of times, administrators will not think to even start up an operating system firewall. However, not using an instance operating system firewall is bad practice.
For example, multiple teams or individuals might have the ability to manage the AWS environment. One of the teams or individuals could create a rule to allow communication between all the instances in a security group. The change might even be required as there are many cases where an application might require the ability to maintain contact with its peers over the network. If the operating system firewall is not enabled, all of the ports on the machine are exposed...
