Security groups

Stateful firewalls per instance.

Security groups deny all inbound traffic by default and allow all outbound traffic. They are stateful: replies to allowed connections are let back in automatically, which is why a Telnet client needs no inbound port 23 rule while the server does.

Best practice: open only the ports a service needs, and only to the sources that need them (e.g. SSH from your own /32 address).