FWIW, The security rules on the machine itself don’t matter much, unless you don’t trust software running in the same VPC (AWS account.)
In some corporate settings, where you want to limit lateral movement of an attacker, this is important, but if you’re not in a large enterprise, no worries 