I recently stumbled upon a firewall issue with my EC2 instance. The TCP port was made available to everyone via the EC2 Security Group, however there was still instance-side filtering using iptables. I figured if anything Security Groups are just a fancy API for IPTables. It turns out they're running completely exclusively from what I can tell. Is there any reason to use both? One firewall should be plenty and adding another layer of complexity seems to be a headache just waiting to happen.
In the meantime, I'm contemplating either opening up all ports in my Security Group and then doing all filtering via iptables, or the inverse, disable iptables and use Security Group filtering.
Any feedback on whether or not my logic here is flawed? Am I missing something critical?