You can use ec2-authorize to specify what kind of traffic to allow to your ec2 instance. Is it still a good idea to run iptables, or is that introducing unnecessary complexity?
Some reasons why you might consider activating iptables:
Activating iptables provides defense in depth, and is easy to configure, eg with ufw:
(note: this won't block outgoing smtp, but it does show that getting a basic iptables configuration setup is fairly painless, and then you can tweak this if you like vi /etc/ufw/*.rules)
I'd say it depends on how paranoid you are. I personally use a two-staged approach on my networks: there is a global firewall which blocks most bad stuff, and then each host runs some type of local firewall specific to its purpose in life.
It sounds like ec2-authorize is a lot like that per-host firewall. I'd configure it up and throw a few bad packets at it, and see what happens. I suspect it is sufficient.