I have a VPC with public and privet subnets. A load balancer serves instances with web servers in private subnets. I have security groups in place to allow only HTTP traffic for the balancer and only local HTTP traffic for instances.
Should I also set inbound/outbound rules for NACL on the VPC and each subnet? Now the default seems to be to allow all the traffic.
Should I consider limiting traffic with NACL according to my needs (HTTP, ssh, etc)? or it's overkill or not very useful or overly complex?