I'm currently setting up several subnets on Amazon VPC. For example I've got a subnet for the database servers, one for the webservers and one for the load balancers. I try to restrict the access to these subnets as much as possible. Right now we create ACLs and security groups with the same set of rules and assign them to the subnets/instances.
Would it be ok to just use one of them? Which would you prefer to use? Or do I miss something which requires creating and maintaining both of these?