If you enable "classic link" for an EC2-classic instance, it will be able to talk to your VPC.
Your existing EC2-security group (assigned to the classic server) - controls all traffic to EC2-classic instance EXCEPT for the traffic with the linked VPC (according to the docs).
That traffic - between the EC2-classic instance and the VPS - is controlled by a separate security group that you assign when you set up this "classic link".
Now. Is it safe to simply allow all traffic on all ports in this VPC security group? Assuming, it connects only to my private VPC anyway.
I guess my question is - when a classic link is enabled, it "links" my EC2-instance to my and only my VPC, correct? No other traffic can physically get through this link, am I right? Thanks.