On an EC2 instance, you can configure a security group to have what seem to be the same as firewall rules (e.g. default drop all traffic with selectively allowing port based, inbound or outbound traffic). Previously I've used other services such as DigitalOcean and I just add some rules to the firewall (e.g. UFW) once I'm logged into the instance.
With an EC2 instance should I only configure firewall rules via security groups and not touch firewall software running on the instance (e.g. once I log into the system, not configure ufw or iptables)?
I want to make sure that I've got this set up correctly, and that I'm not accidently forcing traffic through 2 sets of firewall rules if both security groups and a host based firewall is being used.
My hunch is that either approach, or a combination of both could work (and this would be fine as long as there aren't duplicate rules). Is this right? If possible I would like to simply use security groups.