AWS Cloud Firewall Instance Configuration

Cloud Platform firewall rules let you allow or deny traffic to and from your virtual machine (VM) instances based on a configuration you specify. Enabled firewall rules are always enforced and protect your instances regardless of its configuration and operating system, even if they have not started up.
Every VPC network functions as a distributed firewall and their rules are defined at the network level, connections are allowed or denied on a per-instance basis. Customers can think of the firewall rules as existing not only between their instances and other networks, but in between individual occurrences within the same network.