After launching an EC2 instance, which AWS resource should be used to control inbound and outbound network traffic at the instance level?

Security groups act as virtual firewalls for EC2 instances, controlling both inbound and outbound traffic at the instance level. They specify allowed protocols, ports, and source/destination IP addresses, ensuring only authorized traffic reaches or leaves the instance. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service, not a firewall for individual instances. Network Access Analyzer helps identify unintended network access to your resources but doesn't actively control traffic. VPC endpoints allow private connections to AWS services without traversing the internet, but they don't function as traffic filters for EC2 instances.