Microsoft Windows Firewall is enabled and configured when you build a deployment using Esri Amazon Machine Images (AMIs) on Windows. All ports that are necessary for ArcGIS Enterprise components to run are open to inbound connections.
Outbound connections are allowed by default.
Windows Firewall and Amazon security groups
Amazon security groups provide protection against unsolicited incoming traffic. In this role, they complement Windows Firewall. To completely open a port to inbound traffic, the port must be allowed by both the Amazon security group and Windows Firewall.