Windows Firewall is enabled and preconfigured when you build a Windows-based ArcGIS Server site using ArcGIS Server Cloud Builder on Amazon Web Services or the AWS Management Console. All ports that are necessary for ArcGIS Server to run are open to inbound connections.
Outbound connections are allowed by default.
Legacy:
In the ArcGIS 10.1 AMIs, outbound connections were blocked in Windows Firewall by default.
Windows Firewall and Amazon security groups
The Amazon security groups provide protection against unsolicited incoming traffic. In this role, they complement Windows Firewall. To completely open a port to inbound traffic, the port must be allowed by both the Amazon security group and Windows Firewall.