Windows Firewall is enabled and preconfigured when you build a Windows-based site from Esri Amazon Machine Images. All ports that are necessary for ArcGIS Enterprise components to run are open to inbound connections.
Outbound connections are allowed by default.
Windows Firewall and Amazon security groups
The Amazon security groups provide protection against unsolicited incoming traffic. In this role, they complement Windows Firewall. To completely open a port to inbound traffic, the port must be allowed by both the Amazon security group and Windows Firewall.