The following best practices are general guidelines and don’t represent a complete security solution. Because these best practices might not be appropriate or sufficient for your environment, treat them as helpful considerations rather than prescriptions.
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-best-practices.html

