Should I setup an additional Firewall to EC2 Instances in AWS or Security Groups are enough!

What's the best practice here and why so?