100% disagree with this. There's no reason to not use whitelist first for almost everything… especially inbound. Even if you do want to make your internal comm

100% disagree with this. There's no reason to not use whitelist first for almost everything… especially inbound. Even if you do want to make your internal comms life easier, you can use security-group-based rules that do any/any between the members of the group itself, effectively constructing VLANs easily between services.