I wonder what the purpose of the linux firewalls is if there are already AWS security groups in place? Seems like a lot of extra complexity to track the IPs of

I wonder what the purpose of the linux firewalls is if there are already AWS security groups in place? Seems like a lot of extra complexity to track the IPs of every EC2 instance whenever they launch/start.