Ask HN: What kind of per-machine firewalling if using VPC / security groups?

On AWS, there's no doubt that VPCs and security groups are a very powerful and flexible feature. I am kind of curious what administrators are doing with individual machine-level firewalls (iptables etc.) if making use of these networking features from Amazon. Deny all traffic from sources not in the VPC? etc.