Security groups act as a stateful, virtual firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. You can create security groups and assign specific rules that allow or deny traffic based on protocol, port, and source/destination IP address. By associating a security group with one or more specific EC2 instances, you apply those defined security rules directly to them, which precisely meets the requirement.

A. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS, not a tool for applying rules to specific instances.
B. Network ACLs are stateless firewalls that operate at the subnet level. They apply rules to all instances within a subnet, not to specific, individual instances.
D. AWS Firewall Manager is a security management service that simplifies the administration of firewall rules (including security groups) across multiple accounts and resources, but it is not the feature that provides the instance-level firewall functionality itself.

1. Amazon EC2 User Guide for Linux Instances. "Control traffic to your instances using security groups." This section states, "A security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic... You can add rules to each security group that allow traffic to or from its associated instances."

2. Amazon VPC User Guide. "Security groups." This document details, "A security group acts as a virtual firewall for associated instances, controlling both inbound and outbound traffic at the instance level."

3. Amazon VPC User Guide. "Compare security groups and network ACLs." This guide explicitly contrasts the two: "Security group: Operates at the instance level... Network ACL: Operates at the subnet level."

4. AWS Shield Documentation. "What is AWS Shield?" The first sentence clarifies its purpose: "AWS Shield is a managed distributed denial of service (DDoS) protection service that safeguards applications running on AWS."