Firewalling/FIltering traffic from reaching my instances

Hi,

In case I'd like to make sure no undesirable traffic reaches my instances / VMs, what's the right way do implement this?

In Amazon EC2 this is possible with "Security Groups".

Note I'm not talking about internal firewall on the VM, but a firewall on the cloud's border servers that would filter traffic long before it reaches my VMs.

Thanks!