Which ports must be opened in the Security Group for a public web server?
A public web server must allow HTTP (port 80) and HTTPS (port 443) inbound from 0.0.0.0/0, with optional admin ports like SSH (22) restricted to your IP.
A public web server needs port 80 for HTTP and port 443 for HTTPS open to the world; all other ports should remain closed unless explicitly required.