When we create a VPC in AWS, a default Security Group is created. It has one Inbound rule in which Source field has reference to Security Group itself.
What does it means?
It means that if you create two EC2 instances with that security group, they can comunicate with each other without any network restrictions.
You can learn more on AWS Documentation.