Is an unencrypted wallet secure if bitcoind is not accepting RPC calls?
Turning off RPC will prevent that particular attack vector, but if the coins are on a machine connected to the internet, that's a lot of vulnerabilities and attack vectors to consider.

That said, if you're running a node on EC2, you're not going to generate enough bitcoins to be worth stealing. If the point is to figure out how everything works, I wouldn't worry about the bitcoins you'll be mining since it'll be so little (at most $10 per year).