Comment 7 for bug 2038894

"no open ports" is the long standing policy for all Ubuntu and is not just for cloud images. (Even port 22 is not supposed to be open on bare metal server by default, only as opt in.)

I don't have a link handy at the moment to documentation of this policy but it IS the policy.