I have an AWS server. I didn't want to spend too much time configuring the Security Group and allowed all inbound and all outbound traffic. Is this OK or is it a bad idea?
Restricting inbound traffic is fairly easy to understand: if, say, you're running ssh and only ever access this server from your internal network, then allowing people from the broader internet to connect to sshd is providing an attack vector. Yes, you should be using only key-based authentication, and yes, you may be using something like fail2ban, but having more layers of protection is good to protect you when the others fail.
Restricting outbound traffic helps keep an attacker who's comprised your server from exfiltrating information or poking holes to give themselves remote access.
The least priviledge rule is among the basis of security (note that it is not restricted to IT security...). If everything was at an ideal level (no evil guys trying to break your machine, no flaws in any installed software) restricting traffic would just be loss of time.
Unfortunately, there may be security flaws in numerous pieces of software, making them vulnerable to different attacks, Of couse I assume that you read CERT advisories and patch all known vulnerability. But restricting traffic is just another defense line to limit exposition of your machine to what is stricly required. That way, even if you have forgotten an unpatched piece of software, no evil guy could make use of it if the firewall blocks any communication with it.
That being said, security is always a balance between risk and cost, so if it is only a test machine, it may not be worth the cost of securing it (even if using best practices in always good on a learning point of view). But the decision and the risk is your own problem. Caveat emptor...