Minimally-permissive outbound security rule for Ubuntu EC2

Question

Clients are asking aggressive questions about Data Loss Prevention.

One obvious way to limit the effects of a system being compromised is to do something a bit more restrictive than 0.0.0.0/0 for the outbound security rule. Numerous security guides also recommend limiting these rules, but I don't see any examples about what actually needs to be allowed.

Many instances only need to access package repos, but in experimentation, allowing access to the us-west-2.ec2.archive.ubuntu.com IP addresses on 80 is NOT enough. (For my us-west-2 instance.) What else is required? The apt logs aren't being very helpful.