Question: I have a beanstalk server that is trying to connect to a postgres db running on a ec2 machine. The ips are unknown as they always change. What kind of security should I allow for the db? Normally you retrict to only your known server ip.

Answer: 
You can use AWS security groups to make your postgres server only accessible to your beanstalk instances. Just set up the security group on the postgres server to only allow incoming traffic from instances in your Beanstalk security group. This is effectively a firewall at the TCP/IP level, but you can block/allow based on AWS security groups instead of IP addresses. As far as I know, this should be pretty darn secure. At least, if you trust that Amazon has implemented its security group feature well.
You can try define [VPC security group](http://docs.amazonwebservices.com/AmazonVPC/latest/UserGuide/index.html?VPC_SecurityGroups.html).