it does an ok job by default, security groups are pretty locked down, it creates two for every environment(elb+server). if your db is outside of beanstalk youd want to add your own security groups to it. if you use the eb cli tool to ssh though be careful, the way that works is it opens port 22 to the world, you ssh, and only when you stop ssh'ing cleanly it closes it...