Which ports are open by default on my instances?

We open ports according to an instances' role. They're not necessarily open to the public, e.g. the MySQL database master will only allow access to the MySQL port from your application servers. Rails' application servers allow access from the load balancer, but also from the public by default, so you don't need a load balancer, if you just want to host your application on one instance.

The current policy is:

Load-Balancer: public access to ports 80 (HTTP) and 443 (HTTPS)

Web-Server: public access to ports 80 (HTTP) and 443 (HTTPS), all ports from Load-Balancers

Rails-Application-Server: public access to ports 80 (HTTP) and 443 (HTTPS), all ports from Load-Balancers

PHP-Application-Server: public access to ports 80 (HTTP) and 443 (HTTPS), all ports from Load-Balancers

MySQL-Master (db-master): all ports from Rails-Application-Servers, Web-Servers, PHP-Application-Servers, NodeJS-Application-Servers, and Custom-Servers

Memcached-Master (db-master): all ports from Rails-Application-Servers, Web-Servers, PHP-Application-Servers, NodeJS-Application-Servers, and Custom-Servers

Custom-Server: public access to ports 80 (HTTP) and 443 (HTTPS), all ports from Rails-Application-Servers and PHP-Application-Servers

SSH (port 22) is open on all instances.

See this article on how to create your own EC2 Security Groups and open more ports.