Mysql – Allow any ip to connect to Amazon Web Services RDS using MySQL

First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.

The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.

This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.

1 is correct. As evidence, the available RDS instance types (http://docs.amazonwebservices.com/AmazonRDS/latest/UserGuide/Concepts.DBInstance.html) correspond exactly to the appropriate EC2 instances.