great write up Somesh. I figured i'd share another way of accessing RDS in private VPC. Using Border0 you can access a private RDS DB from anywhere, without the need for a VPN. https://levelup.gitconnected.com/how-to-access-a-private-aws-rds-database-573c08210c85

It works with a variety of database clients out of the box. Best of all, it allows users to use their SSO credentials to log in, no more shared DB creds :) And you get Query logs.