I think you’ve confused a couple of things. Your db should be in a private subnet as opposed to a VPC, and it’s never advised to have public access directly to

I think you’ve confused a couple of things. Your db should be in a private subnet as opposed to a VPC, and it’s never advised to have public access directly to your db. You also don’t need NAT for RDS instances as they shouldn’t be initiating outbound connections to the internet. If you do want to connect to your db from outside of AWS for ad hoc connections then you should be setting up a bastion host in the public subnet and you don’t need anything other than security group rules to configure communication between them - same goes for a web server (routing between public/private subnets are configured out of the box).