Secure RDS (private endpoint) and allow connecting from local machine for specific predefined users
I am not sure it will be helped. I have similar design in my office.
I have some Kubernetes Cluster. all node and master running on local ip from a PVC. And my rds too, only have local ip run on same PVC. Kubernetes Cluster already connect to RDS using local ip.
Then, I build VPN server on bastion server. Have local ip and public ip, run on same PVC with RDS and Kubernetes cluster. So when need connect, I just start my vpn connection on my laptop.
Only vpn/bastion server have IP public. + Load balancer too.
I hope this will give you inspiration.