Technical notes. What I've learned by building.
Reach a private RDS instance from your laptop without a bastion EC2. SSM Session Manager port forwarding does it in one command.