It's also good practice to disallow all public traffic to your db instances on your firewall. AWS's security groups make this really easy to manage.