Why are NACLs required for an RDS Proxy in the same subnet as the RDS db?

Hi!

I was able to resolve my issue, but I was wondering about this unexpected behavior.

So I set up an Aurora Postgres Serverless v2 database cluster and added an RDS Proxy in the same subnet (let's call this the "database subnet"). The connection between those two did not work with the NACL I had configured at the time, which allow inbound traffic from another subnet on port 5432 and outbound traffic back to the same subnet on the ephemeral ports (1024-65535).

To make the RDS Proxy work, I had to also add NACL rules that allowed inbound and outbound traffic to and from the database subnet on the ephemeral ports. I also verified that the traffic does not leave the VPC by adding the NACL rules for my vpc CIDR. The question now is - why? Aren't NACLs only applied for traffic that goes in and out of the subnet?