The hosts in private subnet can get access to internet by using a network address translation (NAT) gateway that resides in the public subnet. Your bastion host can connect to the internet for software updates using the NAT gateway, but the internet cannot establish connections to the bastion host. So, its up to you if you want your bastion host in the same subnet where your database server is or in a private subnet.
If you only want the bastion server to connect to SSM, you can configure VPC Endpoints for Instances with no Internet access.
If you are only concerned with patches, you could do this:
Then you don't need the NAT Gateway, public subnet, or Internet Gateway.
Placing a Bastion in a Private Isolated Subnet
Connecting Managed Grafana to Aurora PostgreSQL RDS database on a private subnetasked 22 days ago
CDK: Moving Bastion Host to Isolated Network
moving rds aurora serverless from Public subnet to private subnet within same VPCasked 4 months ago
Connect Lightsail instance to AWS instance in a private subnetasked 5 months ago
Connect to RDS using SSMAccepted Answerasked 2 years ago
Accessing RDS in Private Isolated VPC using IAM Authentication
Bastion Host (Public Subnet) unable to reach RDS (Private Subnet) in my VPCasked 2 years ago
Connecting to Aurora PostgreSQL RDS database on a private subnet using RDS Proxyasked a month ago
Is it possible to create RDS replica in public subnet while master db is in private?asked 3 months ago