Exclude public subnet routes in a new route table for database subnets.

Attach a security group to DB instances that blocks traffic from the public subnet's security group.

Attach a security group to DB instances that permits traffic from the private subnet's security group.

Establish peering connections: one between public and private subnets, another between private and database subnets.