A developer is migrating features from a legacy monolithic application to AWS Lambda. The Amazon Aurora DB cluster used by the application is within a VPC's private subnets. The Lambda functions must securely access this DB cluster without internet exposure. What configuration ensures this?