Has anyone ever encountered a situation where you have a hosted build server like travis ci, or codeship or circle ci, etc that needs to access an RDS instance located in a private subnet? If so how did you handle the access disconnect..created a bastion host and a tunnel on said bastion host or is this an anti-pattern?