Create a now route table that excludes the route to the public subnets' CIDR blocks. Associate the route table to the database subnets.

Create a security group that denies ingress from the security group used by instances in the public subnets. Attach the security group to an Amazon RDS DB instance.

Create a security group that allows ingress from the security group used by instances in the private subnets. Attach the security group to an Amazon RDS DB instance.

Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.