requirements for configuring access to ec2 and rds instances in AWS

Question

I have 2 EC2 instances (application and bastion) and one rds instance (database) in AWS. I want my RDS to only be accessible through the bastion (for when I as an admin want to