I've done a little digging but struggled to come up with a definitive answer, for RDS should/do the require any form of external access i.e outside of VPC for server updates, ntp etc?
Assuming it's not ingress but egress only i.e connections formed by RDS? My go-to is no but wanted to double check.