Pergunta de entrevista da empresa Boston Consulting Group

In an AWS architecture where a database instance is placed within a private subnet and protected by a security group, how can a developer securely connect to it from outside the VPC or from a different network segment?