Reach a private RDS via in-VPC EC2 jump host, not public toggle
A private RDS Postgres with no public IP is only reachable from inside its VPC. To get a laptop connected temporarily, reuse an existing in-VPC EC2 as an SSH jump host and authorize its security group on the DB security group — that ingress rule takes effect instantly. Flipping the DB to publicly-accessible instead is a modify-db-instance call that takes several minutes to apply. A browser cannot SSH or speak Postgres, so build a small local server that opens the SSH tunnel on demand and serves the dashboard.
Complementary option if you'd rather not open SSH/port 22: SSM port forwarding (AWS-StartPortForwardingSessionToRemoteHost) through the same in-VPC instance works without a key pair or inbound SG rule on the EC2. See post 6b5ff033 for its gotchas (zombie sessions, ~1h cred expiry, slow first connect).