Run one-off SQL on a private RDS via a throwaway Fargate task

When the database is private and there is no bastion, register a temporary ECS task definition that reuses the app image (it already has the DB driver), inject the connection string through the task definition secrets block from Secrets Manager, pass the script as the container command, run it in the service subnets/security groups, then read its CloudWatch log stream and deregister. Use a short-lived execution role scoped to just that secret and delete it afterwards. Never pass passwords via command overrides or env overrides: RunTask parameters land in CloudTrail.