Q:

Connecting to AWS Aurora DB running in private subnet from 'outside world'

We have an Aurora DB cluster running in a private subnet, and want to allow read only access to clients originating from a fixed set of ips (our company ips). Our requirements are: 

The endpoint for DB read calls should be constant so that various ETL clients trying to read this data do not have to change their scripts repeatedly. 
We do not want to make the DB instances publicly accessible. 
The DB connections should use SSL. 

Could someone please direct me with the right steps? 

A:

There are 2 things you need to do:
1. Setting up a OpenVPN Server
Setup a OpenVPN server that allows clients to 'be inside' the VPC allowing access to any resources inside the VPC. The access can be further restricted by implementing Network ACLs / Security Groups. You can set up a OpenVPN server by following the tutorial here. After setting up the server, the clients will have to log in to the VPN using the credentials you provide.
2. Setting up a User on AuroraDB with Read-Only Permissions
In order for clients to access the AuroraDB cluster from the private subnet (after logging in to VPN of course), you'll need to create a database user with read-only permissions to the DB. If you would like, you can further restrict the user to access only a specific set of tables in your DB.

Once these two are implemented, your clients will be able to access
  the database in read only mode from inside the private subnet.

