Formalize bastion host access to DB

[mkysel]

If we need to perform surgery on the DB, we need to have access to it. The best solution for the private subnet DB is to use a bastion host. We need to discuss what access patterns and security we want to have to access the DB.
Once agreed, this needs to be implemented in TF.

[mkysel]

I will re-purpose this ticket to use a different approach