All providers have some way or another to put managed databases behind a private IP so that it's only accessible from within a private network