In AWS, if I have an RDS in a subnet that has had it's public accessibility feature turned off, do I need to worry about making its subnet private? If so, how would I go about making the subnet private? (assuming it was public beforehand)
The Publicly Accessible flag on an Amazon RDS database determines whether its DNS Name can be resolved outside of the VPC.
By setting Publicly Accessible = No
, the database is unreachable from the Internet. However, if you wish to keep the database private, it is also advisable to modify the Security Group associated with the Amazon RDS instance to only permit access from the VPC or, preferably, only from the resources that need to access the database.
A further level of security can be obtained by putting the Amazon RDS database in a private subnet. This is an additional layer of security. It is not necessary to keep your database private (the above two methods are already doing that), but networking and security professionals like to keep most resources in a private subnet, and the only resources they put in a public subnet will be those that need to be accessible from the Internet (eg a Load Balancer or maybe a web server).
So, the choice is yours... you do not need to move it to a private subnet. It depends on your corporate security policies. But, at a minimum, do make sure it is locked-down via the Security Group.