Not sure if it matches your use case, but we use the Pulumi Automation API for this. We have a stack that creates the database in a private subnet, along with a bastion host that is accessible via SSM in the public subnet. Then we establish a tunnel using SSM/the bastion host and run a second stack that uses that tunnel to connect to the database, using the PostgreSQL provider to create logical databases, etc.