Generally speaking, it is recommended that the application (web) connect to the database through the intranet, which is safer. If you want to access the public network, you need to configure security groups and open port 3306 for external specific ip. If there is no fixed ip address, it is still recommended to find a fortress machine (with a fixed ip) to access.