Migrate to PRIVATE_WITH_EGRESS

PRIVATE_WITH_NAT is deprecated. Note that PRIVATE_WITH_EGRESS defaults to the same behaviour as PRIVATE_WITH_NAT, but has the option to set natGateways to 0.

If we are confident that our subnet will never need to make requests to the internet, we can opt to use PRIVATE_ISOLATED instead.

cdk/lib/index.ts

@@ -303,7 +303,7 @@ EOF
     const ruleDB = new GuDatabaseInstance(this, "RuleManagerRDS", {
       app: dbAppName,
       vpc: ruleManagerApp.vpc,
-      vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_NAT },
+      vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
       allocatedStorage: 50,
       allowMajorVersionUpgrade: false,
       autoMinorVersionUpgrade: true,