There should be an option to live migrate data via a private interface instead of public one. With VPC being peered, it would be a great option to avoid exposing database to the public interface (even if it's specific set of IPs). This can resolve concerns of many customers who are following or need to follow some short of compliance on their end.