These days if you have low traffic you can run everything on one box, but separating them is more "best practice," so if you've already done that, congratulations! The database should not be on a public network or have a public IP address, so that only the REST app can reach it. (In fact if it were all on a single box, you'd want the db to bind only to 127.0.0.1.) Assuming the web pages will contact the REST app via…
Thanks for the help! I definitely was confusing VPN with Shared Private Networking and VPC. Just started to read up on the AWS VPC and this is exactly was I needed!