I've used RDS for the DB. My cluster has server running as a service with service discovery open to all other services in the same cluster. Work pools and agents run as separate services within the cluster with access to the server through the mapped dns. You can serve it out to internal or external with an application load balancer and cloud front with WAF enabled. I'd you need external access to API, consider routing API Gateway as a proxy that forwards requests to the Prefect server