How is that a “hack”? You create your DB and you get a connection string to a publicly accessible database or you create it inside a VPC and you configure your lambda to run inside a subnet within your VPC and you configure your security group. This can all be configured within the console.

The main issue with this approach is that running your lambda in a VPC results in painfully slow cold starts, on AWS at least.

IDK why the parent mentioned VPC. It's not necessary.

Without a VPC, how do you not expose your Aurora cluster to the world?

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Auror...

Aurora DB clusters must be created in an Amazon Virtual Private Cloud (VPC). To control which devices and Amazon EC2 instances can open connections to the endpoint and port of the DB instance for Aurora DB clusters in a VPC, you use a VPC security group. These endpoint and port connections can be made using Secure Sockets Layer (SSL). In addition, firewall rules at your company can control whether devices running at your company can open connections to a DB instance. For more information on VPCs, see Amazon Virtual Private Cloud (VPCs) and Amazon RDS.