We briefly explored private link / vpc endpoints, but it required extensive changes to our architecture so we decided to not pursue it.