Firewall – limit outbound access for an EC2 instance

Instead of whitelisting S3 traffic at the NAT instance, I suggest you configure VPC endpoints for S3:

• New – VPC Endpoint for Amazon S3 (AWS Blog)
• AWS VPC User Guide: VPC Endpoints

That way, your EC2 nodes can access S3 directly on the VPC private network instead of going through the NAT.

If you still want a list of IPs used by S3, you can use the AWS CLI command describe-prefix-lists:

aws ec2 describe-prefix-lists

which will give an output like

{
    "PrefixLists": [
        {
            "PrefixListName": "com.amazonaws.eu-west-1.s3", 
            "Cidrs": [
                "54.231.128.0/19"
            ], 
            "PrefixListId": "pl-6da54004"
        }
    ]
}

The list is for the region used by AWS CLI. My sample shows the current output for eu-west-1, You can specify a different region by passing the --region parameter, e.g. aws --region us-east-1 ec2 describe-prefix-lists.

However, please note that the IP range for a service may change from time to time.

If your VPC EC2 instances are in private subnets, then to access EC2-Classic, your VPC will need a NAT. Give your NAT an elastic IP address so it's a constant public IP address.

Then in your RDS security group, allow access only for that Elastic IP address.

If your VPC EC2 instances are in public subnets, then you could give each of them elastic IP addresses and allow access to only those IP addresses in your RDS security group. This is more difficult if they are part of auto-scaling groups.