I built a database bastion with no inbound ports. Is that actually secure?

I built a no-inbound SSM bastion to reach a private RDS, then asked whether closing the ports actually made it secure. The real surface is IAM, not the network.