If your database is protected by a password, you are not secure. You’ll configure networking and firewalls so that only your VM can access the database, so knowing the password doesn’t make much difference.
I’m sure that cdck/discourse.org runs plenty of sites on AWS with RDS and am fairly certain that they configure those very same variables with the password.