i already use the CNAME configuration
but it seems if i enable the proxy, it cannot reach the rds
it seems fine with DNS only, but the firewall rules wont apply
The Cloudflare proxy only works over certain ports and only forwards HTTP(S) traffic unless you opt for Cloudflare Spectrum (although to proxy pure port 3306 mysql traffic, you’d need the Enterprise plan version).
You really should point your web app directly to the RDS endpoint given to you by AWS - creating a subdomain on you domain only exposes and connects your database to your website.