Take it a step further. Set up a locked down bastion server that can only be reached from your IP address, and disable all access to your DB from anything but your application and the bastion server. Then tunnel your local queries through your bastion server.

  ssh -fNg -L 3306:my-secure-db.com:3306 user@bastion-server.com