Connect on-premises app to RabbitMQ

Access to the RabbitMQ cluster from EC2 for applications in the VPC does not go out to the public Internet.
AWS service-to-service communication does not access the public Internet as described in the following document.

Q. Does traffic go over the internet when two instances communicate using public IP addresses, or when instances communicate with a public AWS service endpoint?

No. When using public IP addresses, all communication between instances and services hosted in AWS use AWS's private network. Packets that originate from the AWS network with a destination on the AWS network stay on the AWS global network, except traffic to or from AWS China Regions.

In addition, all data flowing across the AWS global network that interconnects our data centers and Regions is automatically encrypted at the physical layer before it leaves our secured facilities. Additional encryption layers exist as well; for example, all VPC cross-region peering traffic, and customer or service-to-service Transport Layer Security (TLS) connections.

https://aws.amazon.com/vpc/faqs/?nc1=h_ls