I have web application which dynamically deployed on EC2 instances (scalable). Also I have RDS mysql instance which dynamically created by python with boto3. Now port 3306 of RDS is public, but I want to allow connection only from my EC2's from specific VPC. Can I create RDS on specific VPC (same one with EC2 instances)? What is best practice to create such set EC2 + RDS ?
It is certainly best practice to have your Amazon EC2 instances in the same VPC as the Amazon RDS database. Recommended security is:

Create a Security Group for your web application EC2 instances (Web-SG)
Launch your Amazon RDS instance in a private subnet in the same VPC
Configure the Security Group on the RDS instance to allow incoming MySQL (3306) traffic from the Web-SG security group

If your RDS instance is currently in a different VPC, you can take a snapshot and then create a new database from the snapshot.
If you are using an Elastic Load Balancer, you could even put your Amazon EC2 instances in a private subnet since all access will be via the Load Balancer.
Create AWS RDS on specific VPC