I think I found a bug in the AWS API. If you check an RDS cluster's endpoints from the CLI - those DNS records don't exist. You need to add -cluster to the domain. I am going mad.