TIL stupid @awscloud things: 1) multi-az rds failover changes IP under CNAME endpoint instead of doing an EIP-like replacement. Ugh.