Connection timed out on new AWS RDS instances - can connect to older, almost identical RDS with no issue

The problem here ended up being the default RDS Subnet Group (different from the VPC Subnet you typically use, most likely) auto-added both private and public IP blocks.

For my first RDS, it just so happened to get assigned a publicly accessible IP block (still a 10.x, but access from the public) -- my second RDS instance got a private one (so my apps in EC2 could connect, but I couldn't from outside the VPC). We've created a new RDS Subnet containing only private-access IP blocks, and will use ssh tunneling to administer the instances as needed, since publicly accessible DBs tend to not go so well..