awsauth

func GenerateDBAuthToken ¶

func GenerateDBAuthToken(ctx context.Context, host, port, username, region string) (string, error)

GenerateDBAuthToken uses the AWS SDK to build a short-lived RDS IAM authentication token. Credentials are resolved via the standard SDK chain: environment variables, ~/.aws/credentials, EC2/ECS instance metadata, etc.

auth.BuildAuthToken has a bug (https://github.com/aws/aws-sdk-go-v2/issues/3365) where it produces a token without a "/" path component (host:port?Action=... instead of host:port/?Action=...). The SigV4 canonical URI is therefore "" instead of "/", which does not match what RDS expects, causing PAM authentication failure. We insert the missing slash after the fact.