From 6599c63389a8e742174433878353a0cfc6bbd05c Mon Sep 17 00:00:00 2001
From: MangoMaker <charanvfxartist@gmail.com>
Date: Sat, 28 Mar 2026 00:05:15 +0530
Subject: [PATCH] fix(feature/rds/auth): include trailing slash in
 BuildAuthToken URL

BuildAuthToken generates a token missing the '/' path separator between
host:port and the query string (host:5432?Action=...), causing PAM
authentication failures on Aurora Express Configuration clusters.

This aligns the SDK output with the AWS CLI (aws rds generate-db-auth-token)
which produces host:5432/?Action=...

Fixes #3365
---
 feature/rds/auth/connect.go      |  1 +
 feature/rds/auth/connect_test.go | 38 ++++++++++++++++++++++++++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/feature/rds/auth/connect.go b/feature/rds/auth/connect.go
index 4169095070e6..164a08444da9 100644
--- a/feature/rds/auth/connect.go
+++ b/feature/rds/auth/connect.go
@@ -69,6 +69,7 @@ func BuildAuthToken(ctx context.Context, endpoint, region, dbUser string, creds
 	if err != nil {
 		return "", err
 	}
+	req.URL.Path = "/"
 	values := req.URL.Query()
 	values.Set("Action", "connect")
 	values.Set("DBUser", dbUser)
diff --git a/feature/rds/auth/connect_test.go b/feature/rds/auth/connect_test.go
index 7ccb2332f869..02e007b3b653 100644
--- a/feature/rds/auth/connect_test.go
+++ b/feature/rds/auth/connect_test.go
@@ -22,13 +22,13 @@ func TestBuildAuthToken(t *testing.T) {
 			endpoint:      "https://prod-instance.us-east-1.rds.amazonaws.com:3306",
 			region:        "us-west-2",
 			user:          "mysqlUser",
-			expectedRegex: `^prod-instance\.us-east-1\.rds\.amazonaws\.com:3306\?Action=connect.*?DBUser=mysqlUser.*`,
+			expectedRegex: `^prod-instance\.us-east-1\.rds\.amazonaws\.com:3306/\?Action=connect.*?DBUser=mysqlUser.*`,
 		},
 		{
 			endpoint:      "prod-instance.us-east-1.rds.amazonaws.com:3306",
 			region:        "us-west-2",
 			user:          "mysqlUser",
-			expectedRegex: `^prod-instance\.us-east-1\.rds\.amazonaws\.com:3306\?Action=connect.*?DBUser=mysqlUser.*`,
+			expectedRegex: `^prod-instance\.us-east-1\.rds\.amazonaws\.com:3306/\?Action=connect.*?DBUser=mysqlUser.*`,
 		},
 		{
 			endpoint:      "prod-instance.us-east-1.rds.amazonaws.com",
@@ -67,6 +67,40 @@ func TestBuildAuthToken(t *testing.T) {
 	}
 }
 
+func TestBuildAuthTokenPath(t *testing.T) {
+	cases := []struct {
+		name     string
+		endpoint string
+	}{
+		{
+			name:     "endpoint without scheme",
+			endpoint: "prod-instance.us-east-1.rds.amazonaws.com:3306",
+		},
+		{
+			name:     "endpoint with https scheme",
+			endpoint: "https://prod-instance.us-east-1.rds.amazonaws.com:3306",
+		},
+		{
+			name:     "postgresql default port",
+			endpoint: "aurora-cluster.cluster-xxx.us-east-1.rds.amazonaws.com:5432",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			creds := &staticCredentials{AccessKey: "AKID", SecretKey: "SECRET", Session: "SESSION"}
+			token, err := auth.BuildAuthToken(context.Background(), c.endpoint, "us-east-1", "dbUser", creds)
+			if err != nil {
+				t.Fatalf("expect no err, got: %v", err)
+			}
+
+			if !strings.Contains(token, "/?") {
+				t.Errorf("expect token to contain '/?' path separator, got: %s", token)
+			}
+		})
+	}
+}
+
 type staticCredentials struct {
 	AccessKey, SecretKey, Session string
 }