data "external" "rds_auth_token" {
  program = [
    "bash", "-c", replace(
      <<-EOF
        aws rds generate-db-auth-token
          --hostname  ${module.cluster_endpoint}
          --port      ${module.cluster_port}
          --region    ${replace(aws_db_instance.database.availability_zone, "/[[:lower:]]$/", "")}
          --username  ${aws_db_instance.database.username}
          --profile   my-aws-profile
        | jq --raw-input '{ password: . }'
      EOF
    , "\n", " ")
  ]
}