RDS Proxy for PostgreSQL incorrectly targets port 3306 instead of 5432 in ap-southeast-1

[chowpin-tan-ivp]

Describe the bug

When creating an RDS Proxy with EngineFamily: POSTGRESQL for an Aurora PostgreSQL cluster,
the proxy target group incorrectly attempts to connect to the database on port 3306 (MySQL)
instead of port 5432 (PostgreSQL).

This occurs in the ap-southeast-1 region with both:

• CloudFormation AWS::RDS::DBProxy resources
• Manual proxy creation via AWS Console

The target group remains in UNAVAILABLE state with reason "PENDING_PROXY_CAPACITY" and
never successfully connects to the Aurora PostgreSQL cluster.

Verification command shows wrong port:
aws rds describe-db-proxy-targets --db-proxy-name pg-db-prod-proxy

Output shows:
"Port": 3306 (should be 5432 for PostgreSQL)

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

When creating an RDS Proxy with EngineFamily: POSTGRESQL for an Aurora PostgreSQL cluster:

1. Target group should connect to Aurora on port 5432 (PostgreSQL default port)
2. Target group should reach AVAILABLE state within 10-15 minutes
3. Proxy endpoint should successfully accept client connections
4. Command aws rds describe-db-proxy-targets --db-proxy-name <proxy-name> should show:
   "Port": 5432

Current Behavior

When creating an RDS Proxy with EngineFamily: POSTGRESQL for an Aurora PostgreSQL cluster:

1. Target group attempts to connect to Aurora on port 3306 (MySQL port)
2. Target group remains stuck in UNAVAILABLE state with reason "PENDING_PROXY_CAPACITY"
3. CloudFormation deployment times out after 2+ hours
4. Command aws rds describe-db-proxy-targets --db-proxy-name <proxy-name> shows:
   "Port": 3306

This occurs in ap-southeast-1 region with both CloudFormation and manual creation.

aws rds describe-db-proxy-targets --db-proxy-name <proxy_name>

Example output:
{
"Targets": [
{
"RdsResourceId": "pg-db-prod",
"Port": 3306,
"Type": "TRACKED_CLUSTER"
},
{
"Endpoint": "pg-db-prod-instance-1.abcxyz-southeast-1.rds.amazonaws.com",
"TrackedClusterId": "pg-db-prod",
"RdsResourceId": "pg-db-prod-instance-1",
"Port": 3306,
"Type": "RDS_INSTANCE",
"Role": "UNKNOWN",
"TargetHealth": {
"State": "UNAVAILABLE",
"Reason": "PENDING_PROXY_CAPACITY",
"Description": "DBProxy Target is waiting for proxy to scale to desired capacity"
}
}
]
}

Reproduction Steps

1. Create Aurora PostgreSQL cluster (engine: aurora-postgresql)
2. Create RDS Proxy with EngineFamily: POSTGRESQL
3. Create DBProxyTargetGroup pointing to the Aurora cluster
4. Run: aws rds describe-db-proxy-targets --db-proxy-name
5. Observe: Port shows 3306 instead of 5432
6. Result: Target group stuck in UNAVAILABLE state

Possible Solution

No response

Additional Information/Context

No response

CLI version used

aws-cli/2.31.0 Python/3.13.7 Darwin/25.1.0 source/arm64

Environment details (OS name and version, etc.)

OS: macOS M2 Pro Tahoe 26.1

[adev-code]

Hello @chowpin-tan-ivp, thank you for reaching out. I have tried to replicate and did not get the issue. The port that my RDS Proxy for PostgreSQL is using 5432 port. These are the steps that I have tried:

1. Check for existing clusters - aws rds describe-db-clusters
2. Create Aurora PostgreSQL cluster - aws rds create-db-cluster
3. Create DB instance in cluster - aws rds create-db-instance
4. Create Secrets Manager secret - aws secretsmanager create-secret
5. Create IAM role - aws iam create-role
6. Attach policy to IAM role - aws iam put-role-policy
7. Create RDS Proxy - aws rds create-db-proxy
8. Register proxy targets - aws rds register-db-proxy-targets
9. Describe proxy targets - aws rds describe-db-proxy-targets

My output:

{
    "Targets": [
        {
            "RdsResourceId": "[REDACTED]",
            "Port": 5432,
            "Type": "TRACKED_CLUSTER"
        },
        {
            "Endpoint": "[REDACTED].ap-southeast-1.rds.amazonaws.com",
            "TrackedClusterId": "[REDACTED]",
            "RdsResourceId": "[REDACTED]",
            "Port": 5432,
            "Type": "RDS_INSTANCE",
        }
    ]
}

That being said, could you please provide the full --debug logs and please redact any sensitive and security information.

[chowpin-tan-ivp]

hi @adev-code

thanks, I retest again with cloudformation today

rdsProxy:
    Type: AWS::RDS::DBProxy
    Condition: CreateRdsProxy
    DependsOn:
      - rdsInstance
    Properties:
      DBProxyName:
        Fn::Sub: "${databaseName}-proxy"
      EngineFamily: POSTGRESQL
      Auth:
        [REDACTED]
      RoleArn:
        Fn::GetAtt: rdsProxyRole.Arn
      VpcSubnetIds:
        [REDACTED]
      VpcSecurityGroupIds:
        - Ref: rdsProxySecurityGroup
      IdleClientTimeout: 1800
      MaxConnectionsPercent: 100
      DebugLogging: true
      Tags:
        - Key: Name
          Value:
            Fn::Sub: "${databaseName}-proxy"

and rds proxy is created successfully

{
    "Targets": [
        {
            "Endpoint": "[REDACTED].ap-southeast-1.rds.amazonaws.com",
            "RdsResourceId": "[REDACTED]",
            "Port": 5432,
            "Type": "RDS_INSTANCE",
            "Role": "READ_WRITE",
            "TargetHealth": {
                "State": "AVAILABLE"
            }
        }
    ]
}

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.