The current definition of PgErrorText prevents re-authentication when using awsrds.
The authentication error when using awsrds is as follows:
... PAM authentication failed for user ...
Since PgErrorText is currently password authentication failed for user, it fails to match in the AuthError handler.
Changing PgErrorText to authentication failed for user appears to allow it to function as expected.
I've tested this locally by overriding PostgreSQLAuthError before creating a store or connector: e.g.
driver.PostgreSQLAuthError = func(e error) bool {
return strings.Contains(strings.ToLower(e.Error()), "authentication failed for user") || errors.Is(e, sqldriver.ErrBadConn)
}