[Bug]: aws_db_proxy_endpoint external-name template is reversed, wedging every ProxyEndpoint after creation

[itayvolo]

What happened?

The external-name template for aws_db_proxy_endpoint is reversed relative to the ID Terraform actually
produces. As a result, every ProxyEndpoint has its crossplane.io/external-name silently overwritten with
the proxy's name as soon as creation completes, after which the resource can never reconcile again:

refuse to update the external resource because the following update requires replacing it:
cannot change the value of the argument "db_proxy_endpoint_name"
from "my-proxy-read-only" to "my-proxy"

The endpoint exists and is healthy in AWS, and the MR reports Ready=True, so the breakage is quiet — it
shows up only as a permanently Synced=False resource.

Root cause

config/externalname.go (unchanged from at least v2.5.0 through main):

// DB proxy endpoints can be imported using the DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME
"aws_db_proxy_endpoint": config.TemplatedStringAsIdentifier(
    "db_proxy_endpoint_name", "{{ .external_name }}/{{ .parameters.db_proxy_name }}"),

The comment is correct and the template contradicts it. Per the
AWS provider docs,
the ID is DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME — proxy first. The template emits external_name first.

Because TemplatedStringAsIdentifier reuses the same template to recover the external name,
.external_name sitting at index 0 with / to its right selects this branch of
GetExternalNameFromTemplated:

// {{ .external_name }}/someother
case leftSeparator == "" && rightSeparator != "":
    return strings.Split(val, rightSeparator)[0], nil

so Split("my-proxy/my-proxy-read-only", "/")[0] returns my-proxy — the proxy, not the endpoint.

The same reversal breaks import in the other direction: GetIDFn builds endpoint/proxy, which is not a
valid import ID for this resource.

The docs example is example/example, where proxy and endpoint share a name — the one case in which the
reversal is invisible.

How can we reproduce it?

apiVersion: rds.aws.m.upbound.io/v1beta1
kind: ProxyEndpoint
metadata:
  name: my-proxy-read-only
  annotations:
    crossplane.io/external-name: my-proxy-read-only
spec:
  forProvider:
    region: us-west-2
    dbProxyName: my-proxy
    targetRole: READ_ONLY
    vpcSubnetIds: [subnet-a, subnet-b]

The endpoint is created correctly. Once it reaches available:

$ kubectl get proxyendpoint my-proxy-read-only \
    -o jsonpath='{.metadata.annotations.crossplane\.io/external-name}{"\n"}{.status.atProvider.id}'
my-proxy
my-proxy/my-proxy-read-only

The annotation now holds the proxy name while the ID confirms the real order, and Synced goes to False
permanently.

Reproduced on two independent endpoints; both started with the correct annotation and flipped on
completion.

Suggested fix

Swap the template to match the documented ID:

"aws_db_proxy_endpoint": config.TemplatedStringAsIdentifier(
    "db_proxy_endpoint_name", "{{ .parameters.db_proxy_name }}/{{ .external_name }}"),

That form lands in the leftSeparator != "" && rightSeparator == "" branch, which returns the last
segment — the endpoint name — and makes GetIDFn produce a valid import ID.

Note this will change the external name of resources already reconciled with the current template, so it
likely warrants a release note.

What environment did it happen in?

• provider-aws-rds v2.5.0 (namespaced API, rds.aws.m.upbound.io/v1beta1)
• Neither config/cluster/rds/config.go nor config/namespaced/rds/config.go overrides the external name
  for this resource; both only set UseAsync = true

[itayvolo]

Reproduced with a standalone managed resource — no Composition, no XR, nothing but a plain ProxyEndpoint
applied against an existing proxy. This rules out composition-side annotation handling as a cause.

apiVersion: rds.aws.m.upbound.io/v1beta1
kind: ProxyEndpoint
metadata:
  name: my-proxy-rotest
  namespace: crossplane-system
  annotations:
    crossplane.io/external-name: my-proxy-rotest
spec:
  forProvider:
    region: us-west-2
    dbProxyName: my-proxy
    targetRole: READ_ONLY
    vpcSubnetIds: [subnet-a, subnet-b, subnet-c]
    vpcSecurityGroupIds: [sg-x]
  providerConfigRef:
    kind: ProviderConfig
    name: aws-default

Polling the annotation, the provider-reported ID and Synced while it creates:

07  ext=my-proxy-rotest  synced=True   aws=creating    id=<none>
08  ext=my-proxy         synced=False  aws=available   id=my-proxy/my-proxy-rotest

The external name is correct for the whole creating phase and is overwritten the moment the first
observation succeeds — consistent with GetExternalNameFn running against the real Terraform ID. Every
reconcile after that fails:

update failed: async update failed: refuse to update the external resource because the following
update requires replacing it: cannot change the value of the argument "db_proxy_endpoint_name"
from "my-proxy-rotest" to "my-proxy"

Note the ID in that output is my-proxy/my-proxy-rotest, i.e. proxy first, which is what the AWS
provider sets and what the // DB proxy endpoints can be imported using the DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME comment above the entry says. The template declares
{{ .external_name }}/{{ .parameters.db_proxy_name }}, so the reverse parse takes
strings.Split(id, "/")[0] and returns the proxy.

The resource is left Ready=True while Synced=False, so unless something is watching sync conditions
this fails silently — the endpoint exists and works in AWS, it just can never be reconciled again.

Also worth noting for whoever picks this up: the resource deletes cleanly despite the corrupted external
name, since deletion uses the ID from state rather than rebuilding it from the annotation. So the blast
radius is "permanently unreconcilable", not "unremovable".

Environment: provider-aws-rds v2.5.0, namespaced API. Same behaviour is expected on the cluster-scoped
API, since config/externalname.go is the only external-name map in the repo and the per-resource
configurators in both config/cluster/rds/config.go and config/namespaced/rds/config.go only set
UseAsync.