diff --git a/pkg/controller/database/rdsinstance/rdsinstance.go b/pkg/controller/database/rdsinstance/rdsinstance.go
index 3028e0ef19..4dc7c7c2ff 100644
--- a/pkg/controller/database/rdsinstance/rdsinstance.go
+++ b/pkg/controller/database/rdsinstance/rdsinstance.go
@@ -275,19 +275,21 @@ func (e *external) Update(ctx context.Context, mg resource.Managed) (managed.Ext
 		return managed.ExternalUpdate{}, errors.Wrap(err, errPatchCreationFailed)
 	}
 	modify := rds.GenerateModifyDBInstanceInput(meta.GetExternalName(cr), patch, &rsp.DBInstances[0])
-	var conn managed.ConnectionDetails
+	conn := managed.ConnectionDetails{}
 
 	pwd, changed, err := rds.GetPassword(ctx, e.kube, cr.Spec.ForProvider.MasterPasswordSecretRef, cr.Spec.WriteConnectionSecretToReference)
 	if err != nil {
 		return managed.ExternalUpdate{}, err
 	}
 	if changed {
-		conn = managed.ConnectionDetails{
-			xpv1.ResourceCredentialsSecretPasswordKey: []byte(pwd),
-		}
+		conn[xpv1.ResourceCredentialsSecretPasswordKey] = []byte(pwd)
 		modify.MasterUserPassword = aws.String(pwd)
 	}
 
+	if cr.Spec.ForProvider.MasterUsername != nil {
+		conn[xpv1.ResourceCredentialsSecretUserKey] = []byte(aws.ToString(cr.Spec.ForProvider.MasterUsername))
+	}
+
 	if _, err = e.client.ModifyDBInstance(ctx, modify); err != nil {
 		return managed.ExternalUpdate{}, errorutils.Wrap(err, errModifyFailed)
 	}
diff --git a/pkg/controller/database/rdsinstance/rdsinstance_test.go b/pkg/controller/database/rdsinstance/rdsinstance_test.go
index fce4b36a91..6e211f403d 100644
--- a/pkg/controller/database/rdsinstance/rdsinstance_test.go
+++ b/pkg/controller/database/rdsinstance/rdsinstance_test.go
@@ -738,6 +738,9 @@ func TestUpdate(t *testing.T) {
 			},
 			want: want{
 				cr: instance(withTags(map[string]string{"foo": "bar"})),
+				result: managed.ExternalUpdate{
+					ConnectionDetails: managed.ConnectionDetails{},
+				},
 			},
 		},
 		"AutoscaleExcludeStorage": {
@@ -765,6 +768,9 @@ func TestUpdate(t *testing.T) {
 			},
 			want: want{
 				cr: instance(withMaxAllocatedStorage(100), withAllocatedStorage(20)),
+				result: managed.ExternalUpdate{
+					ConnectionDetails: managed.ConnectionDetails{},
+				},
 			},
 		},
 		"AWSManagedBackupRetentionTargetIgnore": {
@@ -796,6 +802,9 @@ func TestUpdate(t *testing.T) {
 			},
 			want: want{
 				cr: instance(withBackupRetentionPeriod(0), withStatusBackupRetentionPeriod(7), withPreferredBackupWindow("x")),
+				result: managed.ExternalUpdate{
+					ConnectionDetails: managed.ConnectionDetails{},
+				},
 			},
 		},
 		"AlreadyModifying": {
@@ -804,6 +813,35 @@ func TestUpdate(t *testing.T) {
 			},
 			want: want{
 				cr: instance(withDBInstanceStatus(v1beta1.RDSInstanceStateModifying)),
+				result: managed.ExternalUpdate{
+					ConnectionDetails: nil,
+				},
+			},
+		},
+		"AddMasterUsernameToConnectionDetails": {
+			args: args{
+				rds: &fake.MockRDSClient{
+					MockModify: func(ctx context.Context, input *awsrds.ModifyDBInstanceInput, opts []func(*awsrds.Options)) (*awsrds.ModifyDBInstanceOutput, error) {
+						return &awsrds.ModifyDBInstanceOutput{}, nil
+					},
+					MockDescribe: func(ctx context.Context, input *awsrds.DescribeDBInstancesInput, opts []func(*awsrds.Options)) (*awsrds.DescribeDBInstancesOutput, error) {
+						return &awsrds.DescribeDBInstancesOutput{
+							DBInstances: []awsrdstypes.DBInstance{{}},
+						}, nil
+					},
+					MockAddTags: func(ctx context.Context, input *awsrds.AddTagsToResourceInput, opts []func(*awsrds.Options)) (*awsrds.AddTagsToResourceOutput, error) {
+						return &awsrds.AddTagsToResourceOutput{}, nil
+					},
+				},
+				cr: instance(withMasterUsername(&masterUsername)),
+			},
+			want: want{
+				cr: instance(withMasterUsername(&masterUsername)),
+				result: managed.ExternalUpdate{
+					ConnectionDetails: managed.ConnectionDetails{
+						xpv1.ResourceCredentialsSecretUserKey: []byte(masterUsername),
+					},
+				},
 			},
 		},
 		"FailedDescribe": {