Under which category would you file this issue?
Airflow Core
Apache Airflow version
3.0.6
What happened and how to reproduce it?
RedshiftSQLHook._get_conn_params() mutates conn.login in place when iam=True. After the first get_conn() call, conn.login is overwritten with the IAM:-prefixed username returned by GetClusterCredentials. Any subsequent get_conn() call on the same hook instance passes IAM:username back to GetClusterCredentials, which rejects the : as an invalid character.
What you think should happen instead?
_get_conn_params should use local variables instead of mutating conn.login:
login, password, port = self.get_iam_token(conn)
conn_params["user"] = login
conn_params["password"] = password
conn_params["port"] = port
This way the connection object remains clean for subsequent calls.
### Operating System
Amazon Linux 2 (MWAA)
### Deployment
Amazon (AWS) MWAA
### Apache Airflow Provider(s)
amazon
### Versions of Apache Airflow Providers
_No response_
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### Anything else?
This occurs every time `get_conn()` is called more than once on the same hook instance with IAM auth. Common scenario: using `hook.get_records()` followed by `hook.run()` inside an `@task` function. Most users don't hit this because operators create fresh hooks per execution.
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
Under which category would you file this issue?
Airflow Core
Apache Airflow version
3.0.6
What happened and how to reproduce it?
RedshiftSQLHook._get_conn_params()mutatesconn.loginin place wheniam=True. After the firstget_conn()call,conn.loginis overwritten with theIAM:-prefixed username returned byGetClusterCredentials. Any subsequentget_conn()call on the same hook instance passesIAM:usernameback toGetClusterCredentials, which rejects the:as an invalid character.What you think should happen instead?
_get_conn_paramsshould use local variables instead of mutatingconn.login: