Skip to content

RedshiftSQLHook: _get_conn_params mutates conn.login with IAM prefix, breaking subsequent get_conn() calls #64985

Description

@iancsg

Under which category would you file this issue?

Airflow Core

Apache Airflow version

3.0.6

What happened and how to reproduce it?

RedshiftSQLHook._get_conn_params() mutates conn.login in place when iam=True. After the first get_conn() call, conn.login is overwritten with the IAM:-prefixed username returned by GetClusterCredentials. Any subsequent get_conn() call on the same hook instance passes IAM:username back to GetClusterCredentials, which rejects the : as an invalid character.

What you think should happen instead?

_get_conn_params should use local variables instead of mutating conn.login:

login, password, port = self.get_iam_token(conn)                                                                                                        
conn_params["user"] = login                               
conn_params["password"] = password                                                                                                                      
conn_params["port"] = port
                                                                                                                                                        
This way the connection object remains clean for subsequent calls.

### Operating System

Amazon Linux 2 (MWAA)

### Deployment

Amazon (AWS) MWAA

### Apache Airflow Provider(s)

amazon

### Versions of Apache Airflow Providers

_No response_

### Official Helm Chart version

Not Applicable

### Kubernetes Version

_No response_

### Helm Chart configuration

_No response_

### Docker Image customizations

_No response_

### Anything else?

This occurs every time `get_conn()` is called more than once on the same hook instance with IAM auth. Common scenario: using `hook.get_records()`  followed by `hook.run()` inside an `@task` function. Most users don't hit this because operators create fresh hooks per execution.

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions