Skip to content

RedshiftSQLHook: _get_conn_params mutates conn.login with IAM prefix, breaking subsequent get_conn() calls #64985

Description

@iancsg

Under which category would you file this issue?

Airflow Core

Apache Airflow version

3.0.6

What happened and how to reproduce it?

RedshiftSQLHook._get_conn_params() mutates conn.login in place when iam=True. After the first get_conn() call, conn.login is overwritten with the IAM:-prefixed username returned by GetClusterCredentials. Any subsequent get_conn() call on the same hook instance passes IAM:username back to GetClusterCredentials, which rejects the : as an invalid character.

What you think should happen instead?

_get_conn_params should use local variables instead of mutating conn.login:

login, password, port = self.get_iam_token(conn)                                                                                                        
conn_params["user"] = login                               
conn_params["password"] = password                                                                                                                      
conn_params["port"] = port
                                                                                                                                                        
This way the connection object remains clean for subsequent calls.

### Operating System

Amazon Linux 2 (MWAA)

### Deployment

Amazon (AWS) MWAA

### Apache Airflow Provider(s)

amazon

### Versions of Apache Airflow Providers

_No response_

### Official Helm Chart version

Not Applicable

### Kubernetes Version

_No response_

### Helm Chart configuration

_No response_

### Docker Image customizations

_No response_

### Anything else?

This occurs every time `get_conn()` is called more than once on the same hook instance with IAM auth. Common scenario: using `hook.get_records()`  followed by `hook.run()` inside an `@task` function. Most users don't hit this because operators create fresh hooks per execution.

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions