> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Redshift Clusters Should Be Encrypted

### More Info:

Database encryption should be enabled for AWS Redshift clusters to protect your data at rest.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Redshift clusters not being encrypted in AWS, follow these steps using the AWS Management Console:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to your AWS account.

        2. **Navigate to Amazon Redshift**: Click on the "Services" dropdown menu at the top of the page, and then select "Redshift" under the Analytics section.

        3. **Select the Redshift Cluster**: In the Redshift dashboard, select the Redshift cluster that you want to encrypt.

        4. **Enable Encryption**: Click on the cluster identifier to access the cluster details. In the cluster details page, click on the "Modify" button.

        5. **Enable Encryption**: In the Modify Cluster window, scroll down to the "Encryption" section.

        6. **Choose Encryption**: Select the option for "Enable" under the Encryption tab.

        7. **Select KMS Key**: Choose the KMS key that you want to use for encrypting the Redshift cluster. If you do not have a KMS key, you can create one by clicking on the "Create a new key" link.

        8. **Save Changes**: Review the other configurations if needed and then click on the "Modify cluster" button to save the changes.

        9. **Monitor Encryption Progress**: Once the modification is initiated, monitor the progress in the Redshift console. The cluster will undergo maintenance during this process.

        10. **Verification**: After the modification is completed, verify that the Redshift cluster is now encrypted by checking the Encryption column in the cluster details.

        By following these steps, you can successfully remediate the misconfiguration of Redshift clusters not being encrypted in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of unencrypted Redshift clusters in AWS using AWS CLI, follow these steps:

        Step 1: List all the existing Redshift clusters to identify the unencrypted clusters by running the following command:

        ```
        aws redshift describe-clusters
        ```

        Step 2: Identify the unencrypted Redshift clusters from the output of the above command.

        Step 3: For each unencrypted Redshift cluster identified, modify the cluster to enable encryption by running the following command:

        ```
        aws redshift modify-cluster --cluster-identifier YOUR_CLUSTER_IDENTIFIER --encrypted
        ```

        Replace `YOUR_CLUSTER_IDENTIFIER` with the identifier of the unencrypted Redshift cluster.

        Step 4: Verify that the encryption is enabled for the cluster by running the following command:

        ```
        aws redshift describe-clusters --cluster-identifier YOUR_CLUSTER_IDENTIFIER
        ```

        Replace `YOUR_CLUSTER_IDENTIFIER` with the identifier of the cluster and ensure that the `Encrypted` field is set to `true`.

        Step 5: Repeat the above steps for each unencrypted Redshift cluster in your AWS account to ensure all Redshift clusters are encrypted.

        By following these steps, you can remediate the misconfiguration of unencrypted Redshift clusters in AWS using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of unencrypted Redshift clusters in AWS, you can use the AWS SDK for Python (Boto3) to enable encryption for the Redshift clusters. Here are the step-by-step instructions on how to remediate this issue:

        1. Install Boto3: If you haven't already installed the Boto3 library, you can do so using pip:

        ```bash theme={null}
        pip install boto3
        ```

        2. Configure AWS Credentials: Make sure you have your AWS credentials configured either by setting environment variables or using AWS CLI `aws configure`.

        3. Use the following Python script to enable encryption for Redshift clusters:

        ```python theme={null}
        import boto3

        def enable_redshift_encryption(cluster_identifier):
            # Create a Redshift client
            redshift_client = boto3.client('redshift')

            # Enable encryption for the Redshift cluster
            response = redshift_client.modify_cluster(
                ClusterIdentifier=cluster_identifier,
                Encrypted=True,
                ApplyImmediately=True
            )

            print(f"Encryption enabled for Redshift cluster {cluster_identifier}")

        # Specify the identifier of the Redshift cluster you want to remediate
        cluster_identifier = 'your-redshift-cluster-identifier'

        # Call the function to enable encryption for the Redshift cluster
        enable_redshift_encryption(cluster_identifier)
        ```

        4. Replace `'your-redshift-cluster-identifier'` with the actual identifier of the Redshift cluster that you want to enable encryption for.

        5. Run the Python script. This will enable encryption for the specified Redshift cluster.

        After following these steps, the Redshift cluster specified in the script will have encryption enabled, thereby remediating the misconfiguration of unencrypted Redshift clusters in AWS.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # 1. Take a manual snapshot of the existing (unencrypted) cluster.
        #    SUBSTITUTE:
        #      - EXISTING_CLUSTER_ID with the current unencrypted cluster identifier
        #      - PRE_ENCRYPTION_SNAPSHOT_ID with a unique snapshot ID (e.g., "mycluster-pre-encryption-snapshot")
        resource "aws_redshift_snapshot" "pre_encryption" {
          cluster_identifier = "EXISTING_CLUSTER_ID"
          snapshot_identifier = "PRE_ENCRYPTION_SNAPSHOT_ID"
        }

        # 2. Create a NEW encrypted cluster from that snapshot.
        #    This mirrors `restore-from-cluster-snapshot --encrypted [--kms-key-id ...]`.
        #    SUBSTITUTE:
        #      - ENCRYPTED_CLUSTER_ID with the new cluster identifier (e.g., "EXISTING_CLUSTER_ID-encrypted")
        #      - NODE_TYPE, MASTER_USERNAME, MASTER_PASSWORD, CLUSTER_SUBNET_GROUP_NAME,
        #        VPC_SECURITY_GROUP_IDS, CLUSTER_PARAMETER_GROUP_NAME, NUMBER_OF_NODES, etc.
        #      - OPTIONAL_KMS_KEY_ARN with your CMK ARN if you don't want the default AWS-managed key
        resource "aws_redshift_cluster" "encrypted" {
          cluster_identifier = "ENCRYPTED_CLUSTER_ID"

          snapshot_identifier = aws_redshift_snapshot.pre_encryption.id

          encrypted = true
          # Omit kms_key_id to use the default AWS-managed key,
          # or set it to use a customer-managed CMK:
          # kms_key_id = "OPTIONAL_KMS_KEY_ARN"

          node_type               = "NODE_TYPE"
          master_username         = "MASTER_USERNAME"
          master_password         = "MASTER_PASSWORD"
          cluster_subnet_group_name = "CLUSTER_SUBNET_GROUP_NAME"
          vpc_security_group_ids  = ["VPC_SECURITY_GROUP_ID_1", "VPC_SECURITY_GROUP_ID_2"]
          cluster_parameter_group_name = "CLUSTER_PARAMETER_GROUP_NAME"
          number_of_nodes         = 2

          # Add any other settings that match your existing cluster:
          # preferred_maintenance_window, automated_snapshot_retention_period, etc.
        }

        # 3. AFTER verifying the new encrypted cluster and updating all client endpoints:
        #    - Remove the old unencrypted aws_redshift_cluster resource from Terraform state/config.
        #    - On `terraform apply`, Terraform will DELETE the old unencrypted cluster.
        #    This mirrors `delete-cluster --final-cluster-snapshot-identifier ...`.
        #
        # WARNING: You CANNOT turn on encryption in-place; this is a full replacement.
        # WARNING: This will cause downtime and the new cluster has a different endpoint.
        # WARNING: Deleting the old cluster (by removing its resource) is irreversible.
        ```

        This change forces creation of a new encrypted Redshift cluster and (once you remove the old cluster resource) destruction of the unencrypted one, causing a replacement and downtime.

        Verification: `terraform plan` should show creation of `aws_redshift_snapshot.pre_encryption`, creation of `aws_redshift_cluster.encrypted`, and (once you remove the old cluster resource) destruction of the previous unencrypted `aws_redshift_cluster`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html)