> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Redshift Automated Snapshots Should Have Retention Period Enabled ### More Info: The automated snapshot retention period set for your AWS Redshift clusters should be a positive number, meaning that automated backups are enabled for the clusters. ### Risk Level Low ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * GDPR * HIPAA * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS, follow these steps using the AWS Management Console: 1. **Login to AWS Console**: Go to the AWS Management Console and log in with your credentials. 2. **Navigate to Amazon Redshift**: Click on the "Services" dropdown menu at the top of the page, and then select "Redshift" under the Analytics section. 3. **Select your Redshift Cluster**: From the Redshift dashboard, select the Redshift cluster for which you want to enable the retention period for automated snapshots. 4. **Modify Cluster**: In the cluster details page, click on the cluster identifier link to go to the cluster details. 5. **Configure Automated Snapshots**: In the cluster details page, scroll down to the "Cluster snapshots" section and click on the "Modify" button. 6. **Enable Retention Period**: In the Modify cluster snapshot settings page, locate the "Automated snapshots" section. Here, you will find the option to set the retention period for automated snapshots. 7. **Set Retention Period**: Check the box next to "Enable" to enable automated snapshots and set a retention period using the dropdown menu. You can choose a retention period between 1 to 35 days. 8. **Save Changes**: Once you have set the retention period, scroll down to the bottom of the page and click on the "Modify cluster" button to save the changes. 9. **Verify Configuration**: After saving the changes, AWS Redshift will start taking automated snapshots with the configured retention period. By following these steps, you have successfully remediated the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS. # To remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS, you can follow these steps using AWS CLI: 1. List the existing automated snapshots for your Redshift cluster to identify the snapshot identifier that needs to be updated: ```bash theme={null} aws redshift describe-cluster-snapshots --cluster-identifier YOUR_CLUSTER_IDENTIFIER ``` 2. Modify the retention period for the identified automated snapshot using the following command. Replace `YOUR_SNAPSHOT_IDENTIFIER` with the actual snapshot identifier and set the `--retention-period` value to the desired number of days: ```bash theme={null} aws redshift modify-cluster-snapshot --snapshot-identifier YOUR_SNAPSHOT_IDENTIFIER --retention-period YOUR_RETENTION_PERIOD ``` 3. Verify the modification by describing the snapshot attributes again: ```bash theme={null} aws redshift describe-cluster-snapshots --cluster-identifier YOUR_CLUSTER_IDENTIFIER ``` 4. Repeat steps 1-3 for all other automated snapshots that do not have the retention period enabled. By following these steps, you can remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS using AWS CLI. To remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS, you can use the AWS SDK for Python (Boto3) to update the cluster snapshot schedule. Here are the step-by-step instructions to remediate this issue: 1. Install Boto3: If you haven't already installed the Boto3 library, you can do so using pip: ``` pip install boto3 ``` 2. Create a Python script to enable the retention period for Redshift Automated Snapshots. You can use the following code snippet as a template: ```python theme={null} import boto3 def enable_snapshot_retention(redshift_cluster_identifier, retention_period): client = boto3.client('redshift') response = client.modify_cluster_snapshot_schedule( ClusterIdentifier=redshift_cluster_identifier, ScheduleIdentifier='default', DisassociateSchedule=True ) response = client.create_snapshot_schedule( ScheduleDefinitions=[ 'rate(1 day)', ], ScheduleIdentifier='default', ScheduleDescription='Default snapshot schedule', Tags=[ { 'Key': 'Name', 'Value': 'DefaultSchedule' }, ], ClusterIdentifier=redshift_cluster_identifier, AssociatedClusterCount=1, AssociatedClusters=[ { 'ClusterIdentifier': redshift_cluster_identifier }, ], Enable=True, RetentionPeriod=retention_period ) print(f"Snapshot retention period enabled for Redshift cluster {redshift_cluster_identifier}") # Replace 'your-redshift-cluster-id' with your Redshift cluster identifier redshift_cluster_identifier = 'your-redshift-cluster-id' # Set the desired snapshot retention period in days retention_period = 7 enable_snapshot_retention(redshift_cluster_identifier, retention_period) ``` 3. Update the script with your Redshift cluster identifier and the desired snapshot retention period in days. 4. Run the Python script: ``` python enable_redshift_snapshot_retention.py ``` 5. Verify that the retention period is enabled for Redshift Automated Snapshots by checking the Redshift console or using the following AWS CLI command: ``` aws redshift describe-cluster-snapshot-schedules --cluster-identifier your-redshift-cluster-id ``` By following these steps, you can remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS Redshift using Python and Boto3. ```hcl theme={null} resource "aws_redshift_cluster" "THIS_CLUSTER" { cluster_identifier = "YOUR_CLUSTER_IDENTIFIER" # ... other required arguments like node_type, master_username, master_password, etc. # Enable automated snapshots and set retention period to 7 days automated_snapshot_retention_period = 7 } ``` Substitute `YOUR_CLUSTER_IDENTIFIER` with the actual Redshift cluster identifier, and ensure the rest of the required arguments for `aws_redshift_cluster` are present as in your existing configuration. This change updates the cluster in-place and does not force replacement. After editing, `terraform plan` should show an in-place update to `aws_redshift_cluster.THIS_CLUSTER` with `automated_snapshot_retention_period` changing from its current value (likely `0` or unset) to `7`. ### Additional Reading: * [https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-snapshots.html](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-snapshots.html)