Skip to main content

🛡️ AWS Redshift Cluster is not encrypted at rest🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that do not have encryption at rest enabled.

Rationale​

Encryption at rest is a fundamental security control that ensures only authorized users with the appropriate AWS KMS permissions can access cluster data. It protects sensitive information by making it unreadable in the event that physical storage media is compromised.

Audit​

This policy flags an Amazon Redshift Cluster as INCOMPLIANT if Encryption is not set to Enabled.

Remediation​

Open File

Remediation​

Enable Encryption at Rest​

To secure your Amazon Redshift cluster, enable encryption at rest using AWS KMS. When you enable encryption, Redshift automatically migrates your data to a new encrypted cluster. During this migration, the cluster remains available in read-only mode, and the cluster status appears as resizing.

Note: If cross-region snapshot copy is enabled, you must disable it before enabling encryption.

From Command Line​

Use the following AWS CLI command to modify an unencrypted cluster and enable encryption. By default, the cluster uses the AWS-managed KMS key. To use a customer-managed key, include the --kms-key-id option:

aws redshift modify-cluster \
    --cluster-identifier {{cluster-id}} \
    --encrypted \
    --kms-key-id {{kms-key-id}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.10] Redshift clusters should be encrypted at rest1no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest20no data
💼 Cloudaware Framework → 💼 Data Encryption70no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)17no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1643no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1736no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)525no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)43no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)136no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)25no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)43no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)136no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)25no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected185no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected158no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected183no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management17no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection432no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31737no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1025no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection27no data