Skip to main content

🛡️ AWS Redshift Cluster is not required to use encryption in transit🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that are not configured to enforce SSL/TLS encryption for all client connections.

Rationale​

Enforcing encryption in transit ensures that all data transmitted between clients and the Redshift cluster is protected from interception and unauthorized access. This control is critical for maintaining data confidentiality and integrity, as well as for meeting organizational and regulatory security requirements.

Audit​

This policy flags an AWS Redshift Cluster as INCOMPLIANT if its related AWS Redshift Cluster Parameter Group contains the require_ssl Parameter set to false.

The Cluster is marked as UNDETERMINED if the Cluster Parameter Group or the require_ssl Parameter is not present in the CMDB.

Remediation​

Open File

Remediation​

Enforce SSL/TLS Connections for Redshift Clusters​

To ensure all client connections use SSL/TLS, update the Redshift cluster parameter group to enable the require_ssl parameter.

Prerequisites​
  • Verify cluster status is available before making changes
  • Plan for a maintenance window as a reboot is required
From Command Line​

  1. Identify the Parameter Group Associated with the Cluster

    Retrieve the name of the parameter group attached to your Redshift cluster:

    aws redshift describe-clusters \
        --cluster-identifier {{cluster-id}} \
        --query "Clusters[0].ClusterParameterGroups[0].ParameterGroupName" \
        --output text

  2. Update the require_ssl Parameter

    Modify the identified parameter group to enforce SSL/TLS connections:

    aws redshift modify-cluster-parameter-group \
        --parameter-group-name {{parameter-group-name}} \
        --parameters "ParameterName=require_ssl,ParameterValue=true"

  3. Reboot the Cluster

    Apply the updated parameter group settings by rebooting the cluster:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit1no data
💼 AWS Well-Architected → 💼 SEC09-BP03 Authenticate network communications3no data
💼 Cloudaware Framework → 💼 Data Encryption66no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23795no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)41no data
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1823no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)822no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1640no data
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)719no data
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)123no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)22no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)179no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)41no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)123no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)19no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events162no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained81no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected173no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected149no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected169no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage112no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269110no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services41no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8 Transmission Confidentiality and Integrity5823no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection821no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(2) Transmission Confidentiality and Integrity _ Pre- and Post-transmission Handling14no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection429no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23 Session Authenticity513no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23(3) Session Authenticity _ Unique System-generated Session Identifiers12no data
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.1827no data
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.227no data
💼 PCI DSS v4.0 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.2927no data