Skip to main content

🛡️ AWS Redshift Cluster is not required to use encryption in transit🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that are not configured to enforce SSL/TLS encryption for all client connections.

Rationale​

Enforcing encryption in transit ensures that all data transmitted between clients and the Redshift cluster is protected from interception and unauthorized access. This control is critical for maintaining data confidentiality and integrity, as well as for meeting organizational and regulatory security requirements.

Audit​

This policy flags an AWS Redshift Cluster as INCOMPLIANT if its related AWS Redshift Cluster Parameter Group contains the require_ssl Parameter set to false.

The Cluster is marked as UNDETERMINED if the Cluster Parameter Group or the require_ssl Parameter is not present in the CMDB.

Remediation​

Open File

Remediation​

Enforce SSL/TLS Connections for Redshift Clusters​

To ensure all client connections use SSL/TLS, update the Redshift cluster parameter group to enable the require_ssl parameter.

Prerequisites​
  • Verify cluster status is available before making changes
  • Plan for a maintenance window as a reboot is required
From Command Line​

  1. Identify the Parameter Group Associated with the Cluster

    Retrieve the name of the parameter group attached to your Redshift cluster:

    aws redshift describe-clusters \
        --cluster-identifier {{cluster-id}} \
        --query "Clusters[0].ClusterParameterGroups[0].ParameterGroupName" \
        --output text

  2. Update the require_ssl Parameter

    Modify the identified parameter group to enforce SSL/TLS connections:

    aws redshift modify-cluster-parameter-group \
        --parameter-group-name {{parameter-group-name}} \
        --parameters "ParameterName=require_ssl,ParameterValue=true"

  3. Reboot the Cluster

    Apply the updated parameter group settings by rebooting the cluster:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit1no data
💼 AWS Well-Architected → 💼 SEC09-BP03 Authenticate network communications3no data
💼 Cloudaware Framework → 💼 Data Encryption57no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23789no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)35no data
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1820no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)819no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1634no data
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)716no data
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)120no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)19no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)173no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)35no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)120no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)19no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)16no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events149no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained76no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected164no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected140no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected156no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage103no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement326999no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services35no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8 Transmission Confidentiality and Integrity5819no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection818no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(2) Transmission Confidentiality and Integrity _ Pre- and Post-transmission Handling10no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection423no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23 Session Authenticity510no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23(3) Session Authenticity _ Unique System-generated Session Identifiers9no data
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.1825no data
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.225no data
💼 PCI DSS v4.0 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.2925no data