Skip to main content

🛡️ AWS Redshift Cluster Enhanced VPC Routing is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that have Enhanced VPC Routing disabled. When enabled, this feature forces all COPY and UNLOAD traffic between the cluster and data repositories (such as Amazon S3) to flow through the associated VPC.

Rationale​

When Enhanced VPC Routing is disabled, Amazon Redshift may route traffic over the public internet when communicating with other AWS services. Enabling this feature ensures that data transfers remain within the AWS network and allows you to enforce network-level controls using VPC security groups and network access control lists. This improves security, enables better visibility through VPC Flow Logs, and can help reduce data egress exposure.

Impact​

Because Enhanced VPC Routing changes how Amazon Redshift accesses external resources, COPY and UNLOAD operations may fail if the VPC is not configured correctly. You must explicitly establish a valid network path between the cluster’s VPC and the target data resources.

There is no additional charge for enabling Enhanced VPC Routing. However, standard data transfer charges may apply in certain scenarios, for example:

... see more

Remediation​

Open File

Remediation​

Enable Enhanced VPC Routing​

To ensure that data transfers between Amazon Redshift and external data repositories remain within your VPC, enable Enhanced VPC Routing on the cluster. This allows you to apply network-level security controls and improve visibility into data movement.

From Command Line​

Use the following AWS CLI command to enable Enhanced VPC Routing for the specified Redshift cluster:

aws redshift modify-cluster \
    --cluster-identifier {{cluster-id}} \
    --enhanced-vpc-routing

Note: Enabling Enhanced VPC Routing may require a cluster restart and proper VPC configuration (such as routes, NAT gateways, or VPC endpoints) to ensure that COPY and UNLOAD operations continue to function as expected.

Post-Remediation Validation​
  • Verify that the cluster status returns to available after the change.
  • Confirm that COPY and UNLOAD operations complete successfully using the configured private network paths.
  • Review VPC Flow Logs to validate that traffic is routed through the VPC as intended.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.7] Redshift clusters should use enhanced VPC routing1no data
💼 Cloudaware Framework → 💼 Secure Access75no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)237105no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1163no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10884no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)20no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)37no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)49no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)189no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)63no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)768no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events180no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events181no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained89no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected187no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected160no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected184no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage123no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269123no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3763no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29493no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services49no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic34no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic37no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation20no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components37no data