Skip to main content

🛡️ AWS Redshift Cluster Master Username is a default values🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that are using the default master username.

AWS Redshift clusters should be configured with custom master usernames instead of the default awsuser.

Rationale​

Using a custom master username adds an additional layer of defense against generic or non-targeted attacks. While changing the default master username improves security, it does not fully prevent attackers who may obtain database usernames through social engineering or other means. For comprehensive Redshift security, it is recommended to restrict the root account to privileged users, enforce strong and complex passwords, and grant database-level permissions only to trusted users.

Impact​

Requires recreating the database cluster with a custom master username and migrating the existing data to the new cluster.

Audit​

This policy flags an Amazon Redshift Cluster as INCOMPLIANT if the Master Username is set to awsuser.

Remediation​

Open File

Remediation​

Change the Default Master Username​

To replace the default master username for an existing AWS Redshift Cluster, you must create a new cluster with a custom master username and migrate your data from the old cluster.

From Command Line​

  1. Retrieve cluster configuration

    Use the describe-clusters command to obtain the current configuration of the cluster you plan to replace:

    aws redshift describe-clusters \
        --region {{region}} \
        --cluster-identifier {{cluster-id}}

    The output will include metadata such as node type, database name, and current master username, which you will need when creating the new cluster.

    Example:

    {
        "Clusters": [
            {
                "PubliclyAccessible": true,
                "MasterUsername": "awsuser",
                "DBName": "awsclusterdb",
                "ClusterStatus": "available"
            }
        ]
    }

  2. Create a new cluster

    Use the configuration information from the previous step to launch a new cluster with a custom master username:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.8] Amazon Redshift clusters should not use the default Admin username1no data
💼 Cloudaware Framework → 💼 Threat Protection49no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data