Skip to main content

🛡️ AWS Redshift Cluster security group allows unrestricted access on the cluster port🟢

  • Contextual name: 🛡️ Cluster security group allows unrestricted access on the cluster port🟢
  • ID: /ce/ca/aws/redshift/cluster-security-group-unrestricted-port
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that are associated with VPC security groups containing inbound rules that allow unrestricted access to the Redshift cluster port (TCP 5439) from the public internet (0.0.0.0/0 or ::/0).

Rationale​

Amazon Redshift clusters commonly store sensitive analytical data. Allowing unrestricted inbound connectivity to the database port increases the likelihood of unauthorized access attempts, credential stuffing, brute-force attacks, and accidental exposure. Even when authentication is required, internet-exposed database ports materially increase attack surface and monitoring burden.

Security group ingress to the Redshift port should be limited to:

  • Trusted corporate/public egress IPs (specific CIDRs),
  • Approved network paths (VPN, Direct Connect, bastion, private connectivity),
  • Or internal VPC-only sources where appropriate.

Impact​

Restricting inbound access to TCP 5439 may disrupt workloads if applications, BI tools, or user networks currently connect from untracked or dynamic IP ranges. Before enforcing restrictions, confirm the legitimate client source ranges and ensure network paths (VPN/Direct Connect/VPC routing) are in place.

... see more

Remediation​

Open File

Remediation​

Restrict public inbound access to the Redshift cluster port (TCP 5439)​

Update the VPC security group(s) associated with the Redshift cluster to remove inbound rules that allow access from 0.0.0.0/0 and/or ::/0 to TCP port 5439. Replace them with trusted CIDR ranges, or route access through approved private connectivity (VPN/Direct Connect/bastion).

From Command Line​

  1. Identify the cluster security groups:

    aws redshift describe-clusters \
        --cluster-identifier {{cluster-id}} \
        --query 'Clusters[0].VpcSecurityGroups[].VpcSecurityGroupId' \
        --output text

  2. Review the inbound rules on each security group:

    aws ec2 describe-security-groups \
        --group-ids {{sg-id}} \
        --query 'SecurityGroups[0].IpPermissions' \
        --output json

  3. Revoke unrestricted IPv4 ingress to TCP 5439:

    aws ec2 revoke-security-group-ingress \
    --group-id {{sg-id}} \
    --ip-permissions '[
        {
        "IpProtocol": "tcp",

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.15] Redshift security groups should allow ingress on the cluster port only from restricted origins1no data
💼 Cloudaware Framework → 💼 Secure Access75no data
💼 PCI DSS v3.2.1 → 💼 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic.1065no data
💼 PCI DSS v4.0.1 → 💼 1.3.1 Inbound traffic to the CDE is restricted.65no data
💼 PCI DSS v4.0.1 → 💼 1.3.2 Outbound traffic from the CDE is restricted.65no data
💼 PCI DSS v4.0 → 💼 1.3.1 Inbound traffic to the CDE is restricted.765no data
💼 PCI DSS v4.0 → 💼 1.3.2 Outbound traffic from the CDE is restricted.65no data