Skip to main content

🛡️ AWS Redshift Cluster Automated Snapshot Retention Period is not set🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that do not have automated snapshots enabled.

Amazon Redshift automatically takes snapshots of clusters based on the configured snapshot retention period, which defines the number of days automated snapshots are retained. When the retention period is set to 0, automated snapshots are disabled. While manual snapshots can still be created in this configuration, automated snapshots provide a more reliable and consistent mechanism for data protection and recovery.

Rationale​

Automated snapshots provide a critical safety net for Amazon Redshift environments. Without automated snapshots, point-in-time recovery is not possible in the event of accidental data deletion, data corruption, malicious activity (such as ransomware), or infrastructure failures.

Impact​

Automated snapshots incur storage costs. Organizations should balance the snapshot retention period against storage expenses while ensuring adequate data protection and recoverability.

Audit​

This policy flags an AWS Redshift Cluster as INCOMPLIANT when the Automated Snapshot Retention Period is set to 0.

Remediation​

Open File

Remediation​

Enable Automated Snapshots​

Update the configuration of the affected Redshift cluster to enable automated snapshots by setting a positive automated snapshot retention period.

The automated snapshot retention period determines how many days Amazon Redshift retains automated backups. Valid values range from 1 to 35 days. Setting this value to 0 disables automated snapshots.

From Command Line​

Run the following AWS CLI command to enable automated snapshots for the selected Amazon Redshift cluster:

aws redshift modify-cluster \
    --region {{region}} \
    --cluster-identifier {{cluster-id}} \
    --automated-snapshot-retention-period 7

Adjust the --automated-snapshot-retention-period value as needed to align with your organization’s backup retention requirements.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled1no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery23no data
💼 FedRAMP High Security Controls → 💼 CP-6 Alternate Storage Site (M)(H)319no data
💼 FedRAMP High Security Controls → 💼 CP-6(1) Separation from Primary Site (M)(H)5no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)19no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5414no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)220no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)18no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)12no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)20no data
💼 FedRAMP Moderate Security Controls → 💼 CP-6 Alternate Storage Site (M)(H)25no data
💼 FedRAMP Moderate Security Controls → 💼 CP-6(1) Separation from Primary Site (M)(H)5no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)214no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)120no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected185no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected183no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested15no data
💼 NIST CSF v2.0 → 💼 PR.IR-04: Adequate resource capacity to ensure availability is maintained5no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process20no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed20no data
💼 NIST CSF v2.0 → 💼 RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration9no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed20no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6 Alternate Storage Site319no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(1) Alternate Storage Site _ Separation from Primary Site5no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives19no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9 System Backup811no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution620no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy24no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration18no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability19no data