Skip to main content

🛡️ AWS Redshift Cluster Automated Snapshot Retention Period is not set🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Redshift Clusters that do not have automated snapshots enabled.

Amazon Redshift automatically takes snapshots of clusters based on the configured snapshot retention period, which defines the number of days automated snapshots are retained. When the retention period is set to 0, automated snapshots are disabled. While manual snapshots can still be created in this configuration, automated snapshots provide a more reliable and consistent mechanism for data protection and recovery.

Rationale​

Automated snapshots provide a critical safety net for Amazon Redshift environments. Without automated snapshots, point-in-time recovery is not possible in the event of accidental data deletion, data corruption, malicious activity (such as ransomware), or infrastructure failures.

Impact​

Automated snapshots incur storage costs. Organizations should balance the snapshot retention period against storage expenses while ensuring adequate data protection and recoverability.

Audit​

This policy flags an AWS Redshift Cluster as INCOMPLIANT when the Automated Snapshot Retention Period is set to 0.

Remediation​

Open File

Remediation​

Enable Automated Snapshots​

Update the configuration of the affected Redshift cluster to enable automated snapshots by setting a positive automated snapshot retention period.

The automated snapshot retention period determines how many days Amazon Redshift retains automated backups. Valid values range from 1 to 35 days. Setting this value to 0 disables automated snapshots.

From Command Line​

Run the following AWS CLI command to enable automated snapshots for the selected Amazon Redshift cluster:

aws redshift modify-cluster \
    --region {{region}} \
    --cluster-identifier {{cluster-id}} \
    --automated-snapshot-retention-period 7

Adjust the --automated-snapshot-retention-period value as needed to align with your organization's backup retention requirements.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.3] Amazon Redshift clusters should have automatic snapshots enabled1no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery25no data
💼 FedRAMP High Security Controls → 💼 CP-6 Alternate Storage Site (M)(H)320no data
💼 FedRAMP High Security Controls → 💼 CP-6(1) Separation from Primary Site (M)(H)6no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)20no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5416no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)221no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)18no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)14no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)21no data
💼 FedRAMP Moderate Security Controls → 💼 CP-6 Alternate Storage Site (M)(H)26no data
💼 FedRAMP Moderate Security Controls → 💼 CP-6(1) Separation from Primary Site (M)(H)6no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)216no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)121no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected196no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected197no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested18no data
💼 NIST CSF v2.0 → 💼 PR.IR-04: Adequate resource capacity to ensure availability is maintained6no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process21no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed21no data
💼 NIST CSF v2.0 → 💼 RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration10no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed21no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6 Alternate Storage Site320no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(1) Alternate Storage Site _ Separation from Primary Site6no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives20no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9 System Backup812no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution621no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy24no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration18no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability20no data