1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in with your credentials.
2. Navigate to Amazon Redshift: Click on the “Services” dropdown menu at the top left corner of the console, then select “Redshift” under the Analytics section.
3. Select the Redshift Cluster: In the Redshift dashboard, click on the Redshift cluster for which you want to enable audit logging.
4. Modify Cluster: In the cluster details page, click on the “Cluster” dropdown menu at the top, then select “Modify Cluster”.
5. Enable Audit Logging: Scroll down to the “Audit logging” section in the Modify Cluster settings.
6. Enable Audit Logging: Check the box next to “Enable audit logging”.
7. Choose S3 Bucket: Select an existing S3 bucket where you want to store the audit logs or create a new one.
8. IAM Role: Choose an existing IAM role that has permission to write logs to the selected S3 bucket, or create a new IAM role with the required permissions.
9. Encryption: Choose whether you want to encrypt the audit logs using AWS Key Management Service (KMS). If you choose to encrypt, select the KMS key to use.
10. Save Changes: Scroll to the bottom of the page and click on the “Modify Cluster” button to save the changes.
11. Monitor Audit Logs: Once the changes are saved, Redshift will start logging audit information to the specified S3 bucket. You can monitor the audit logs in the S3 bucket to ensure that the logging is working correctly.

​

1. Install Boto3: Ensure you have Boto3 installed in your Python environment. You can install it using pip:
   pip install boto3
   
2. Configure AWS Credentials: Make sure you have configured your AWS credentials with the necessary permissions to modify Redshift clusters. You can set up your credentials using the AWS Command Line Interface (CLI) or by setting environment variables.
3. Write Python Script: Create a Python script with the following code to enable logging for the Redshift cluster:
   import boto3
   
   # Initialize the Redshift client
   redshift_client = boto3.client('redshift')
   
   # Specify the Redshift cluster identifier
   cluster_identifier = 'your-redshift-cluster-identifier'
   
   # Enable logging for the Redshift cluster
   response = redshift_client.modify_cluster(
       ClusterIdentifier=cluster_identifier,
       LoggingProperties={
           'BucketName': 'your-s3-bucket-name',
           'S3KeyPrefix': 'redshift-logs/'
       }
   )
   
   print('Logging enabled for Redshift cluster:', cluster_identifier)
   
   Replace 'your-redshift-cluster-identifier' with the actual identifier of your Redshift cluster and 'your-s3-bucket-name' with the name of the S3 bucket where you want to store the logs.
4. Run the Script: Execute the Python script to enable logging for the specified Redshift cluster. Make sure the script runs successfully without any errors.

resource "aws_redshift_cluster" "this" {
  cluster_identifier = "REDSHIFT_CLUSTER_IDENTIFIER" # replace with your cluster identifier
  node_type          = "dc2.large"
  master_username    = "REDSHIFT_MASTER_USERNAME"
  master_password    = "REDSHIFT_MASTER_PASSWORD"
  cluster_type       = "single-node"

  logging {
    enable        = true
    bucket_name   = "YOUR_LOG_BUCKET_NAME"                        # must be an existing S3 bucket in same region
    s3_key_prefix = "redshift-audit-logs/REDSHIFT_CLUSTER_IDENTIFIER/"
  }
}

resource "aws_s3_bucket" "redshift_logs" {
  bucket = "YOUR_LOG_BUCKET_NAME" # replace with the actual, pre-created/desired bucket name
}

data "aws_iam_policy_document" "redshift_logging" {
  statement {
    sid    = "RedshiftPutObject"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["redshift.amazonaws.com"]
    }

    actions = ["s3:PutObject"]

    resources = [
      "arn:aws:s3:::YOUR_LOG_BUCKET_NAME/redshift-audit-logs/REDSHIFT_CLUSTER_IDENTIFIER/*",
    ]
  }

  statement {
    sid    = "RedshiftGetBucketAcl"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["redshift.amazonaws.com"]
    }

    actions = ["s3:GetBucketAcl"]

    resources = [
      "arn:aws:s3:::YOUR_LOG_BUCKET_NAME",
    ]
  }
}

resource "aws_s3_bucket_policy" "redshift_logging" {
  bucket = aws_s3_bucket.redshift_logs.id
  policy = data.aws_iam_policy_document.redshift_logging.json
}

• an in-place update to aws_redshift_cluster.this adding logging.enable = true, logging.bucket_name, and logging.s3_key_prefix
• creation (or update) of aws_s3_bucket.redshift_logs and aws_s3_bucket_policy.redshift_logging.