Redshift Cluster Should Not Use Default Master Username

Using Console

To remediate the misconfiguration of an AWS Redshift cluster using the default master username, follow these steps using the AWS Management Console:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.
Navigate to Amazon Redshift: In the AWS Management Console, search for “Redshift” in the services search bar and click on “Amazon Redshift” to open the Redshift dashboard.
Select the Redshift Cluster: From the list of Redshift clusters, select the cluster for which you want to remediate the misconfiguration.
Modify the Cluster: Click on the cluster identifier to open the cluster details page. In the cluster details page, click on the “Modify” button at the top.
Change Master Username: In the “Cluster Database Properties” section of the modify cluster page, locate the “Master user name” field. Change the default master username (usually “masteruser”) to a custom username that follows your organization’s security best practices.
Save Changes: After updating the master username, scroll down to the bottom of the modify cluster page and click on the “Modify cluster” button to save the changes.
Monitor the Modification: AWS Redshift will start applying the changes to the cluster. You can monitor the modification progress in the cluster details page.
Verify the Changes: Once the modification is completed, verify that the master username has been successfully changed to the custom username you specified.

By following these steps, you have successfully remediated the misconfiguration of using the default master username for an AWS Redshift cluster.

Using CLI

To remediate the misconfiguration of AWS Redshift cluster using the default master username, you can follow these steps using AWS CLI:Step 1: List the existing Redshift clusters to identify the cluster that is using the default master username.

aws redshift describe-clusters

Step 2: Identify the Redshift cluster for which you want to change the master username.Step 3: Modify the master username for the identified Redshift cluster using the following command:

aws redshift modify-cluster --cluster-identifier YOUR_CLUSTER_IDENTIFIER --master-username NEW_MASTER_USERNAME

Replace YOUR_CLUSTER_IDENTIFIER with the actual identifier of your Redshift cluster and NEW_MASTER_USERNAME with the desired non-default master username.Step 4: You will be prompted to provide the master user password for confirmation. Enter the master user password when prompted.Step 5: Verify that the master username has been successfully changed by describing the cluster again:

aws redshift describe-clusters --cluster-identifier YOUR_CLUSTER_IDENTIFIER

By following these steps, you can remediate the misconfiguration of using the default master username for an AWS Redshift cluster using the AWS CLI.

Using Python

To remediate the misconfiguration of an AWS Redshift cluster using the default master username, you can follow these steps using Python and AWS SDK (boto3):

Install boto3 library if you haven’t already:

pip install boto3

Use the following Python script to update the master username of the Redshift cluster:

import boto3

# Define the AWS region and the Redshift cluster identifier
region = 'your_aws_region'
cluster_identifier = 'your_redshift_cluster_identifier'

# Define the new master username
new_master_username = 'new_master_username'

# Create a Redshift client using boto3
redshift_client = boto3.client('redshift', region_name=region)

# Modify the Redshift cluster to update the master username
response = redshift_client.modify_cluster(
    ClusterIdentifier=cluster_identifier,
    MasterUserPassword=new_master_username,
    ApplyImmediately=True
)

# Print the response
print(response)

Replace the placeholders your_aws_region, your_redshift_cluster_identifier, and new_master_username with your actual AWS region, Redshift cluster identifier, and the desired new master username.
Run the Python script to update the master username of the Redshift cluster. This will trigger an immediate update, and the Redshift cluster will no longer use the default master username.

By following these steps and running the Python script, you can remediate the misconfiguration of an AWS Redshift cluster using the default master username.

Using Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier = "REDSHIFT_CLUSTER_IDENTIFIER" # e.g. "analytics-prod"

  # CHANGE THIS: do not use the default "awsuser"
  master_username = "NON_DEFAULT_MASTER_USERNAME"    # e.g. "redshift_admin"

  master_password = "REDSHIFT_MASTER_PASSWORD"       # or use a sensitive input / Secrets Manager

  node_type         = "dc2.large"
  cluster_type      = "multi-node"
  number_of_nodes   = 2
  database_name     = "REDSHIFT_DB_NAME"
  port              = 5439
  iam_roles         = ["REDSHIFT_IAM_ROLE_ARN"]
  cluster_subnet_group_name = "REDSHIFT_SUBNET_GROUP_NAME"
  # ...other required arguments...
}

Changing master_username on aws_redshift_cluster forces replacement of the cluster; plan/apply will destroy and recreate it, so ensure you snapshot and/or restore data as needed before applying, as this is an irreversible change for in-place data.For verification, terraform plan should show the existing aws_redshift_cluster.this being replaced (-/+) with the sole functional difference being master_username changing from "awsuser" to "NON_DEFAULT_MASTER_USERNAME".

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Redshift Cluster Should Not Use Default Master Username

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: