Redshift Clusters Should Not Use Default Port

Using Console

To remediate the misconfiguration of Redshift clusters using default port in AWS, follow these steps using the AWS Management Console:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and log in to your account.
Navigate to Amazon Redshift: Click on the “Services” dropdown menu at the top left corner, then select “Redshift” under the “Analytics” section.
Select the Redshift Cluster: From the list of Redshift clusters, select the cluster that is using the default port that you want to change.
Modify the Cluster: In the cluster details page, click on the “Cluster” menu on the left side, then click on the “Modify” button at the top.
Change the Port: Scroll down to the “Network and security” section, locate the “Cluster port” field, and change the port number from the default port (5439) to a custom port of your choice. Make sure the new port is not being used by any other service.
Apply Changes: After changing the port number, scroll down to the bottom of the page and click on the “Modify cluster” button to apply the changes.
Monitor the Modification: The modification process may take a few minutes to complete. You can monitor the progress on the cluster details page.
Verify the Port Change: Once the modification is completed, you can verify that the Redshift cluster is now using the custom port by checking the cluster details.

By following these steps, you have successfully remediated the misconfiguration of Redshift clusters using the default port in AWS.

Using CLI

To remediate the misconfiguration of Redshift clusters using the default port in AWS, you can follow these steps using the AWS CLI:Step 1: List the existing Redshift clusters to identify the clusters using the default port (5439) by running the following command:

aws redshift describe-clusters

Step 2: Identify the Redshift cluster for which you want to update the port and make a note of the Cluster Identifier.Step 3: Modify the cluster to change the port using the modify-cluster command. Replace <cluster-identifier> with the actual Cluster Identifier and <new-port> with the desired port number (e.g., 5432) by running the following command:

aws redshift modify-cluster --cluster-identifier <cluster-identifier> --port <new-port>

Step 4: Verify the port change by describing the cluster again and checking if the port has been updated successfully:

aws redshift describe-clusters --cluster-identifier <cluster-identifier>

By following these steps, you can remediate the misconfiguration of Redshift clusters using the default port in AWS Redshift using the AWS CLI.

Using Python

To remediate the misconfiguration of Redshift clusters using the default port in AWS, you can use the AWS SDK for Python (Boto3) to update the cluster’s port to a non-default value. Here are the step-by-step instructions to remediate this misconfiguration:

Install Boto3: If you haven’t already installed the Boto3 library, you can install it using pip:
pip install boto3

Update Redshift Cluster Port: Use the following Python script to update the port for your Redshift cluster. Replace <cluster_id> with the ID of your Redshift cluster and <new_port> with the desired non-default port value:

import boto3

redshift = boto3.client('redshift')

cluster_id = '<cluster_id>'
new_port = <new_port>

response = redshift.modify_cluster(
    ClusterIdentifier=cluster_id,
    ClusterParameterGroupName='default',
    AutomatedSnapshotRetentionPeriod=1,
    Port=new_port
)

print(f"Updated port for Redshift cluster {cluster_id} to {new_port}")

Run the Python Script: Save the above script in a file (e.g., update_redshift_port.py) and run it using Python:
python update_redshift_port.py
Verify the Port Update: You can verify that the port for your Redshift cluster has been updated successfully by checking the cluster details in the AWS Management Console or by running describe-cluster CLI command.

By following these steps, you can remediate the misconfiguration of Redshift clusters using the default port in AWS.

Using Terraform

resource "aws_redshift_cluster" "THIS_CLUSTER" {
  cluster_identifier = "YOUR_CLUSTER_IDENTIFIER"  # replace with your cluster identifier

  # ... other required arguments such as:
  # node_type             = "dc2.large"
  # master_username       = "MASTER_USERNAME"
  # master_password       = "MASTER_PASSWORD"
  # cluster_type          = "single-node"
  # iam_roles             = [aws_iam_role.redshift_role.arn]
  # vpc_security_group_ids = [aws_security_group.redshift_sg.id]
  # cluster_subnet_group_name = aws_redshift_subnet_group.example.name

  # Use a non-default, unused port (must NOT be 5439)
  port = 6543 # replace with YOUR_NON_DEFAULT_PORT
}

Changing the port argument will cause AWS to reboot the cluster, resulting in a temporary outage, but it does not force Terraform to replace the cluster. After applying, you must update client connection strings and security group rules to use the new port.Verification: terraform plan should show ~ port: "5439" => "YOUR_NON_DEFAULT_PORT" for the aws_redshift_cluster.THIS_CLUSTER resource.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Redshift Clusters Should Not Use Default Port

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: