Redshift Clusters Should Be Encrypted With KMS CMKs

Using Console

To remediate the misconfiguration of Redshift clusters not being encrypted with KMS Customer Managed Keys (CMKs) in AWS, follow these steps using the AWS Management Console:

Navigate to the Amazon Redshift Console:
- Go to the AWS Management Console (https://console.aws.amazon.com/).
- In the “Find Services” search bar, type “Redshift” and click on “Amazon Redshift” to open the Redshift Console.
Select the Redshift Cluster:
- In the Redshift Console, select the Redshift cluster that you want to encrypt with KMS CMKs by clicking on the cluster identifier.
Enable Encryption:
- In the cluster details page, click on the “Cluster” dropdown menu and select “Modify”.
Enable Encryption with KMS CMKs:
- In the “Cluster configuration” section, find the “Encryption” option.
- Select the option to enable encryption.
- Choose “KMS” as the encryption type.
- Select the desired KMS Customer Managed Key (CMK) from the dropdown menu. If you don’t have a CMK, you can create one in the AWS Key Management Service (KMS) console.
Review and Apply Changes:
- Review the other configuration settings to ensure they are correct.
- Scroll down and click on the “Modify cluster” button to apply the encryption settings.
Monitor Encryption Progress:
- Once you have modified the cluster configuration, monitor the cluster status in the Redshift Console.
- The cluster will undergo modifications to enable encryption with the selected KMS CMK. This process may take some time depending on the size of the cluster.
Verify Encryption:
- After the modification is complete, verify that the Redshift cluster is now encrypted with the selected KMS CMK.
- You can check the encryption status in the cluster details page under the “Cluster” dropdown menu.

By following these steps, you can remediate the misconfiguration of Redshift clusters not being encrypted with KMS CMKs in AWS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of AWS Redshift clusters not being encrypted with KMS Customer Master Keys (CMKs), you can follow these steps using the AWS CLI:

List the existing Redshift clusters to identify the clusters that are not encrypted with KMS CMKs:

aws redshift describe-clusters

For each Redshift cluster that is not encrypted with a KMS CMK, modify the cluster to enable encryption with a KMS CMK. Replace your-cluster-identifier with the actual identifier of the Redshift cluster:

aws redshift modify-cluster --cluster-identifier your-cluster-identifier --encrypted --kms-key-id your-kms-key-id

--encrypted: Specifies that the cluster should be encrypted.
--kms-key-id: The Amazon Resource Name (ARN) of the KMS CMK to use for encryption. You can find the ARN of the KMS CMK in the AWS Key Management Service (KMS) console.

Verify that the encryption status of the Redshift cluster has been updated:

aws redshift describe-clusters --cluster-identifier your-cluster-identifier --query "Clusters[0].Encrypted"

Ensure that the output is true, indicating that the cluster is now encrypted with a KMS CMK.

By following these steps, you can remediate the misconfiguration of AWS Redshift clusters not being encrypted with KMS CMKs using the AWS CLI.

Using Python

To remediate the misconfiguration of Redshift clusters not being encrypted with KMS CMKs in AWS, you can use the AWS SDK for Python (Boto3) to update the cluster configuration. Here are the step-by-step instructions to remediate this issue:

Install Boto3: If you haven’t already installed the Boto3 library, you can install it using pip:
pip install boto3
Configure AWS Credentials: Make sure your AWS credentials are properly configured. You can set up your AWS credentials using the AWS CLI or by setting environment variables.

Write a Python script: Create a Python script with the following code to update the Redshift cluster configuration to enable encryption with a KMS CMK:

import boto3

# Initialize the Redshift client
redshift_client = boto3.client('redshift')

# Specify the Redshift cluster identifier
cluster_identifier = 'your-redshift-cluster-identifier'

# Specify the KMS key ARN for encryption
kms_key_arn = 'arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id'

# Update the Redshift cluster to enable encryption with the specified KMS key
response = redshift_client.modify_cluster(
    ClusterIdentifier=cluster_identifier,
    Encrypted=True,
    KmsKeyId=kms_key_arn
)

print("Redshift cluster encryption updated successfully")

Replace the placeholders:
- Replace 'your-redshift-cluster-identifier' with the actual identifier of your Redshift cluster.
- Replace 'arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id' with the ARN of the KMS key you want to use for encryption.
Run the Python script: Execute the Python script to update the Redshift cluster configuration for encryption with a KMS CMK:
python remediate_redshift_encryption.py
Verify the encryption status: After running the script, verify that the Redshift cluster is now encrypted with the specified KMS CMK by checking the cluster details in the AWS Management Console or using the Boto3 API.

By following these steps, you can remediate the misconfiguration of Redshift clusters not being encrypted with KMS CMKs in AWS using Python and Boto3.

Using Terraform

resource "aws_kms_key" "redshift_cmk" {
  description             = "KMS CMK for Redshift cluster encryption"
  deletion_window_in_days = 30

  # Optional: restrict key usage to Redshift with key policy, etc.
}

resource "aws_redshift_cluster" "this" {
  cluster_identifier = "REDSHIFT_CLUSTER_IDENTIFIER" # e.g. "analytics-prod"
  node_type          = "REDSHIFT_NODE_TYPE"          # e.g. "dc2.large"
  master_username    = "MASTER_USERNAME"
  master_password    = "MASTER_PASSWORD"
  cluster_type       = "REDSHIFT_CLUSTER_TYPE"       # e.g. "single-node" or "multi-node"

  # ...other required and existing arguments...

  encrypted  = true
  kms_key_id = aws_kms_key.redshift_cmk.arn
}

Changing an existing unencrypted Redshift cluster (or one using the default AWS-managed key) to use a customer-managed KMS key forces a full replacement of the cluster, which is an outage and data-destructive unless you restore from a snapshot.Verification: terraform plan should show encrypted changing to true and kms_key_id set to the CMK ARN, with the Redshift cluster resource marked for replacement if it was not previously using that CMK.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Redshift Clusters Should Be Encrypted With KMS CMKs

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: