Redshift Clusters Should Allow Version Upgrade

Using Console

To remediate “Redshift clusters should allow version upgrade” in the AWS Console, you need to enable “Allow version upgrade” on each cluster.

Step-by-step in AWS Console

Sign in to AWS Console
- Go to: https://console.aws.amazon.com/
- Choose the correct region where your Redshift cluster is deployed.
Open Amazon Redshift
- In the services search bar, type “Redshift” and select Amazon Redshift.
Go to Clusters
- In the left navigation pane, click “Provisioned clusters” (or “Clusters” if that’s what you see).
- You’ll see a list of existing Redshift clusters.
Select the Cluster
- Click the name of the cluster you want to fix.
- This opens the cluster details page.
Edit Cluster Settings
- On the cluster details page, look for the “Actions” button or an “Edit” button (UI varies slightly by console version).
- Choose “Edit” (or “Modify”).
Enable Allow Version Upgrade
- In the edit/modify form, scroll to the “Maintenance” or “Cluster configuration” section.
- Find the checkbox or toggle named “Allow version upgrade”.
- Set it to enabled/checked.
Save Changes
- Scroll to the bottom and click “Save changes” or “Modify cluster”.
- Confirm if a confirmation dialog appears.
Repeat for Other Clusters
- Repeat steps 4–7 for each Redshift cluster that needs this setting enabled.

After this, during Redshift maintenance windows, the cluster will be able to upgrade to newer engine versions automatically.

Using CLI

To fix “Redshift Clusters Should Allow Version Upgrade” using AWS CLI, you need to set --allow-version-upgrade to true on each cluster.Below are concise, step-by-step instructions.

1. List all Redshift clusters

aws redshift describe-clusters \
  --query "Clusters[].ClusterIdentifier" \
  --output text

This returns cluster identifiers (space-separated).

2. Check current `AllowVersionUpgrade` setting (optional)

For a specific cluster:

CLUSTER_ID="my-redshift-cluster"

aws redshift describe-clusters \
  --cluster-identifier "$CLUSTER_ID" \
  --query "Clusters[0].{Cluster:ClusterIdentifier,AllowVersionUpgrade:AllowVersionUpgrade}" \
  --output table

3. Enable version upgrade for a single cluster

CLUSTER_ID="my-redshift-cluster"

aws redshift modify-cluster \
  --cluster-identifier "$CLUSTER_ID" \
  --allow-version-upgrade \
  --no-cli-pager

--allow-version-upgrade without a value means true.

4. Enable version upgrade for all clusters (bash loop)

for CLUSTER_ID in $(aws redshift describe-clusters \
  --query "Clusters[].ClusterIdentifier" \
  --output text); do
  echo "Enabling version upgrade for cluster: $CLUSTER_ID"
  aws redshift modify-cluster \
    --cluster-identifier "$CLUSTER_ID" \
    --allow-version-upgrade \
    --no-cli-pager
done

5. Verify remediation

aws redshift describe-clusters \
  --query "Clusters[].{Cluster:ClusterIdentifier,AllowVersionUpgrade:AllowVersionUpgrade}" \
  --output table

All clusters should show AllowVersionUpgrade as True.

Using Python

To remediate “Redshift Clusters Should Allow Version Upgrade” using Python (boto3), you need to set AllowVersionUpgrade=True on the cluster(s).Below is a concise step‑by‑step.

1. Prerequisites

AWS credentials configured (via environment variables, AWS profile, or IAM role).
boto3 installed:

pip install boto3

2. Identify Redshift clusters where `AllowVersionUpgrade` is `False`

import boto3

redshift = boto3.client("redshift", region_name="us-east-1")  # adjust region

def get_clusters_with_upgrade_disabled():
    clusters_to_fix = []
    paginator = redshift.get_paginator("describe_clusters")
    for page in paginator.paginate():
        for cluster in page.get("Clusters", []):
            if not cluster.get("AllowVersionUpgrade", True):
                clusters_to_fix.append(cluster["ClusterIdentifier"])
    return clusters_to_fix

if __name__ == "__main__":
    clusters = get_clusters_with_upgrade_disabled()
    print("Clusters with AllowVersionUpgrade = False:", clusters)

3. Enable version upgrade on those clusters

import boto3

redshift = boto3.client("redshift", region_name="us-east-1")  # adjust region

def enable_version_upgrade(cluster_identifier: str):
    """
    Sets AllowVersionUpgrade=True on a specific Redshift cluster.
    """
    response = redshift.modify_cluster(
        ClusterIdentifier=cluster_identifier,
        AllowVersionUpgrade=True
    )
    return response

def remediate_all():
    paginator = redshift.get_paginator("describe_clusters")
    for page in paginator.paginate():
        for cluster in page.get("Clusters", []):
            cid = cluster["ClusterIdentifier"]
            if not cluster.get("AllowVersionUpgrade", True):
                print(f"Enabling version upgrade for cluster: {cid}")
                enable_version_upgrade(cid)

if __name__ == "__main__":
    remediate_all()

4. Verify remediation

import boto3

redshift = boto3.client("redshift", region_name="us-east-1")

def verify():
    paginator = redshift.get_paginator("describe_clusters")
    for page in paginator.paginate():
        for cluster in page.get("Clusters", []):
            print(
                cluster["ClusterIdentifier"],
                "AllowVersionUpgrade=",
                cluster["AllowVersionUpgrade"]
            )

if __name__ == "__main__":
    verify()

If you want this to run automatically (e.g., as part of a Lambda remediation), the core logic is the remediate_all() function; you just need to adapt it into a Lambda handler and configure appropriate IAM permissions (redshift:DescribeClusters and redshift:ModifyCluster).

Using Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier = "YOUR_CLUSTER_IDENTIFIER"
  node_type          = "YOUR_NODE_TYPE"
  master_username    = "YOUR_MASTER_USERNAME"
  master_password    = "YOUR_MASTER_PASSWORD"
  cluster_type       = "multi-node"

  # Ensure the cluster allows major version upgrades
  allow_version_upgrade = true

  # ...other required arguments...
}

Substitute:

YOUR_CLUSTER_IDENTIFIER with the Redshift cluster identifier,
YOUR_NODE_TYPE with the desired node type (e.g., dc2.large),
YOUR_MASTER_USERNAME / YOUR_MASTER_PASSWORD with your credentials.

This change updates the existing cluster in place (no forced replacement), though Redshift may perform version upgrades during maintenance windows.To verify, terraform plan should show an in-place update with:

allow_version_upgrade: "false" => "true" (or from its previous value to true) and no -/+ replacement indicator on the cluster.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Redshift Clusters Should Allow Version Upgrade

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

Step-by-step in AWS Console

1. List all Redshift clusters

2. Check current `AllowVersionUpgrade` setting (optional)

3. Enable version upgrade for a single cluster

4. Enable version upgrade for all clusters (bash loop)

5. Verify remediation

1. Prerequisites

2. Identify Redshift clusters where `AllowVersionUpgrade` is `False`

3. Enable version upgrade on those clusters

4. Verify remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Remediation

​Using AWS Console

​Triage and Remediation

​Remediation

​Step-by-step in AWS Console

​1. List all Redshift clusters

​2. Check current AllowVersionUpgrade setting (optional)

​3. Enable version upgrade for a single cluster

​4. Enable version upgrade for all clusters (bash loop)

​5. Verify remediation

​1. Prerequisites

​2. Identify Redshift clusters where AllowVersionUpgrade is False

​3. Enable version upgrade on those clusters

​4. Verify remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

Step-by-step in AWS Console

1. List all Redshift clusters

2. Check current `AllowVersionUpgrade` setting (optional)

3. Enable version upgrade for a single cluster

4. Enable version upgrade for all clusters (bash loop)

5. Verify remediation

1. Prerequisites

2. Identify Redshift clusters where `AllowVersionUpgrade` is `False`

3. Enable version upgrade on those clusters

4. Verify remediation

Additional Reading: