More Info:
AWS Redshift non-default parameter groups require SSL to secure data in transit.Risk Level
MediumAddress
SecurityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- GDPR
- HIPAA
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of the Redshift Parameter Group requiring SSL in AWS using the AWS Management Console, follow these steps:
- Login to AWS Console: Go to the AWS Management Console and login to your account.
- Navigate to Redshift Service: In the AWS Management Console, navigate to the Amazon Redshift service.
- Select Parameter Groups: In the left-hand navigation pane, select “Parameter Groups”.
- Identify the Parameter Group: Identify the parameter group that is associated with your Redshift cluster. This parameter group should be the one that needs to have SSL enabled.
- Modify the Parameter Group: Select the parameter group by checking the box next to it, and then click on the “Modify” button at the top.
-
Update SSL Configuration: In the parameter group settings, locate the parameter
require_ssland set its value totrueto enforce SSL connections. -
Save Changes: After updating the
require_sslparameter, scroll to the bottom of the page and click on the “Save Changes” button to apply the configuration. - Apply Changes to Cluster: Once the changes are saved, you will need to apply the modified parameter group to your Redshift cluster. To do this, select your Redshift cluster, click on the “Cluster Actions” dropdown, and choose “Modify”.
- Associate Parameter Group: In the Modify Cluster settings, select the modified parameter group from the dropdown list under the “Cluster Parameter Group” section.
- Apply Changes: Review the other settings if needed and click on the “Modify Cluster” button to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration of requiring SSL for an AWS Redshift Parameter Group using AWS CLI, follow these steps:Replace Replace By following these steps, you can remediate the misconfiguration of requiring SSL for an AWS Redshift Parameter Group using AWS CLI.
- List all existing Redshift parameter groups to identify the one that needs to be updated:
- Modify the Redshift parameter group to require SSL by setting the
require_sslparameter totrue:
<parameter-group-name> with the actual name of the Redshift parameter group that needs to be updated.- Apply the modified parameter group to the Redshift cluster:
<cluster-identifier> with the identifier of the Redshift cluster to apply the changes.- Verify the changes by describing the modified Redshift parameter group:
Using Python
Using Python
To remediate the misconfiguration of requiring SSL for an AWS Redshift Parameter Group using Python, you can follow these steps:
-
Install the
boto3library if you haven’t already. You can install it using pip: - Use the following Python script to update the Redshift Parameter Group to require SSL:
-
Replace
'your_aws_region'with the AWS region where your Redshift cluster is located, and'your_parameter_group_name'with the name of the Redshift Parameter Group you want to update. - Run the Python script. This will update the Redshift Parameter Group to require SSL.
Using Terraform
Using Terraform
require_ssl is a static parameter; after applying Terraform you must still reboot the cluster (e.g., via aws redshift reboot-cluster or the console) to apply it, which causes a brief outage and will affect any other clusters using the same parameter group at their next reboot.For verification, terraform plan should show an in-place update to aws_redshift_parameter_group.REDSHIFT_PARAMETER_GROUP (adding or changing the require_ssl parameter to "true") and no replacements.
