Skip to main content

More Info:

The automated snapshot retention period set for your AWS Redshift clusters should be a positive number, meaning that automated backups are enabled for the clusters.

Risk Level

Low

Address

Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • GDPR
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS, follow these steps using the AWS Management Console:
  1. Login to AWS Console: Go to the AWS Management Console and log in with your credentials.
  2. Navigate to Amazon Redshift: Click on the “Services” dropdown menu at the top of the page, and then select “Redshift” under the Analytics section.
  3. Select your Redshift Cluster: From the Redshift dashboard, select the Redshift cluster for which you want to enable the retention period for automated snapshots.
  4. Modify Cluster: In the cluster details page, click on the cluster identifier link to go to the cluster details.
  5. Configure Automated Snapshots: In the cluster details page, scroll down to the “Cluster snapshots” section and click on the “Modify” button.
  6. Enable Retention Period: In the Modify cluster snapshot settings page, locate the “Automated snapshots” section. Here, you will find the option to set the retention period for automated snapshots.
  7. Set Retention Period: Check the box next to “Enable” to enable automated snapshots and set a retention period using the dropdown menu. You can choose a retention period between 1 to 35 days.
  8. Save Changes: Once you have set the retention period, scroll down to the bottom of the page and click on the “Modify cluster” button to save the changes.
  9. Verify Configuration: After saving the changes, AWS Redshift will start taking automated snapshots with the configured retention period.
By following these steps, you have successfully remediated the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS.

To remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS, you can follow these steps using AWS CLI:
  1. List the existing automated snapshots for your Redshift cluster to identify the snapshot identifier that needs to be updated:
  1. Modify the retention period for the identified automated snapshot using the following command. Replace YOUR_SNAPSHOT_IDENTIFIER with the actual snapshot identifier and set the --retention-period value to the desired number of days:
  1. Verify the modification by describing the snapshot attributes again:
  1. Repeat steps 1-3 for all other automated snapshots that do not have the retention period enabled.
By following these steps, you can remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS using AWS CLI.
To remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS, you can use the AWS SDK for Python (Boto3) to update the cluster snapshot schedule. Here are the step-by-step instructions to remediate this issue:
  1. Install Boto3: If you haven’t already installed the Boto3 library, you can do so using pip:
  2. Create a Python script to enable the retention period for Redshift Automated Snapshots. You can use the following code snippet as a template:
  1. Update the script with your Redshift cluster identifier and the desired snapshot retention period in days.
  2. Run the Python script:
  3. Verify that the retention period is enabled for Redshift Automated Snapshots by checking the Redshift console or using the following AWS CLI command:
By following these steps, you can remediate the misconfiguration of Redshift Automated Snapshots not having retention period enabled in AWS Redshift using Python and Boto3.
Substitute YOUR_CLUSTER_IDENTIFIER with the actual Redshift cluster identifier, and ensure the rest of the required arguments for aws_redshift_cluster are present as in your existing configuration. This change updates the cluster in-place and does not force replacement.After editing, terraform plan should show an in-place update to aws_redshift_cluster.THIS_CLUSTER with automated_snapshot_retention_period changing from its current value (likely 0 or unset) to 7.

Additional Reading: