Redshift Cluster Should Not Use Default Master Username
More Info:
AWS Redshift database clusters should not be using “awsuser” (default master user name) for database access.Risk Level
InformationalAddress
Operational Maturity, SecurityCompliance Standards
PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of an AWS Redshift cluster using the default master username, follow these steps using the AWS Management Console:
- Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.
- Navigate to Amazon Redshift: In the AWS Management Console, search for “Redshift” in the services search bar and click on “Amazon Redshift” to open the Redshift dashboard.
- Select the Redshift Cluster: From the list of Redshift clusters, select the cluster for which you want to remediate the misconfiguration.
- Modify the Cluster: Click on the cluster identifier to open the cluster details page. In the cluster details page, click on the “Modify” button at the top.
- Change Master Username: In the “Cluster Database Properties” section of the modify cluster page, locate the “Master user name” field. Change the default master username (usually “masteruser”) to a custom username that follows your organization’s security best practices.
- Save Changes: After updating the master username, scroll down to the bottom of the modify cluster page and click on the “Modify cluster” button to save the changes.
- Monitor the Modification: AWS Redshift will start applying the changes to the cluster. You can monitor the modification progress in the cluster details page.
- Verify the Changes: Once the modification is completed, verify that the master username has been successfully changed to the custom username you specified.
Using CLI
Using CLI
To remediate the misconfiguration of AWS Redshift cluster using the default master username, you can follow these steps using AWS CLI:Step 1: List the existing Redshift clusters to identify the cluster that is using the default master username.Step 2: Identify the Redshift cluster for which you want to change the master username.Step 3: Modify the master username for the identified Redshift cluster using the following command:Replace By following these steps, you can remediate the misconfiguration of using the default master username for an AWS Redshift cluster using the AWS CLI.
YOUR_CLUSTER_IDENTIFIER with the actual identifier of your Redshift cluster and NEW_MASTER_USERNAME with the desired non-default master username.Step 4: You will be prompted to provide the master user password for confirmation. Enter the master user password when prompted.Step 5: Verify that the master username has been successfully changed by describing the cluster again:Using Python
Using Python
To remediate the misconfiguration of an AWS Redshift cluster using the default master username, you can follow these steps using Python and AWS SDK (boto3):
- Install boto3 library if you haven’t already:
- Use the following Python script to update the master username of the Redshift cluster:
-
Replace the placeholders
your_aws_region,your_redshift_cluster_identifier, andnew_master_usernamewith your actual AWS region, Redshift cluster identifier, and the desired new master username. - Run the Python script to update the master username of the Redshift cluster. This will trigger an immediate update, and the Redshift cluster will no longer use the default master username.