Redshift Clusters Should Be Launched Within a VPC

More Info:

Your Redshift clusters should be provisioned within the AWS EC2-VPC platform instead of EC2-Classic platform (outdated) for better flexibility and control over clusters security, traffic routing, availability and more.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of launching Redshift clusters outside of a VPC in AWS, follow these steps using the AWS Management Console:

1. Create a VPC (Virtual Private Cloud):

   • Go to the AWS Management Console and navigate to the VPC dashboard.
   • Click on "Create VPC" and provide the necessary details like VPC name, CIDR block, and other configurations.
   • Create at least one subnet within the VPC for your Redshift cluster.

2. Modify Redshift Cluster Configuration:

   • Go to the Amazon Redshift console.
   • Select the Redshift cluster that is not within a VPC.
   • Click on the "Cluster" actions dropdown and select "Modify".
   • In the "Network and security" section, choose the VPC and the subnet you created in step 1.
   • Save the changes.

3. Verify the Configuration:

   • Once the modification is complete, verify that the Redshift cluster is now launched within the VPC.
   • Check the VPC ID and subnet ID associated with the Redshift cluster to ensure it is within the desired VPC.

4. Update Security Group Rules:

   • Update the security group rules associated with the Redshift cluster to allow necessary inbound and outbound traffic within the VPC.

5. Test the Redshift Cluster:

   • After making these changes, test the Redshift cluster to ensure it is functioning as expected within the VPC.

By following these steps, you can remediate the misconfiguration of launching Redshift clusters outside of a VPC in AWS and ensure that your Redshift cluster is securely deployed within a VPC.

Using CLI

To remediate the misconfiguration of launching Redshift clusters within a VPC in AWS using AWS CLI, follow these steps:

1. Create a VPC (if not already created):

   aws ec2 create-vpc --cidr-block 10.0.0.0/16

2. Create a subnet within the VPC:

   aws ec2 create-subnet --vpc-id <VPC_ID> --cidr-block 10.0.1.0/24

3. Create a security group for Redshift within the VPC:

   aws ec2 create-security-group --group-name redshift-sg --description "Redshift Security Group" --vpc-id <VPC_ID>

4. Allow necessary inbound rules for the security group (e.g., Redshift port 5439):

   aws ec2 authorize-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 5439 --cidr 0.0.0.0/0

5. Launch a Redshift cluster within the VPC:

   aws redshift create-cluster --cluster-identifier myredshiftcluster --node-type dc2.large --master-username admin --master-user-password <PASSWORD> --cluster-type single-node --vpc-security-group-ids <SECURITY_GROUP_ID> --cluster-subnet-group-name <SUBNET_GROUP_NAME>

6. Ensure that the Redshift cluster is launched within the VPC by checking the VPC ID of the cluster:

   aws redshift describe-clusters --cluster-identifier myredshiftcluster

By following these steps, you would have successfully remediated the misconfiguration of launching Redshift clusters within a VPC in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of launching Redshift clusters within a VPC in AWS using Python, you can follow these steps:

1. Import the necessary Python libraries:

import boto3

2. Initialize the AWS Redshift client:

redshift_client = boto3.client('redshift')

3. Get a list of existing Redshift clusters:

response = redshift_client.describe_clusters()
clusters = response['Clusters']

4. For each Redshift cluster, check if it is launched within a VPC:

for cluster in clusters:
    cluster_id = cluster['ClusterIdentifier']
    vpc_id = cluster.get('VpcId', None)
    
    if vpc_id is None:
        # Modify the cluster to launch within a VPC
        redshift_client.modify_cluster(ClusterIdentifier=cluster_id, VpcSecurityGroupIds=['vpc-security-group-id'])

5. Replace 'vpc-security-group-id' with the appropriate VPC security group ID where you want to launch the Redshift cluster.

6. Run the Python script to remediate the misconfiguration by launching the Redshift clusters within a VPC.

By following these steps, you can use Python to remediate the misconfiguration of launching Redshift clusters within a VPC in AWS.

Using Terraform

# Create (or point to) a Redshift subnet group in your VPC
resource "aws_redshift_subnet_group" "REDSHIFT_SUBNET_GROUP" {
  name       = "REPLACE_WITH_REDSHIFT_SUBNET_GROUP_NAME"
  description = "Redshift subnet group in VPC"
  subnet_ids = [
    aws_subnet.PRIVATE_SUBNET_1.id,
    aws_subnet.PRIVATE_SUBNET_2.id,
    # add more subnets as needed, all in the same VPC
  ]
}

# Example VPC security group for Redshift
resource "aws_security_group" "REDSHIFT_SG" {
  name        = "REPLACE_WITH_REDSHIFT_SG_NAME"
  description = "Security group for Redshift in VPC"
  vpc_id      = aws_vpc.MY_VPC.id

  # Add ingress/egress rules appropriate for your environment
  # e.g., allow from app servers:
  # ingress {
  #   from_port   = 5439
  #   to_port     = 5439
  #   protocol    = "tcp"
  #   cidr_blocks = ["REPLACE_WITH_ALLOWED_CIDR"]
  # }
}

# Redshift cluster launched in the VPC via subnet group + VPC security group
resource "aws_redshift_cluster" "REDSHIFT_CLUSTER" {
  cluster_identifier = "REPLACE_WITH_CLUSTER_IDENTIFIER"

  node_type        = "REPLACE_WITH_NODE_TYPE"
  master_username  = "REPLACE_WITH_MASTER_USERNAME"
  master_password  = "REPLACE_WITH_MASTER_PASSWORD"

  # This is what ensures the cluster is launched in the VPC:
  cluster_subnet_group_name = aws_redshift_subnet_group.REDSHIFT_SUBNET_GROUP.name
  vpc_security_group_ids    = [aws_security_group.REDSHIFT_SG.id]

  # Other required/desired settings:
  # number_of_nodes       = 2
  # cluster_type          = "multi-node"
  # port                  = 5439
  # publicly_accessible   = false
  # encrypted             = true
  # skip_final_snapshot   = false
  # final_snapshot_identifier = "REPLACE_WITH_FINAL_SNAPSHOT_ID"
}

Moving an existing EC2-Classic Redshift cluster into a VPC requires creating a new VPC-based cluster and destroying the old one; this is a replacement and will cause downtime unless you plan a migration/cutover.

For verification, terraform plan should show your aws_redshift_cluster.REDSHIFT_CLUSTER either:

• being created (if new), or
• being destroyed and re-created with changes to cluster_subnet_group_name and vpc_security_group_ids (if you are migrating from EC2-Classic).

Additional Reading:

• https://docs.aws.amazon.com/redshift/latest/mgmt/getting-started-cluster-in-vpc.html