Redshift Clusters Should Be Launched Within a VPC
More Info:
Your Redshift clusters should be provisioned within the AWS EC2-VPC platform instead of EC2-Classic platform (outdated) for better flexibility and control over clusters security, traffic routing, availability and more.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of launching Redshift clusters outside of a VPC in AWS, follow these steps using the AWS Management Console:
-
Create a VPC (Virtual Private Cloud):
- Go to the AWS Management Console and navigate to the VPC dashboard.
- Click on “Create VPC” and provide the necessary details like VPC name, CIDR block, and other configurations.
- Create at least one subnet within the VPC for your Redshift cluster.
-
Modify Redshift Cluster Configuration:
- Go to the Amazon Redshift console.
- Select the Redshift cluster that is not within a VPC.
- Click on the “Cluster” actions dropdown and select “Modify”.
- In the “Network and security” section, choose the VPC and the subnet you created in step 1.
- Save the changes.
-
Verify the Configuration:
- Once the modification is complete, verify that the Redshift cluster is now launched within the VPC.
- Check the VPC ID and subnet ID associated with the Redshift cluster to ensure it is within the desired VPC.
-
Update Security Group Rules:
- Update the security group rules associated with the Redshift cluster to allow necessary inbound and outbound traffic within the VPC.
-
Test the Redshift Cluster:
- After making these changes, test the Redshift cluster to ensure it is functioning as expected within the VPC.
Using CLI
Using CLI
To remediate the misconfiguration of launching Redshift clusters within a VPC in AWS using AWS CLI, follow these steps:
-
Create a VPC (if not already created):
-
Create a subnet within the VPC:
-
Create a security group for Redshift within the VPC:
-
Allow necessary inbound rules for the security group (e.g., Redshift port 5439):
-
Launch a Redshift cluster within the VPC:
-
Ensure that the Redshift cluster is launched within the VPC by checking the VPC ID of the cluster:
Using Python
Using Python
To remediate the misconfiguration of launching Redshift clusters within a VPC in AWS using Python, you can follow these steps:
- Import the necessary Python libraries:
- Initialize the AWS Redshift client:
- Get a list of existing Redshift clusters:
- For each Redshift cluster, check if it is launched within a VPC:
-
Replace
'vpc-security-group-id'with the appropriate VPC security group ID where you want to launch the Redshift cluster. - Run the Python script to remediate the misconfiguration by launching the Redshift clusters within a VPC.