Skip to main content

Redshift Clusters Should Allow Version Upgrade

More Info:​

Version Upgrade should be enabled for Redshift clusters to automatically receive upgrades during the maintenance window.

Risk Level​

Low

Address​

Security, Operational Maturity

Compliance Standards​

AWSWAF

Remediation​

How to enable automatic version upgrade for redshift clusters

Using AWS Console​

  1. Access Redshift Console: Sign in to the AWS Management Console and navigate to the Amazon Redshift service.
  2. Select Cluster: From the list of Redshift clusters, choose the cluster for which you want to enable automatic version upgrades. (In the Cloudanix Console, navigate to "Misconfig" page and look for Affected Assets for "Redshift Clusters Should Allow Version Upgrade" Policy.)
  3. Modify Cluster: In the cluster details page, click on the "Modify" button to make changes to the cluster configuration.
  4. Enable Automatic Version Upgrade: Scroll down to the "Cluster Version" section of the Modify Cluster page. Check the box next to "Automatic Upgrade" to enable automatic version upgrades.
  5. Save Changes: After enabling automatic version upgrades, click on the "Apply Changes" button to save the configuration.
  6. Monitor Cluster Upgrades: Once automatic version upgrades are enabled, Redshift will automatically upgrade your cluster to the latest available version during the maintenance window. You can monitor the upgrade progress and status in the cluster details page.

Triage and Remediation​

Remediation​

Using Console

To remediate “Redshift clusters should allow version upgrade” in the AWS Console, you need to enable “Allow version upgrade” on each cluster.

Step-by-step in AWS Console​

  1. Sign in to AWS Console

  2. Open Amazon Redshift

    • In the services search bar, type “Redshift” and select Amazon Redshift.

  3. Go to Clusters

    • In the left navigation pane, click “Provisioned clusters” (or “Clusters” if that’s what you see).
    • You’ll see a list of existing Redshift clusters.

  4. Select the Cluster

    • Click the name of the cluster you want to fix.
    • This opens the cluster details page.

  5. Edit Cluster Settings

    • On the cluster details page, look for the “Actions” button or an “Edit” button (UI varies slightly by console version).
    • Choose “Edit” (or “Modify”).

  6. Enable Allow Version Upgrade

    • In the edit/modify form, scroll to the “Maintenance” or “Cluster configuration” section.
    • Find the checkbox or toggle named “Allow version upgrade”.
    • Set it to enabled/checked.

  7. Save Changes

    • Scroll to the bottom and click “Save changes” or “Modify cluster”.
    • Confirm if a confirmation dialog appears.

  8. Repeat for Other Clusters

    • Repeat steps 4–7 for each Redshift cluster that needs this setting enabled.

After this, during Redshift maintenance windows, the cluster will be able to upgrade to newer engine versions automatically.

Using CLI

To fix “Redshift Clusters Should Allow Version Upgrade” using AWS CLI, you need to set --allow-version-upgrade to true on each cluster.

Below are concise, step-by-step instructions.

1. List all Redshift clusters​

aws redshift describe-clusters \
  --query "Clusters[].ClusterIdentifier" \
  --output text

This returns cluster identifiers (space-separated).

2. Check current AllowVersionUpgrade setting (optional)​

For a specific cluster:

CLUSTER_ID="my-redshift-cluster"

aws redshift describe-clusters \
  --cluster-identifier "$CLUSTER_ID" \
  --query "Clusters[0].{Cluster:ClusterIdentifier,AllowVersionUpgrade:AllowVersionUpgrade}" \
  --output table

3. Enable version upgrade for a single cluster​

CLUSTER_ID="my-redshift-cluster"

aws redshift modify-cluster \
  --cluster-identifier "$CLUSTER_ID" \
  --allow-version-upgrade \
  --no-cli-pager

--allow-version-upgrade without a value means true.

4. Enable version upgrade for all clusters (bash loop)​

for CLUSTER_ID in $(aws redshift describe-clusters \
  --query "Clusters[].ClusterIdentifier" \
  --output text); do
  echo "Enabling version upgrade for cluster: $CLUSTER_ID"
  aws redshift modify-cluster \
    --cluster-identifier "$CLUSTER_ID" \
    --allow-version-upgrade \
    --no-cli-pager
done

5. Verify remediation​

aws redshift describe-clusters \
  --query "Clusters[].{Cluster:ClusterIdentifier,AllowVersionUpgrade:AllowVersionUpgrade}" \
  --output table

All clusters should show AllowVersionUpgrade as True.

Using Python

To remediate “Redshift Clusters Should Allow Version Upgrade” using Python (boto3), you need to set AllowVersionUpgrade=True on the cluster(s).

Below is a concise step‑by‑step.

1. Prerequisites​

  • AWS credentials configured (via environment variables, AWS profile, or IAM role).
  • boto3 installed:
pip install boto3

2. Identify Redshift clusters where AllowVersionUpgrade is False​

import boto3

redshift = boto3.client("redshift", region_name="us-east-1")  # adjust region

def get_clusters_with_upgrade_disabled():
    clusters_to_fix = []
    paginator = redshift.get_paginator("describe_clusters")
    for page in paginator.paginate():
        for cluster in page.get("Clusters", []):
            if not cluster.get("AllowVersionUpgrade", True):
                clusters_to_fix.append(cluster["ClusterIdentifier"])
    return clusters_to_fix

if __name__ == "__main__":
    clusters = get_clusters_with_upgrade_disabled()
    print("Clusters with AllowVersionUpgrade = False:", clusters)

3. Enable version upgrade on those clusters​

import boto3

redshift = boto3.client("redshift", region_name="us-east-1")  # adjust region

def enable_version_upgrade(cluster_identifier: str):
    """
    Sets AllowVersionUpgrade=True on a specific Redshift cluster.
    """
    response = redshift.modify_cluster(
        ClusterIdentifier=cluster_identifier,
        AllowVersionUpgrade=True
    )
    return response

def remediate_all():
    paginator = redshift.get_paginator("describe_clusters")
    for page in paginator.paginate():
        for cluster in page.get("Clusters", []):
            cid = cluster["ClusterIdentifier"]
            if not cluster.get("AllowVersionUpgrade", True):
                print(f"Enabling version upgrade for cluster: {cid}")
                enable_version_upgrade(cid)

if __name__ == "__main__":
    remediate_all()

4. Verify remediation​

import boto3

redshift = boto3.client("redshift", region_name="us-east-1")

def verify():
    paginator = redshift.get_paginator("describe_clusters")
    for page in paginator.paginate():
        for cluster in page.get("Clusters", []):
            print(
                cluster["ClusterIdentifier"],
                "AllowVersionUpgrade=",
                cluster["AllowVersionUpgrade"]
            )

if __name__ == "__main__":
    verify()

If you want this to run automatically (e.g., as part of a Lambda remediation), the core logic is the remediate_all() function; you just need to adapt it into a Lambda handler and configure appropriate IAM permissions (redshift:DescribeClusters and redshift:ModifyCluster).

Using Terraform
resource "aws_redshift_cluster" "this" {
  cluster_identifier = "YOUR_CLUSTER_IDENTIFIER"
  node_type          = "YOUR_NODE_TYPE"
  master_username    = "YOUR_MASTER_USERNAME"
  master_password    = "YOUR_MASTER_PASSWORD"
  cluster_type       = "multi-node"

  # Ensure the cluster allows major version upgrades
  allow_version_upgrade = true

  # ...other required arguments...
}

Substitute:

  • YOUR_CLUSTER_IDENTIFIER with the Redshift cluster identifier,
  • YOUR_NODE_TYPE with the desired node type (e.g., dc2.large),
  • YOUR_MASTER_USERNAME / YOUR_MASTER_PASSWORD with your credentials.

This change updates the existing cluster in place (no forced replacement), though Redshift may perform version upgrades during maintenance windows.

To verify, terraform plan should show an in-place update with:

  • allow_version_upgrade: "false" => "true" (or from its previous value to true) and no -/+ replacement indicator on the cluster.

Additional Reading:​