Skip to main content

Redshift Parameter Group Require SSL

More Info:​

AWS Redshift non-default parameter groups require SSL to secure data in transit.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of the Redshift Parameter Group requiring SSL in AWS using the AWS Management Console, follow these steps:

  1. Login to AWS Console: Go to the AWS Management Console and login to your account.

  2. Navigate to Redshift Service: In the AWS Management Console, navigate to the Amazon Redshift service.

  3. Select Parameter Groups: In the left-hand navigation pane, select "Parameter Groups".

  4. Identify the Parameter Group: Identify the parameter group that is associated with your Redshift cluster. This parameter group should be the one that needs to have SSL enabled.

  5. Modify the Parameter Group: Select the parameter group by checking the box next to it, and then click on the "Modify" button at the top.

  6. Update SSL Configuration: In the parameter group settings, locate the parameter require_ssl and set its value to true to enforce SSL connections.

  7. Save Changes: After updating the require_ssl parameter, scroll to the bottom of the page and click on the "Save Changes" button to apply the configuration.

  8. Apply Changes to Cluster: Once the changes are saved, you will need to apply the modified parameter group to your Redshift cluster. To do this, select your Redshift cluster, click on the "Cluster Actions" dropdown, and choose "Modify".

  9. Associate Parameter Group: In the Modify Cluster settings, select the modified parameter group from the dropdown list under the "Cluster Parameter Group" section.

  10. Apply Changes: Review the other settings if needed and click on the "Modify Cluster" button to apply the changes.

By following these steps, you have successfully enforced SSL connections for your Amazon Redshift cluster by modifying the parameter group settings.

Using CLI

To remediate the misconfiguration of requiring SSL for an AWS Redshift Parameter Group using AWS CLI, follow these steps:

  1. List all existing Redshift parameter groups to identify the one that needs to be updated:
aws redshift describe-cluster-parameter-groups
  1. Modify the Redshift parameter group to require SSL by setting the require_ssl parameter to true:
aws redshift modify-cluster-parameter-group --parameter-group-name <parameter-group-name> --parameters "ParameterName=require_ssl,ParameterValue=true,ApplyType=dynamic"

Replace <parameter-group-name> with the actual name of the Redshift parameter group that needs to be updated.

  1. Apply the modified parameter group to the Redshift cluster:
aws redshift reboot-cluster --cluster-identifier <cluster-identifier>

Replace <cluster-identifier> with the identifier of the Redshift cluster to apply the changes.

  1. Verify the changes by describing the modified Redshift parameter group:
aws redshift describe-cluster-parameters --parameter-group-name <parameter-group-name>

By following these steps, you can remediate the misconfiguration of requiring SSL for an AWS Redshift Parameter Group using AWS CLI.

Using Python

To remediate the misconfiguration of requiring SSL for an AWS Redshift Parameter Group using Python, you can follow these steps:

  1. Install the boto3 library if you haven't already. You can install it using pip:

    pip install boto3

  2. Use the following Python script to update the Redshift Parameter Group to require SSL:

import boto3

def update_redshift_parameter_group():
    # Specify the AWS region where your Redshift cluster is located
    region = 'your_aws_region'

    # Specify the name of the Redshift Parameter Group you want to update
    parameter_group_name = 'your_parameter_group_name'

    # Create a Redshift client
    redshift = boto3.client('redshift', region_name=region)

    # Specify the parameter to update (require_ssl)
    parameters = [
        {
            'ParameterName': 'require_ssl',
            'ParameterValue': 'true',
            'ApplyType': 'static'
        }
    ]

    # Update the Redshift Parameter Group
    response = redshift.modify_cluster_parameter_group(
        ParameterGroupName=parameter_group_name,
        Parameters=parameters
    )

    print('Redshift Parameter Group updated successfully!')

if __name__ == '__main__':
    update_redshift_parameter_group()

  1. Replace 'your_aws_region' with the AWS region where your Redshift cluster is located, and 'your_parameter_group_name' with the name of the Redshift Parameter Group you want to update.

  2. Run the Python script. This will update the Redshift Parameter Group to require SSL.

Please ensure that you have the necessary permissions to modify Redshift Parameter Groups in your AWS account before running the script.

Using Terraform
resource "aws_redshift_parameter_group" "REDSHIFT_PARAMETER_GROUP" {
  name   = "REPLACE_WITH_PARAMETER_GROUP_NAME"
  family = "REPLACE_WITH_REDSHIFT_FAMILY" # e.g., "redshift-1.0"

  parameter {
    name  = "require_ssl"
    value = "true"
  }
}

resource "aws_redshift_cluster" "REDSHIFT_CLUSTER" {
  cluster_identifier = "REPLACE_WITH_CLUSTER_IDENTIFIER"
  node_type          = "REPLACE_WITH_NODE_TYPE"
  master_username    = "REPLACE_WITH_MASTER_USERNAME"
  master_password    = "REPLACE_WITH_MASTER_PASSWORD"
  cluster_type       = "REPLACE_WITH_CLUSTER_TYPE" # e.g., "single-node" or "multi-node"

  cluster_parameter_group_name = aws_redshift_parameter_group.REDSHIFT_PARAMETER_GROUP.name

  # ...any other required arguments (subnet_group_name, vpc_security_group_ids, etc.)
}

The change to require_ssl is a static parameter; after applying Terraform you must still reboot the cluster (e.g., via aws redshift reboot-cluster or the console) to apply it, which causes a brief outage and will affect any other clusters using the same parameter group at their next reboot.

For verification, terraform plan should show an in-place update to aws_redshift_parameter_group.REDSHIFT_PARAMETER_GROUP (adding or changing the require_ssl parameter to "true") and no replacements.

Additional Reading:​