Redshift cluster has audit logging enabled

Check ID: redshift_cluster_audit_logging
Provider: AWS
Service: redshift
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters are evaluated for database audit logging that exports connection, user, and user-activity events to Amazon S3 or CloudWatch.

Risk

Without audit logs, malicious logins and queries can evade detection, impacting confidentiality (data exfiltration), integrity (unauthorized user/role changes), and availability of investigations due to missing evidence for forensics and incident response.

Recommendation

Enable comprehensive Redshift audit logging and include user-activity events. Centralize logs in a protected destination, enforce least privilege access, retention, and immutability. Implement alerts for anomalous connections and queries as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift enable-logging —cluster-identifier <example_resource_id> —bucket-name <S3_BUCKET_NAME>

resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "dc2.large"
  master_username    = "masteruser"
  master_password    = "SuperSecretPassw0rd!"
  cluster_type       = "single-node"

  logging {
    enable      = true                 # Critical: Turns on audit logging
    bucket_name = "<S3_BUCKET_NAME>"  # Critical: S3 destination required
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      NodeType: dc2.large
      DBName: mydb
      MasterUsername: masteruser
      MasterUserPassword: <PASSWORD>
      # Critical: Enables Redshift audit logging to S3
      LoggingProperties:
        BucketName: <S3_BUCKET_NAME>  # Critical: Required to turn on logging

References

https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_audit_logging. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS snapshot is not publicly shared Redshift cluster has automated snapshots enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires