Redshift cluster has automated snapshots enabled

Check ID: redshift_cluster_automated_snapshot
Provider: AWS
Service: redshift
Severity: HIGH
Categories: resilience
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters are evaluated for automated snapshots being enabled with a retention period > 0, confirming that periodic backups are created and retained.

Risk

Without automated snapshots, clusters lack recent recovery points, degrading availability and integrity. Accidental deletion, malicious changes, or failed ETL can cause data loss and prolonged recovery, increasing RPO/RTO and limiting effective forensic analysis.

Recommendation

Enable automated snapshots with retention aligned to RPO/RTO. Enforce least privilege on snapshot access and use encryption. Regularly test restores and monitor backup health. For resilience, replicate snapshots to another Region/account and separate backup administration from data owners.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift modify-cluster —cluster-identifier <example_resource_id> —automated-snapshot-retention-period 1

# Terraform: Enable automated snapshots for a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  cluster_type       = "single-node"
  node_type          = "<NODE_TYPE>"
  database_name      = "<DB_NAME>"
  master_username    = "<MASTER_USERNAME>"
  master_password    = "<MASTER_PASSWORD>"

  automated_snapshot_retention_period = 1  # Critical: enables automated snapshots by retaining them for 1 day
}

# CloudFormation: Enable automated snapshots for a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      NodeType: <NODE_TYPE>
      DBName: <DB_NAME>
      MasterUsername: <MASTER_USERNAME>
      MasterUserPassword: <MASTER_PASSWORD>
      AutomatedSnapshotRetentionPeriod: 1  # Critical: enables automated snapshots by retaining them for 1 day

References

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Redshift.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_automated_snapshot. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Redshift cluster has audit logging enabled Redshift cluster has automatic version upgrade enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires