Redshift cluster has automatic version upgrade enabled

Check ID: redshift_cluster_automatic_upgrades
Provider: AWS
Service: redshift
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters have automatic major engine upgrades allowed via AllowVersionUpgrade so updates are applied during the maintenance window.

Risk

Without automatic upgrades, clusters can run vulnerable engine versions, enabling exploits against known flaws. Attackers may read or tamper data (confidentiality/integrity), and unresolved bugs can cause downtime (availability). Delayed patching increases exposure window and operational risk.

Recommendation

Enable AllowVersionUpgrade to keep clusters patched. Use a controlled maintenance window and an appropriate maintenance track; validate upgrades in staging before production. Align with secure-by-default and defense in depth; keep tested backups and rollback plans. Document justified exceptions and review regularly.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift modify-cluster —cluster-identifier <cluster_id> —allow-version-upgrade

# Redshift cluster allowing automatic major version upgrades
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<node_type>"
  master_username    = "<master_username>"
  master_password    = "<master_user_password>"

  allow_version_upgrade = true  # Critical: enables automatic major version upgrades
}

# CloudFormation to ensure Redshift allows major version upgrades
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      DBName: <db_name>
      MasterUsername: <master_username>
      MasterUserPassword: <master_user_password>
      NodeType: <node_type>
      AllowVersionUpgrade: true  # Critical: enables automatic major version upgrades during the maintenance window

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_automatic_upgrades. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Redshift cluster has automated snapshots enabled Redshift cluster is encrypted at rest

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires