Redshift cluster is encrypted at rest

Check ID: redshift_cluster_encrypted_at_rest
Provider: AWS
Service: redshift
Severity: CRITICAL
Categories: encryption
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters use encryption at rest. The evaluation inspects the cluster’s encryption setting to determine if on-disk data and snapshots are protected with a managed key.

Risk

Without encryption at rest, data blocks and snapshots can be read if storage media or backups are accessed by unauthorized parties. This compromises confidentiality, enabling bulk data exfiltration and exposure of sensitive analytics, which can facilitate further compromise.

Recommendation

Enable encryption at rest for all clusters and prefer customer-managed keys (CMEK) for control and auditing. Apply least privilege to key usage, rotate keys, and restrict snapshot access and cross-Region copies. Monitor key health and access events as part of defense-in-depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift modify-cluster —cluster-identifier <cluster-id> —encrypted

# Terraform: Enable at-rest encryption for a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<NODE_TYPE>"
  cluster_type       = "<CLUSTER_TYPE>"
  master_username    = "<MASTER_USERNAME>"
  master_password    = "<MASTER_PASSWORD>"

  encrypted = true  # Critical: enables encryption at rest to pass the check
}

# CloudFormation: Enable at-rest encryption for a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterIdentifier: "<example_resource_id>"
      DBName: "<DB_NAME>"
      MasterUsername: "<MASTER_USERNAME>"
      MasterUserPassword: "<MASTER_PASSWORD>"
      NodeType: "<NODE_TYPE>"
      ClusterType: "<CLUSTER_TYPE>"
      Encrypted: true  # Critical: enables encryption at rest to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_encrypted_at_rest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Redshift cluster has automatic version upgrade enabled Redshift cluster has Enhanced VPC Routing enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires