Redshift cluster has Enhanced VPC Routing enabled

Check ID: redshift_cluster_enhanced_vpc_routing
Provider: AWS
Service: redshift
Severity: MEDIUM
Categories: trust-boundaries, internet-exposed
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters are assessed for the EnhancedVpcRouting setting, which routes all COPY and UNLOAD traffic between the cluster and data repositories through the VPC, enabling use of VPC security controls and logging.

Risk

Without enhanced VPC routing, COPY/UNLOAD transfers can leave VPC oversight, reducing control and visibility.

VPC egress filtering and endpoint policies can be bypassed (confidentiality)
Limited flow-log telemetry (visibility)
Higher risk of unauthorized exfiltration or tampering (confidentiality, integrity)

Recommendation

Enable EnhancedVpcRouting and enforce least privilege egress:

Prefer private access with VPC endpoints and restrictive policies
Constrain outbound paths via security groups, NACLs, and routing
Monitor transfers with VPC Flow Logs

This strengthens defense in depth and zero trust for data movement.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift modify-cluster —cluster-identifier <cluster-id> —enhanced-vpc-routing

# Terraform: Enable Enhanced VPC Routing on a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier  = "<example_resource_name>"
  cluster_type        = "single-node"
  node_type           = "ra3.xlplus"
  master_username     = "<USERNAME>"
  master_password     = "<PASSWORD>"
  enhanced_vpc_routing = true  # Critical: routes COPY/UNLOAD via VPC
}

# CloudFormation: Enable Enhanced VPC Routing on a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterIdentifier: <example_resource_name>
      ClusterType: single-node
      NodeType: ra3.xlplus
      DBName: dev
      MasterUsername: <USERNAME>
      MasterUserPassword: <PASSWORD>
      EnhancedVpcRouting: true  # Critical: forces COPY/UNLOAD traffic through the VPC

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_enhanced_vpc_routing. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Redshift cluster is encrypted at rest Redshift cluster is encrypted in transit

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires