Check ID: redshift_cluster_non_default_database_name
Provider: AWS
Service: redshift
Severity: LOW
Categories: vulnerabilities
Resource type: AwsRedshiftCluster

​
What this check verifies

Amazon Redshift clusters are identified when the database name equals the default dev, rather than a custom name.

​
Risk

Using the predictable dev name weakens confidentiality and integrity. Mis-scoped IAM or network rules may unintentionally match the database, and known names aid enumeration and targeted connection attempts, increasing the likelihood of unauthorized queries and data exposure.

​
Recommendation

Use a unique, non-default database name per cluster. Define a naming standard that avoids generic values (e.g., dev, test) and supports least privilege by preventing broad policy conditions. Review IAM and network rules to reference only intended, explicit resources.

​
Remediation

# Terraform: Redshift cluster with non-default database name
resource "aws_redshift_cluster" "example" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<NODE_TYPE>"
  cluster_type       = "single-node"
  master_username    = "<MASTER_USERNAME>"
  master_password    = "<MASTER_PASSWORD>"
  database_name      = "<new-db-name>" # Critical: ensure this is not "dev" to pass the check
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_non_default_database_name. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks