Check ID: redshift_cluster_non_default_username
Provider: AWS
Service: redshift
Severity: MEDIUM
Categories: identity-access
Resource type: AwsRedshiftCluster

​
What this check verifies

Amazon Redshift clusters are assessed for use of a non-default admin username; clusters using the known default awsuser are identified.

​
Risk

Default admin names make accounts predictable, enabling username enumeration, password spraying, and brute-force attempts. A takeover can expose warehouse data (confidentiality), enable unauthorized queries or schema changes (integrity), and disrupt analytics workloads (availability).

​
Recommendation

Use a unique, non-predictable admin username at creation instead of awsuser. Apply least privilege by using dedicated roles and limiting superuser use. Enforce strong authentication, rotate credentials, and audit access. For existing clusters, create a new one with a unique admin and migrate.

​
Remediation

resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<example_node_type>"
  cluster_type       = "single-node"
  master_username    = "<new-username>"  # Critical: not 'awsuser' to pass the check
  master_password    = "<password>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_non_default_username. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks