Redshift cluster is not publicly exposed to the Internet

Check ID: redshift_cluster_public_access
Provider: AWS
Service: redshift
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters with publicly accessible endpoints in public subnets and security groups allowing TCP from 0.0.0.0/0 or ::/0 are identified as internet-exposed. Public endpoints without internet reachability due to private subnets or restrictive rules are recognized separately.

Risk

Internet-exposed Redshift endpoints allow direct DB access from any host, impacting:

Confidentiality: credential brute force, unauthorized queries, data exfiltration
Integrity: unauthorized writes or schema changes
Availability: scanning/abuse leading to connection exhaustion or disruption

Recommendation

Prefer private connectivity: disable public access, place clusters in private subnets, and apply least privilege security groups limited to trusted CIDRs or VPC sources. Use defense in depth with VPN/peering/endpoints, strong authentication, and monitoring. Avoid 0.0.0.0/0 or ::/0 to database ports.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift modify-cluster —cluster-identifier <CLUSTER_ID> —no-publicly-accessible

# Redshift cluster not publicly accessible
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier  = "<example_resource_id>"
  node_type           = "dc2.large"
  cluster_type        = "single-node"
  master_username     = "<example_username>"
  master_password     = "<example_password>"

  publicly_accessible = false  # Critical: disables public access to prevent Internet exposure
}

# CloudFormation: Redshift cluster not publicly accessible
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      DBName: <example_db_name>
      MasterUsername: <example_username>
      MasterUserPassword: <example_password>
      NodeType: dc2.large
      PubliclyAccessible: false  # Critical: disables public access to prevent Internet exposure

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Redshift cluster does not use the default admin username Resource Explorer indexes exist

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires