Back to Checks
aws

Redshift cluster has audit logging enabled

redshift_cluster_audit_logging
Service: redshiftSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters are evaluated for database audit logging that exports connection, user, and user-activity events to Amazon S3 or CloudWatch.

Prowler logoProwlerprowler-provider-aws

Risk

Without audit logs, malicious logins and queries can evade detection, impacting confidentiality (data exfiltration), integrity (unauthorized user/role changes), and availability of investigations due to missing evidence for forensics and incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_audit_logging

Recommendation

Enable comprehensive Redshift audit logging and include user-activity events. Centralize logs in a protected destination, enforce least privilege access, retention, and immutability. Implement alerts for anomalous connections and queries as part of defense in depth.

Remediation

CLI

aws redshift enable-logging --cluster-identifier <example_resource_id> --bucket-name <S3_BUCKET_NAME>

Terraform

resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "dc2.large"
  master_username    = "masteruser"
  master_password    = "SuperSecretPassw0rd!"
  cluster_type       = "single-node"

  logging {
    enable      = true                 # Critical: Turns on audit logging
    bucket_name = "<S3_BUCKET_NAME>"  # Critical: S3 destination required
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      NodeType: dc2.large
      DBName: mydb
      MasterUsername: masteruser
      MasterUserPassword: <PASSWORD>
      # Critical: Enables Redshift audit logging to S3
      LoggingProperties:
        BucketName: <S3_BUCKET_NAME>  # Critical: Required to turn on logging

Other

1Open the Amazon Redshift console and go to Clusters
2Select the target cluster and open the Properties tab
3In Database audit logging, click Edit
4Enable logging and select an S3 bucket
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_audit_logging(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"Redshift Cluster {cluster.id} has audit logging enabled."
            )
            if not cluster.logging_enabled:
                report.status = "FAIL"
                report.status_extended = (
                    f"Redshift Cluster {cluster.id} has audit logging disabled."
                )

            findings.append(report)

        return findings

References