Back to Checks
aws

Redshift cluster has automated snapshots enabled

redshift_cluster_automated_snapshot
Service: redshiftSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters are evaluated for automated snapshots being enabled with a retention period > 0, confirming that periodic backups are created and retained.

Prowler logoProwlerprowler-provider-aws

Risk

Without automated snapshots, clusters lack recent recovery points, degrading availability and integrity.

Accidental deletion, malicious changes, or failed ETL can cause data loss and prolonged recovery, increasing RPO/RTO and limiting effective forensic analysis.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_automated_snapshot

Recommendation

Enable automated snapshots with retention aligned to RPO/RTO. Enforce least privilege on snapshot access and use encryption. Regularly test restores and monitor backup health.

For resilience, replicate snapshots to another Region/account and separate backup administration from data owners.

Remediation

CLI

aws redshift modify-cluster --cluster-identifier <example_resource_id> --automated-snapshot-retention-period 1

Terraform

# Terraform: Enable automated snapshots for a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  cluster_type       = "single-node"
  node_type          = "<NODE_TYPE>"
  database_name      = "<DB_NAME>"
  master_username    = "<MASTER_USERNAME>"
  master_password    = "<MASTER_PASSWORD>"

  automated_snapshot_retention_period = 1  # Critical: enables automated snapshots by retaining them for 1 day
}

NativeIaC

# CloudFormation: Enable automated snapshots for a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      NodeType: <NODE_TYPE>
      DBName: <DB_NAME>
      MasterUsername: <MASTER_USERNAME>
      MasterUserPassword: <MASTER_PASSWORD>
      AutomatedSnapshotRetentionPeriod: 1  # Critical: enables automated snapshots by retaining them for 1 day

Other

1Open the AWS Console and go to Amazon Redshift
2Select your cluster and click Modify
3Under Backup, set Automated snapshot retention period to 1 (or greater)
4Click Save changes and apply the modification

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_automated_snapshot(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"Redshift Cluster {cluster.id} has automated snapshots enabled."
            )
            if not cluster.cluster_snapshots:
                report.status = "FAIL"
                report.status_extended = (
                    f"Redshift Cluster {cluster.id} has automated snapshots disabled."
                )

            findings.append(report)

        return findings

References