Back to Checks
aws

Redshift cluster has automatic version upgrade enabled

redshift_cluster_automatic_upgrades
Service: redshiftSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters have automatic major engine upgrades allowed via AllowVersionUpgrade so updates are applied during the maintenance window.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic upgrades, clusters can run vulnerable engine versions, enabling exploits against known flaws.

Attackers may read or tamper data (confidentiality/integrity), and unresolved bugs can cause downtime (availability). Delayed patching increases exposure window and operational risk.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_automatic_upgrades

Recommendation

Enable AllowVersionUpgrade to keep clusters patched. Use a controlled maintenance window and an appropriate maintenance track; validate upgrades in staging before production.

Align with secure-by-default and defense in depth; keep tested backups and rollback plans. Document justified exceptions and review regularly.

Remediation

CLI

aws redshift modify-cluster --cluster-identifier <cluster_id> --allow-version-upgrade

Terraform

# Redshift cluster allowing automatic major version upgrades
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<node_type>"
  master_username    = "<master_username>"
  master_password    = "<master_user_password>"

  allow_version_upgrade = true  # Critical: enables automatic major version upgrades
}

NativeIaC

# CloudFormation to ensure Redshift allows major version upgrades
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      DBName: <db_name>
      MasterUsername: <master_username>
      MasterUserPassword: <master_user_password>
      NodeType: <node_type>
      AllowVersionUpgrade: true  # Critical: enables automatic major version upgrades during the maintenance window

Other

1Open the Amazon Redshift console
2Go to Clusters and select your cluster
3Click Edit (or Edit maintenance settings)
4Enable "Major version upgrades" (Allow version upgrade)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_automatic_upgrades(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"Redshift Cluster {cluster.id} has AllowVersionUpgrade enabled."
            )
            if not cluster.allow_version_upgrade:
                report.status = "FAIL"
                report.status_extended = (
                    f"Redshift Cluster {cluster.id} has AllowVersionUpgrade disabled."
                )

            findings.append(report)

        return findings

References