Back to Checks
aws

Redshift cluster is encrypted at rest

redshift_cluster_encrypted_at_rest
Service: redshiftSeverity: critical
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters use encryption at rest. The evaluation inspects the cluster's encryption setting to determine if on-disk data and snapshots are protected with a managed key.

Prowler logoProwlerprowler-provider-aws

Risk

Without encryption at rest, data blocks and snapshots can be read if storage media or backups are accessed by unauthorized parties. This compromises confidentiality, enabling bulk data exfiltration and exposure of sensitive analytics, which can facilitate further compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_encrypted_at_rest

Recommendation

Enable encryption at rest for all clusters and prefer customer-managed keys (CMEK) for control and auditing. Apply least privilege to key usage, rotate keys, and restrict snapshot access and cross-Region copies. Monitor key health and access events as part of defense-in-depth.

Remediation

CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --encrypted

Terraform

# Terraform: Enable at-rest encryption for a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<NODE_TYPE>"
  cluster_type       = "<CLUSTER_TYPE>"
  master_username    = "<MASTER_USERNAME>"
  master_password    = "<MASTER_PASSWORD>"

  encrypted = true  # Critical: enables encryption at rest to pass the check
}

NativeIaC

# CloudFormation: Enable at-rest encryption for a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterIdentifier: "<example_resource_id>"
      DBName: "<DB_NAME>"
      MasterUsername: "<MASTER_USERNAME>"
      MasterUserPassword: "<MASTER_PASSWORD>"
      NodeType: "<NODE_TYPE>"
      ClusterType: "<CLUSTER_TYPE>"
      Encrypted: true  # Critical: enables encryption at rest to pass the check

Other

1Open the AWS Management Console and go to Amazon Redshift
2Choose Clusters, then select your cluster
3Open the Properties tab > Database configurations > Edit > Edit encryption
4Select Enable encryption (use AWS-managed or a specific KMS key)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_encrypted_at_rest(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"Redshift Cluster {cluster.id} is not encrypted at rest."
            )
            if cluster.encrypted:
                report.status = "PASS"
                report.status_extended = (
                    f"Redshift Cluster {cluster.id} is encrypted at rest."
                )

            findings.append(report)

        return findings

References