Back to Checks
aws

Redshift cluster has Enhanced VPC Routing enabled

redshift_cluster_enhanced_vpc_routing
Service: redshiftSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundariesinternet-exposed
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters are assessed for the EnhancedVpcRouting setting, which routes all COPY and UNLOAD traffic between the cluster and data repositories through the VPC, enabling use of VPC security controls and logging.

Prowler logoProwlerprowler-provider-aws

Risk

Without enhanced VPC routing, COPY/UNLOAD transfers can leave VPC oversight, reducing control and visibility.

  • VPC egress filtering and endpoint policies can be bypassed (confidentiality)
  • Limited flow-log telemetry (visibility)
  • Higher risk of unauthorized exfiltration or tampering (confidentiality, integrity)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_enhanced_vpc_routing

Recommendation

Enable EnhancedVpcRouting and enforce least privilege egress:

  • Prefer private access with VPC endpoints and restrictive policies
  • Constrain outbound paths via security groups, NACLs, and routing
  • Monitor transfers with VPC Flow Logs

This strengthens defense in depth and zero trust for data movement.

Remediation

CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --enhanced-vpc-routing

Terraform

# Terraform: Enable Enhanced VPC Routing on a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier  = "<example_resource_name>"
  cluster_type        = "single-node"
  node_type           = "ra3.xlplus"
  master_username     = "<USERNAME>"
  master_password     = "<PASSWORD>"
  enhanced_vpc_routing = true  # Critical: routes COPY/UNLOAD via VPC
}

NativeIaC

# CloudFormation: Enable Enhanced VPC Routing on a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterIdentifier: <example_resource_name>
      ClusterType: single-node
      NodeType: ra3.xlplus
      DBName: dev
      MasterUsername: <USERNAME>
      MasterUserPassword: <PASSWORD>
      EnhancedVpcRouting: true  # Critical: forces COPY/UNLOAD traffic through the VPC

Other

1Open the AWS Console and go to Amazon Redshift
2Choose Provisioned clusters, select your cluster
3Click Actions > Modify
4In Network and security, turn on Enhanced VPC routing
5Click Save changes (apply immediately if prompted)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_enhanced_vpc_routing(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"Redshift Cluster {cluster.id} does not have Enhanced VPC Routing security feature enabled."
            if cluster.enhanced_vpc_routing:
                report.status = "PASS"
                report.status_extended = f"Redshift Cluster {cluster.id} has Enhanced VPC Routing security feature enabled."

            findings.append(report)

        return findings

References