Back to Checks
aws

Redshift cluster is encrypted in transit

redshift_cluster_in_transit_encryption_enabled
Service: redshiftSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters enforce encryption in transit by requiring TLS for client connections when require_ssl is enabled.

This evaluation identifies clusters where connections are not forced to use TLS.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing plaintext or optional TLS exposes SQL sessions to:

  • Confidentiality loss: credentials, queries, and results can be intercepted.
  • Integrity compromise: statements or data may be modified in transit.
  • Availability impact: session hijacking can disrupt workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_in_transit_encryption_enabled

Recommendation

Require TLS for all Redshift connections by setting require_ssl=true and disallow plaintext.

Configure clients to validate certificates and prefer private network paths. Keep drivers/TLS policies current. Apply least privilege and defense in depth to limit exposure if transport security fails.

Remediation

CLI

aws redshift modify-cluster-parameter-group --parameter-group-name <example_resource_name> --parameters ParameterName=require_ssl,ParameterValue=true

Terraform

# Set require_ssl to true in the Redshift parameter group used by the cluster
resource "aws_redshift_parameter_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  family = "redshift-1.0"

  parameter {
    name  = "require_ssl"   # CRITICAL: Enforces TLS for client connections
    value = "true"          # CRITICAL: Enable SSL requirement
  }
}

NativeIaC

# CloudFormation: Set require_ssl to true in the Redshift parameter group in use
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::ClusterParameterGroup
    Properties:
      Description: Require SSL for Redshift connections
      ParameterGroupFamily: redshift-1.0
      Parameters:
        - ParameterName: require_ssl   # CRITICAL: Enforces TLS for client connections
          ParameterValue: true         # CRITICAL: Enable SSL requirement

Other

1In the AWS Console, go to Amazon Redshift > Parameter groups
2Open the parameter group used by your cluster
3Click Edit parameters, set require_ssl to true, and Save
4Reboot the cluster to apply the static parameter change

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_in_transit_encryption_enabled(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"Redshift Cluster {cluster.id} is not encrypted in transit."
            )
            if cluster.require_ssl:
                report.status = "PASS"
                report.status_extended = (
                    f"Redshift Cluster {cluster.id} is encrypted in transit."
                )

            findings.append(report)

        return findings

References