Back to Checks
aws

Redshift cluster does not use the default database name dev

redshift_cluster_non_default_database_name
Service: redshiftSeverity: low
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters are identified when the database name equals the default dev, rather than a custom name.

Prowler logoProwlerprowler-provider-aws

Risk

Using the predictable dev name weakens confidentiality and integrity. Mis-scoped IAM or network rules may unintentionally match the database, and known names aid enumeration and targeted connection attempts, increasing the likelihood of unauthorized queries and data exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_non_default_database_name

Recommendation

Use a unique, non-default database name per cluster. Define a naming standard that avoids generic values (e.g., dev, test) and supports least privilege by preventing broad policy conditions. Review IAM and network rules to reference only intended, explicit resources.

Remediation

Terraform

# Terraform: Redshift cluster with non-default database name
resource "aws_redshift_cluster" "example" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<NODE_TYPE>"
  cluster_type       = "single-node"
  master_username    = "<MASTER_USERNAME>"
  master_password    = "<MASTER_PASSWORD>"
  database_name      = "<new-db-name>" # Critical: ensure this is not "dev" to pass the check
}

NativeIaC

# CloudFormation: Create a Redshift cluster with a non-default DB name
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      NodeType: <NODE_TYPE>
      MasterUsername: <MASTER_USERNAME>
      MasterUserPassword: <MASTER_PASSWORD>
      DBName: <new-db-name>  # Critical: set initial database name to a value other than "dev" to pass the check

Other

1In the AWS Management Console, go to Amazon Redshift > Provisioned clusters
2Click Create cluster
3In Database configurations, set Database name to a value that is not "dev"
4Complete the wizard and create the cluster
5Migrate workloads to the new cluster and delete the old cluster that used the default "dev" database name

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_non_default_database_name(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = f"Redshift Cluster {cluster.id} does not have the default database name."
            if cluster.database_name == "dev":
                report.status = "FAIL"
                report.status_extended = f"Redshift Cluster {cluster.id} has the default database name: {cluster.database_name}."

            findings.append(report)

        return findings

References