Back to Checks
aws

Amazon Redshift cluster does not use the default admin username

redshift_cluster_non_default_username
Service: redshiftSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsRedshiftCluster

Amazon Redshift clusters are assessed for use of a non-default admin username; clusters using the known default awsuser are identified.

Prowler logoProwlerprowler-provider-aws

Risk

Default admin names make accounts predictable, enabling username enumeration, password spraying, and brute-force attempts. A takeover can expose warehouse data (confidentiality), enable unauthorized queries or schema changes (integrity), and disrupt analytics workloads (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks redshift_cluster_non_default_username

Recommendation

Use a unique, non-predictable admin username at creation instead of awsuser. Apply least privilege by using dedicated roles and limiting superuser use. Enforce strong authentication, rotate credentials, and audit access. For existing clusters, create a new one with a unique admin and migrate.

Remediation

Terraform

resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  node_type          = "<example_node_type>"
  cluster_type       = "single-node"
  master_username    = "<new-username>"  # Critical: not 'awsuser' to pass the check
  master_password    = "<password>"
}

NativeIaC

# CloudFormation: Redshift cluster with non-default admin username
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterType: single-node
      NodeType: <example_node_type>
      MasterUsername: <new-username>  # Critical: not 'awsuser' to pass the check
      MasterUserPassword: <password>

Other

1In the Amazon Redshift console, choose Create cluster
2Set Admin user name to a value other than awsuser (critical)
3Enter the required minimal settings (password, node type) and create the cluster
4Migrate data from the old cluster if needed
5Delete the old cluster that uses the awsuser admin to remove the failing resource

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.redshift.redshift_client import redshift_client


class redshift_cluster_non_default_username(Check):
    def execute(self):
        findings = []
        for cluster in redshift_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = f"Redshift Cluster {cluster.id} does not have the default Admin username."
            if cluster.master_username == "awsuser":
                report.status = "FAIL"
                report.status_extended = (
                    f"Redshift Cluster {cluster.id} has the default Admin username."
                )

            findings.append(report)

        return findings

References