Amazon_Redshift_17

Ensure redshift cluster have enhanced VPC routing enabled

Description

Ensure that Enhanced VPC Routing is enabled for your Amazon Redshift data warehouse clusters in order to force the traffic between your clusters and your AWS cloud resources to pass through the Virtual Private Cloud (VPC) and not through the Internet, allowing you to control your network traffic. By using Enhanced VPC Routing, you can use standard VPC network features, such as VPC security groups, Network Access Control Lists (NACLs), VPC endpoints, VPC endpoint policies, Internet gateways, and Domain Name System (DNS) servers. You use these VPC features to tightly manage the flow of data between your Amazon Redshift clusters and other cloud resources.

Remediation

To enable enhanced VPC routing for a cluster

  • Sign in to the AWS Management Console and open the Amazon Redshift console at https://console.aws.amazon.com/redshift/.
  • On the navigation menu, choose Clusters, then choose cluster for which enhanced VPC routing is to be enabled.
  • Under Propertied tab, in Network and security settings choose edit.
  • Enable enhanced VPC routing option and click on save changes.
  • Under Propertied tab, in Network and security settings choose edit.
  • Under Propertied tab, in Network and security settings choose edit.
  • When Enhanced VPC Routing is enabled, it does not automatically enable traffic flow through a Virtual Private Cloud (VPC). You must specifically create a network path between your Redshift cluster VPC and your data resources. To make use of the Enhanced VPC Routing feature, you can configure the following pathways in your clusters VPC:
    • VPC endpoints – for traffic to an Amazon S3 bucket in the same AWS region as your Redshift cluster, you can create a VPC endpoint to direct traffic directly to the bucket. When you use VPC endpoints, you can attach an endpoint policy to manage access to Amazon S3 data.
    • NAT gateway – if required, you can connect to an Amazon S3 bucket in another AWS region or you can connect to another service within the AWS cloud network. You can also access a host instance outside the AWS cloud network by configuring a Network Address Translation (NAT) gateway.
    • Internet gateway – used to connect to AWS services outside your Virtual Private Cloud (VPC) network, you can attach an Internet Gateway to your VPC subnet. To use an Internet Gateway (IGW), your Redshift cluster must have a public IP to allow other services to communicate with your cluster.
  • Repeat for other clusters and for other regions

Service

Redshift

Severity

Medium

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!