Control: 6 Amazon Redshift should have automatic upgrades to major versions enabled

Description

This control checks whether automatic major version upgrades are enabled for the Amazon Redshift cluster.

Enabling automatic major version upgrades ensures that the latest major version updates to Amazon Redshift clusters are installed during the maintenance window. These updates might include security patches and bug fixes. Keeping up to date with patch installation is an important step in securing systems.

Remediation

To remediate this issue from the AWS CLI, use the Amazon Redshift modify-cluster command to set the --allow-version-upgrade attribute.

From the AWS CLI, run

aws redshift modify-cluster --cluster-identifier clustername --allow-version-upgrade

Where clustername is the name of your Amazon Redshift cluster.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_redshift_6

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_redshift_6 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when allow_version_upgrade then 'ok'
    else 'alarm'
  end as status,
  case
    when allow_version_upgrade then title || ' automatic upgrades to major versions enabled.'
    else title || ' automatic upgrades to major versions disabled.'
  end as reason
  
  , region, account_id
from
  aws_redshift_cluster;

Control: 6 Amazon Redshift should have automatic upgrades to major versions enabled

Description

Remediation

Usage

SQL

Tags