# Ensure Redshift Cluster Requires TLS Check

- Source: https://support.icompaas.com/support/solutions/articles/62000218464-ensure-redshift-cluster-requires-tls-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [Automation Policies](https://support.icompaas.com/support/solutions/folders/62000167189)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

The Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the cloud. An Amazon Redshift data warehouse is a collection of computing resources called nodes, which are organized into a group called a cluster.

 Redshift supports SSL to encrypt data and server certificates to validate.

## **Rationale:**

Checks whether Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. The rule is NON\_COMPLIANT if any Amazon Redshift cluster has parameter require\_SSL not set to true.

## **Impact:**

We know that TLS (Transport Layer Security) is a security protocol that provides privacy and data integrity for Internet communications. If we ensure that the Redshift cluster contains TLS it prevents the data breach, It helps to hide the data from third parties and also ensures that data has not been tampered with by unknown person/bad guys/unauthorized person. It means this policy prevents Man in middle (MITM) attacks.

## **Default Value:**

By default encryption in the redshift cluster is disabled and in the parameter group it contains default.redshift-1.0 which is not editable . 

  

### **Pre-Requisite:**

1.  In Redshift, it must contain at least one cluster
    
2.  default parameter group is not editable so you need to create a parameter group before the implementation step
    

  

  

  

**Remediation:**

**Test Plan:**

**Step 1:** Log in to AWS Management Console and go to the Redshift dashboard at             [https://console.aws.amazon.com/redshiftv2](https://console.aws.amazon.com/redshiftv2 "https://console.aws.amazon.com/redshiftv2")

**Step 2:** Choose a cluster to examine ![](https://support.icompaas.com/assets/kb/2fb1a5a05f4bcbd5.png) 

**Step 3:** In the selected cluster go to the properties tab ![](https://support.icompaas.com/assets/kb/5fc09e02ce0cb7d5.png) 

**Step 4:** In properties, tab see in Data configurations it contains Parameter group and encryption we can see encryption either enable or disable 

![](https://support.icompaas.com/assets/kb/b36a29b22eb7c4bb.png)  

**Step 5:** In the default parameter group SSL require set value is false it is not editable for examination click on the default parameter group![](https://support.icompaas.com/assets/kb/4b01c73247d23630.png)

  

**Step 6:** Click on the Parameters tab![](https://support.icompaas.com/assets/kb/f0179f087ed0772e.png)

  

In the parameter, we can see require\_ssl false  
![](https://support.icompaas.com/assets/kb/308d584f29859006.png)

**Using AWS CLI** 

1.  First, run the describe-clusters command 
    
    aws redshift describe-clusters
      --region <region>
      --output table
      --query 'Clusters\[\*\].ClusterIdentifier'
    
      
    

2\. Lists the parameter data or the cluster

aws redshift describe-cluster-parameters
  --region us-east-1
  --parameter-group-name cc-cluster-redshift-param-group

  

**Implementation Steps:**

**Step 1:** Log in to AWS Management Console and go to the Redshift dashboard at             [https://console.aws.amazon.com/redshiftv2](https://console.aws.amazon.com/redshiftv2 "https://console.aws.amazon.com/redshiftv2")

**Step 2:** Choose a cluster to examine 

![](https://support.icompaas.com/assets/kb/f73e203de56762a2.png)  

**Step 3:** In the selected cluster go to the properties tab 

![](https://support.icompaas.com/assets/kb/69a097d24e5c60fe.png)  

  

**Step 4:** First enable the Encryption by clicking on the edit button and clicking on edit encryption

![](https://support.icompaas.com/assets/kb/31f1b1c8cbdf6038.png)  

Choose the encryption option as per your organization's policy

![](https://support.icompaas.com/assets/kb/602db16ac5395d19.png)  

in the parameter group you change the false value of require\_ssl in true steps to change the value of the parameter group not in the default group we assume that you already created the parameter group

**Step 5:** Click on the parameter group contains in your cluster

![](https://support.icompaas.com/assets/kb/21af8f2de6dc8c28.png)  

**Step 6:** Go to the parameter tab in the selected parameter group

![](https://support.icompaas.com/assets/kb/726458f9afb4e593.png)  

**Step 7:** Click on the Edit Parameters button and set require\_ssl value true and click on the Save button

![](https://support.icompaas.com/assets/kb/b7091a1e14116611.png)  

**Step 8:** go to the parameter tab in the selected parameter group ![](https://support.icompaas.com/assets/kb/2d8db42cd1e43e1b.png) 

**Step 9:** Click on the Edit Parameters button  ![](https://support.icompaas.com/assets/kb/4328203cf8d0f4fe.png)  

**Step 10:** set requires a value to be true and click on the Save button ![](https://support.icompaas.com/assets/kb/d8acf2819d684e6b.png) 

  

  

**Using AWS CLI:**

Syntax: to modify the redshift

aws redshift modify-cluster-parameter-group \\
--parameter-group-name parameter\_group\_name \\
--parameters ParameterName=parameter\_name,ParameterValue=parameter\_value

  

modify cluster change the parameter value to true in require\_ssl

aws redshift modify-cluster-parameter-group \\
 --parameter-group-name <cluster name> \\
  --parameters ParameterName=require\_ssl,ParameterValue=true 

  
**Backout Plan:**

**Step 1:** Log in to AWS Management Console and go to the Redshift dashboard at [https://console.aws.amazon.com/redshiftv2](https://console.aws.amazon.com/redshiftv2 "https://console.aws.amazon.com/redshiftv2")

**Step 2:** Choose a cluster to examine

**Step 3:** In the selected cluster go to the properties tab

**Step 4:** Click on the Parameter group

**Step 5:** Click on the Parameter

**Step 6:** Click on the Edit Parameter

**Step 7:** Make changes in require-ssl as false![](https://support.icompaas.com/assets/kb/f7df7486aafd1880.png)

**step 8:** Click on save changes 

  

**Using AWS CLI:**

**To modify the the parameter group** 

aws redshift modify-cluster-parameter-group \\
 --parameter-group-name <cluster name> \\
  --parameters ParameterName=require\_ssl,ParameterValue=false 

## **Reference:**

1.  [![](https://support.icompaas.com/assets/kb/45092f56c2d9b77b.png)](https://docs.aws.amazon.com/cli/latest/reference/redshift/index.html)[redshift — AWS CLI 1.20.1 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/redshift/index.html) 
    
2.  [](https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-mgmt.pdf "https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-mgmt.pdf")[https://aws.amazon.com/redshift/](https://aws.amazon.com/redshift/ "https://aws.amazon.com/redshift/")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.