Profile Applicability:
Level 1
Description:
Amazon Redshift is a fully managed data warehouse service that allows you to run complex queries and analytics on large datasets. Enhanced VPC Routing in Redshift helps route all COPY and UNLOAD traffic between your Redshift cluster and Amazon S3 (or other data sources) through your Virtual Private Cloud (VPC), which ensures that network traffic is routed securely and can be monitored using VPC flow logs and security groups.
By enabling Enhanced VPC Routing, you ensure that all Redshift data traffic is directed within your private network, enhancing security by using VPC components like security groups and NACLs (Network Access Control Lists). It also allows you to integrate with other AWS services in a more controlled environment.
Rationale:
Enhanced Security: Routing traffic through a VPC helps protect data by ensuring it is not exposed to the public internet.
Traffic Monitoring: With Enhanced VPC Routing, you can use tools like VPC Flow Logs and security groups to monitor and control the data traffic.
Compliance: Using private network routes helps meet strict security and compliance requirements (e.g., PCI-DSS, HIPAA).
Network Segmentation: Helps keep Redshift traffic isolated within your VPC, preventing unauthorized access from public networks.
Impact:
Pros:
Increased Security: Traffic between Amazon Redshift and Amazon S3 (and other data sources) remains within your private VPC.
Enhanced Monitoring: Easier to monitor network traffic with VPC Flow Logs and apply network-level security controls.
Compliance: Helps meet compliance requirements by preventing Redshift traffic from going over the public internet.
Cost Efficiency: By keeping traffic within the VPC, you avoid potential additional costs that might arise from public routing.
Cons:
Complexity: Requires proper setup of VPC routing, subnets, and security controls, which may increase configuration complexity.
Latency Considerations: Depending on the setup of your VPC and network, there may be slight latency increases for inter-region communication.
Default Value:
By default, Enhanced VPC Routing is disabled when you launch a Redshift cluster. You must explicitly enable it during the creation of the Redshift cluster or later via the Redshift Console or CLI.
Pre-requisite:
AWS IAM Permissions:
redshift:DescribeClusters
redshift:ModifyCluster
ec2:DescribeVpcs
ec2:DescribeSubnets
ec2:CreateRoute
ec2:CreateSecurityGroup
AWS CLI installed and configured.
A valid Amazon Redshift cluster and a configured VPC.
Proper VPC security groups, subnets, and NACLs in place for security.
Remediation:
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon Redshift under Services.
In the Redshift Dashboard, select the cluster you want to check.
Go to the Properties section of the cluster.
Look for Enhanced VPC Routing under Network and Security.
If Enhanced VPC Routing is enabled, it will show as Enabled.
If not enabled, it will show as Disabled.
To enable Enhanced VPC Routing, click Modify Cluster, select Enable Enhanced VPC Routing, and then apply the changes.
Using AWS CLI:
To check if Enhanced VPC Routing is enabled for a Redshift cluster, run:
aws redshift describe-clusters --query 'Clusters[*].{ClusterIdentifier:ClusterIdentifier,EnhancedVpcRouting:EnhancedVpcRouting}'This will list all clusters with their EnhancedVpcRouting status.
To enable Enhanced VPC Routing for a Redshift cluster, run:
aws redshift modify-cluster --cluster-identifier <cluster-id> --enhanced-vpc-routing
To confirm the change:
aws redshift describe-clusters --cluster-identifier <cluster-id> --query 'Clusters[*].EnhancedVpcRouting
Implementation Steps:
Using AWS Console:
Log in to the AWS Management Console and navigate to Amazon Redshift.
In the Redshift Dashboard, click on Clusters.
Select the Redshift Cluster that you want to modify.
In the Cluster Properties section, check if Enhanced VPC Routing is enabled.
If Enhanced VPC Routing is disabled, click Modify.
In the Network and Security section, select Enable Enhanced VPC Routing.
Click Continue, and then Apply Changes.
The cluster will undergo a restart process to apply the new settings.
Using AWS CLI:
To enable Enhanced VPC Routing on a Redshift cluster, run:
aws redshift describe-clusters --cluster-identifier <cluster-id> --query 'Clusters[*].EnhancedVpcRouting
To verify that Enhanced VPC Routing is enabled, run:
aws redshift describe-clusters --cluster-identifier <cluster-id> --query 'Clusters[*].EnhancedVpcRouting'
To confirm that the changes are applied, check the cluster's properties again using the describe command.
Backout Plan:
Console Process
Go to the Amazon Redshift Console:
Open the Amazon Redshift console.
Select Your Cluster:
Choose the cluster you want to check.
Check Enhanced VPC Routing:
In the cluster details, look for the Enhanced VPC Routing setting.
If it’s enabled, it will show as True.
CLI Process
Describe the Cluster:
aws redshift describe-clusters --cluster-identifier <cluster-name>
Check the Output:
Look for the EnhancedVpcRouting field in the output.
If it says true, enhanced VPC routing is enabled.
Note:
Testing: Before enabling Enhanced VPC Routing in a production environment, test it in a development or staging environment to ensure that your VPC setup (subnets, routing, security groups) is properly configured and works as expected.
Monitoring: Enable CloudWatch logs to monitor the performance and health of the Redshift cluster, especially after enabling enhanced routing.