Description

Ensure that Amazon Redshift clusters have encryption at rest enabled using an AWS KMS key (or AWS Redshift-managed default encryption), so that data stored on cluster nodes, along with automated snapshots, is encrypted.

Rationale

Without encryption at rest, data warehoused in a Redshift cluster, along with any automated or manual snapshots taken of it, is stored unencrypted, which does not meet common confidentiality requirements for data warehouse content that frequently aggregates sensitive business and customer data from multiple source systems. Enabling encryption at rest ensures this data, and any derived snapshots, are protected using AWS KMS.

Impact

  • Protects data warehouse content at rest, including automated and manual snapshots

  • Supports compliance requirements mandating encryption of data at rest for aggregated, potentially sensitive datasets

  • Enabling encryption on an existing, unencrypted cluster requires creating an encrypted copy via snapshot restore, resulting in a new cluster endpoint

Default Value

Encryption at rest is disabled by default for a newly created Redshift cluster unless explicitly enabled at creation time.

Pre-Requisites

  • An AWS KMS key, if a customer-managed key is required (otherwise the AWS-managed default Redshift key can be used)

  • IAM permissions to view and modify Redshift clusters (redshift:DescribeClusters, redshift:ModifyCluster, redshift:RestoreFromClusterSnapshot)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon Redshift > Clusters and select the cluster to review.

  3. Open the Properties tab.

  4. Review the Encryption field.

  5. Verify that it shows as Enabled with an associated KMS key.

  6. If encryption is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon Redshift > Clusters and select the unencrypted cluster to update.

  3. Select Actions, then Modify encryption.

  4. Enable encryption and select the desired KMS key.

  5. Confirm the change; Redshift will automatically create an encrypted copy of the cluster via a snapshot restore process and update the cluster to use it, which involves some downtime while the migration completes.

  6. Verify the cluster's Properties tab now shows Encryption as Enabled and that applications can reconnect successfully (the cluster endpoint typically remains the same after this managed migration).

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon Redshift > Clusters and select the encrypted cluster.

  3. Select Actions, then Modify encryption, and disable encryption, if reverting is required.

  4. Confirm the change and allow the managed migration to complete.

Reference