Description

Ensure that Amazon Redshift clusters require SSL/TLS for client connections, by enabling the require_SSL parameter in the cluster's parameter group, so that traffic between clients and the cluster is encrypted.

Rationale

Without requiring SSL, clients may connect to the Redshift cluster over an unencrypted connection, exposing query text, result sets, and authentication credentials to interception on the network path between the client and the cluster. Enforcing SSL/TLS at the parameter group level ensures that only encrypted connections are accepted, regardless of individual client configuration.

Impact

  • Protects query traffic, result data, and credentials in transit between clients and the cluster

  • Enforces a consistent security posture regardless of individual client connection settings

  • Requires client drivers and connection strings to be configured to support or require SSL

Default Value

The require_SSL parameter defaults to false in the default Redshift parameter group, meaning SSL is not enforced unless explicitly required.

Pre-Requisites

  • Client drivers/tools capable of connecting to Redshift over SSL

  • IAM permissions to modify Redshift parameter groups (redshift:ModifyClusterParameterGroup) and clusters (redshift:ModifyCluster)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon Redshift > Clusters and select the cluster to review.

  3. Open the Properties tab and note the associated Parameter group.

  4. Navigate to Parameter groups, select the associated group, and review the require_SSL parameter.

  5. Verify that require_SSL is set to true.

  6. If require_SSL is false, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon Redshift > Parameter groups.

  3. If the cluster uses the default parameter group, create a new custom parameter group based on the current family, since the default group cannot be modified.

  4. Select the parameter group, edit parameters, and set require_SSL to true.

  5. Save the changes.

  6. Navigate to Clusters, select the cluster, and, if a new parameter group was created, associate it with the cluster via Modify, then apply the change and reboot the cluster if required for the parameter to take effect.

  7. Update client connection strings to use SSL and verify connectivity.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon Redshift > Parameter groups and select the associated group.

  3. Edit parameters and set require_SSL back to false.

  4. Save the changes and reboot the cluster if required.

Reference