Redshift cluster is not using a custom master user name
Incident Management が一般に使用できるようになりました。 Incident Management が広範に使用できるようになりました。
<  Back to rules search

Redshift cluster is not using a custom master user name

redshift

Classification:

compliance

Set up the redshift integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Overview

Description

Confirm Redshift clusters are using a custom master user name, versus the default master user name.

Rationale

Default master user names for publicly accessible clusters can be a backdoor for hacking. While setting a customer master user name alone does not fully protect against attacks, restricting the root account only to privileged users and using additional password measures can add an additional layer of protection.

Remediation

  1. Run describe-clusters with a cluster-identifier to retrieve cluster metadata.

    describe-clusters.sh

        aws redshift describe-clusters
    	    --cluster-identifier cluster-name
        
  2. Run create-cluster with the returned cluster metadata to launch a new cluster with the existing metadata and a new master user name.

    create-cluster.sh

        aws redshift create-cluster
    	    --cluster-identifier old-cluster-identifier
    	    --master-username awsmasterusr
            --vpc-security-group-ids id-012a3b4c
            ...
        
  3. Re-run describe-clusters with a custom query filter to retrieve the database cluster endpoint.

    describe-clusters.sh

        aws redshift describe-clusters
    	    --cluster-identifier new-cluster-identifier
    	    --query 'Clusters[*].Endpoint.Address'
        
  4. Reload the old cluster data into the new database cluster with the Unload Copy Utility.

  5. Use the returned new database cluster endpoint URL from step 3 to update your application’s configuration to point to the new cluster endpoint.

  6. Run delete-cluster to delete the old cluster.

    delete-cluster.sh

        aws redshift create-cluster
    	    --cluster-identifier old-cluster-identifier
    	    ...