Redshift clusters must not be publicly accessible. Exposing cluster endpoints to the internet increases the risk of unauthorized access, data exfiltration, and brute-force attacks. For Ansible, check tasks using the redshift or community.aws.redshift modules: the publicly_accessible parameter must be set to false. This rule flags any task where publicly_accessible is true. Explicitly set publicly_accessible: false in your task to ensure the cluster is not reachable from the public internet. Relying on implicit defaults may be ambiguous across versions.
