Redshift clusters should use a custom master username

문서 > Datadog 보안 > OOTB Rules > Redshift clusters should use a custom master username

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Confirm Redshift clusters are using a custom master user name, versus the default master user name.

Rationale

Default master user names for publicly accessible clusters can be a backdoor for hacking. While setting a custom master user name alone does not fully protect against attacks, restricting the root account only to privileged users and using additional password measures can add an additional layer of protection.

Remediation

From the console

Follow the Getting information about cluster configuration docs to access your cluster configuration information. If the cluster has a master user name of awsuser, it is the default master user name. Modify the user name to a custom user name in the console.

From the command line

Run describe-clusters with a cluster-identifier to retrieve cluster metadata.
describe-clusters.sh
```
    aws redshift describe-clusters
	    --cluster-identifier cluster-name
    
```

Run create-cluster with the returned cluster metadata to launch a new cluster with the existing metadata and a new master user name.

create-cluster.sh

    aws redshift create-cluster
	    --cluster-identifier old-cluster-identifier
	    --master-username awsmasterusr
        --vpc-security-group-ids id-012a3b4c
        ...
    

Re-run describe-clusters with a custom query filter to retrieve the database cluster endpoint.

describe-clusters.sh

    aws redshift describe-clusters
	    --cluster-identifier new-cluster-identifier
	    --query 'Clusters[*].Endpoint.Address'
    

Reload the old cluster data into the new database cluster with the Unload Copy Utility.
Use the returned new database cluster endpoint URL from step 3 to update your application’s configuration to point to the new cluster endpoint.

Run delete-cluster to delete the old cluster.

delete-cluster.sh

    aws redshift create-cluster
	    --cluster-identifier old-cluster-identifier
	    ...
    