---
title: Redshift clusters should use a non-default port for communication
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Redshift clusters should use a
  non-default port for communication
---

# Redshift clusters should use a non-default port for communication
 
## Description{% #description %}

Confirm [Redshift clusters](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html) are not using default port 5439 to protect against non-targeted attacks.

## Rationale{% #rationale %}

Using a custom port can protect your publicly accessible AWS Redshift clusters against potential brute-force and dictionary attacks. Although setting a custom port can help fend off these attacks, it is also recommended to restrict public access, use SSL to encrypt client connections to database clusters, and control cluster access through security groups and Network Access Control Lists (NACLs) to add an additional layer of security for your account.

## Remediation{% #remediation %}

### From the console{% #from-the-console %}

Follow the [Getting information about cluster configuration][7] docs to access your cluster configuration information. If the cluster has a port 5439, it is the default port. Modify the port number in the console.

### From the command line{% #from-the-command-line %}

1. Run `describe-clusters` with a `cluster-identifier` to [retrieve cluster metadata](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/redshift/describe-clusters.html).

In the `describe-clusters.sh` file:

   ```bash
       aws redshift describe-clusters
   	    --cluster-identifier cluster-name
       
```

1. Run `create-cluster-snapshot` with [create a snapshot of your database cluster](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/redshift/create-cluster-snapshot.html).

In the `create-cluster-snapshot.sh` file:

   ```bash
       aws redshift create-cluster-snapshot
           --cluster-identifier cluster-name
           --snapshot-identifier snapshot-identifier
       
```

1. Run `restore-from-cluster-snapshot` to [create a new cluster from the snapshot created above](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/redshift/restore-from-cluster-snapshot.html). Use the retrieved metadata in step one to configure a new port number.

In the `restore-from-cluster-snapshot.sh` file:

   ```bash
       aws redshift restore-from-cluster-snapshot
           ...
           --cluster-identifier cluster-name
           --snapshot-identifier snapshot-identifier
           --port 2000
        
```