Redshift clusters should use a custom master username

redshift

Description

Confirm Redshift clusters are using a custom master user name, versus the default master user name.

Rationale

Default master user names for publicly accessible clusters can be a backdoor for hacking. While setting a custom master user name alone does not fully protect against attacks, restricting the root account only to privileged users and using additional password measures can add an additional layer of protection.

Remediation

From the console

Follow the Getting information about cluster configuration docs to access your cluster configuration information. If the cluster has a master user name of awsuser, it is the default master user name. Modify the user name to a custom user name in the console.

From the command line

  1. Run describe-clusters with a cluster-identifier to retrieve cluster metadata.

    describe-clusters.sh

        aws redshift describe-clusters
	    --cluster-identifier cluster-name

  2. Run create-cluster with the returned cluster metadata to launch a new cluster with the existing metadata and a new master user name.

    create-cluster.sh

        aws redshift create-cluster
	    --cluster-identifier old-cluster-identifier
	    --master-username awsmasterusr
        --vpc-security-group-ids id-012a3b4c
        ...

  3. Re-run describe-clusters with a custom query filter to retrieve the database cluster endpoint.

    describe-clusters.sh

        aws redshift describe-clusters
	    --cluster-identifier new-cluster-identifier
	    --query 'Clusters[*].Endpoint.Address'

  4. Reload the old cluster data into the new database cluster with the Unload Copy Utility.

  5. Use the returned new database cluster endpoint URL from step 3 to update your application’s configuration to point to the new cluster endpoint.

  6. Run delete-cluster to delete the old cluster.

    delete-cluster.sh

        aws redshift create-cluster
	    --cluster-identifier old-cluster-identifier
	    ...