Terraform AWS Redshift¶
Terraform module which creates Redshift cluster resources on AWS with comprehensive features including snapshots, parameter groups, subnet groups, and IAM roles.
Implemented Controls¶
The following compliance controls are implemented in this module.
- AWS Redshift audit logging should be enabled
- AWS Redshift clusters should have automatic snapshots enabled
- AWS Redshift should have automatic upgrades to major versions enabled
- Redshift clusters should be encrypted with CMK
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift clusters should be encrypted with KMS
- AWS Redshift should have required maintenance settings
- Redshift clusters should have Multi-AZ deployments enabled
- AWS Redshift clusters should not use the default Admin username
- Redshift clusters should not use the default database name
- Redshift clusters should prohibit public access
Compliance.tf registry endpoints¶
module "redshift" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "acscism2023.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "awscontroltower.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "awsgenai.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cccsmedium.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cis.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cisv500.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cisv600.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "fedramplow.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "ffiec.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "gdpr.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "hipaa.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "iso27001.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "nist800171.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "nist80053.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "nistcsf.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "nydfs23.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "pcidss.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
module "redshift" {
source = "soc2.compliance.tf/terraform-aws-modules/redshift/aws"
version = "<version>"
# ... your arguments here
}
See the Technical Usage Guide to get started and read the Features section for more details on how to customize the module for your requirements.
Mapped compliance frameworks¶
ISM-1271: Network environment
ISM-1758: Database event logging
CP-10(2): Transaction Recovery
- AWS Redshift audit logging should be enabled
- AWS Redshift clusters should have automatic snapshots enabled
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift clusters should be encrypted with KMS
- Redshift clusters should prohibit public access
164.308(a)(7)(ii)(B): Administrative Safeguards - 164.308(a)(7)(ii)(B)
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift clusters should be encrypted with KMS
- AWS Redshift should have required maintenance settings
- Redshift clusters should prohibit public access
A.12.3.1: Information backup
- AWS Redshift clusters should have automatic snapshots enabled
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift should have required maintenance settings
- Redshift clusters should prohibit public access
CP-10(2): Transaction Recovery
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift clusters should be encrypted with KMS
- AWS Redshift should have required maintenance settings
- Redshift clusters should prohibit public access
6.3.3: Security vulnerabilities are identified and addressed.
- AWS Redshift audit logging should be enabled
- AWS Redshift clusters should have automatic snapshots enabled
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift clusters should be encrypted with KMS
- Redshift clusters should prohibit public access