compliance.tf
Terraform Modules for AWSDatabases, Caching & Analytics

Terraform AWS Redshift

Redshift clusters or serverless workgroups with VPC networking, encryption, audit logging, snapshot settings, parameter groups, enhanced VPC routing, and controlled access.

Controls enforced

These compliance controls are checked at terraform plan time.

Quick start

module "redshift" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}
module "redshift" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "redshift" {
  source  = "terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"
}
module "redshift" {
  source  = "soc2.compliance.tf/terraform-aws-modules/redshift/aws"
  version = ">= 7.0.0, < 8.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "redshift" {
  source  = "terraform-aws-modules/redshift/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

1.2.5: Network security controls (NSCs) are configured and maintained.

1.3.1: Network access to and from the cardholder data environment is restricted.

1.3.2: Network access to and from the cardholder data environment is restricted.

1.4.1: Network connections between trusted and untrusted networks are controlled.

1.4.2: Network connections between trusted and untrusted networks are controlled.

1.4.4: System components that store cardholder data are not directly accessible from untrusted networks

10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.3.1: Audit logs are protected from destruction and unauthorized modifications.

10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.

2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons

2.2.7: System components are configured and managed securely.

4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained

4.2.1: PAN is protected with strong cryptography during transmission.

5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.

8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities

AC-3(1) Restricted Access To Privileged Functions

AC-3(10) Audited Override Of Access Control Mechanisms

AU-12(1) System-Wide And Time-Correlated Audit Trial

AU-12(3) Changes By Authorized Individuals

AU-12(4) Query Parameter Audits Of Personally Identifiable Information

AU-14(3) Remote Viewing And Listening

AU-6(3) Correlate Audit Record Repositories

AU-6(4) Central Review And Analysis

AU-6(6) Correletion With Physical Monitoring

AU-6(9) Correletion With From Nontechnical Sources

Continuous Monitoring Strategy (PM-31)

SC-28(1): Cryptographic Protection

SC-8(3) Cryptographic Protection For Message Externals

SC-8(4) Conceal Or Ramdomize Communications

SI-19(4) Removal, Masking, Encryption, Hashing, Or Replacement Of Direct Identifiers

SI-4(17) Integrated Situational Awareness

SI-4(2) Automated Tools For Real-Time Analysis

SI-7(8) Auditing Capability For Significant Events

11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period

11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records

11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand

164.308(a)(1)(ii)(B) Risk Management

164.308(a)(1)(ii)(D): Administrative Safeguards

164.308(a)(3)(ii)(A) Authorization and/or supervision

164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions

164.312(a)(2)(iv) Encryption and decryption

A.8.14 Redundancy of information processing facilities

A.8.3 Information access restriction

Framework coverage

Which controls from this module are active under each framework endpoint.

ControlPCI DSS v4.0HIPAA Omnibus Rule 2013
Redshift clusters should have audit logging enabled●●
Redshift clusters should have automatic snapshots enabled○○
Redshift clusters should have automatic upgrades to major versions enabled●○
Redshift clusters should be encrypted with CMK○○
Redshift cluster encryption in transit should be enabled●●
Redshift clusters should have audit logging and encryption enabled○○
Redshift clusters should have enhanced VPC routing enabled●●
Redshift clusters should have KMS encryption enabled●●
Redshift clusters should have required maintenance settings●○
Redshift clusters should have Multi-AZ deployments enabled●○
Redshift clusters should not use the default admin username○○
Redshift clusters should not use the default database name○○
Redshift clusters should prohibit public access○○

● enforced by default · ○ not activated by this endpoint

RDS Aurora

Previous Page

EMR

Next Page

On this page

Controls enforcedQuick startMigration from upstreamReversibilityMapped compliance frameworksFramework coverage

Ask AI about this

Help improve this page