Question 1

Is allow_version_upgrade enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, This control checks whether automatic major version upgrades are enabled for the AWS Redshift cluster.

Question 2

Is automated_snapshot_retention_period enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, This control checks whether AWS Redshift clusters have automated snapshots enabled. It also checks whether the snapshot retention period is greater than or equal to seven.

Question 3

Is cloudwatch_log_group_kms_key_id enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 4

Is cloudwatch_log_group_retention_in_days enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 5

Is cluster_identifier enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, This control ensures if redshift clusters are logging audits to a specific bucket. The rule is no compliant if audit logging is not enabled for a redshift cluster or if the 'bucketNames' parameter is provided but the audit logging destination does not match.

Question 6

Is encrypted enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Ensure that your AWS Redshift clusters require TLS/SSL encryption to connect to SQL clients.

Question 7

Is enhanced_vpc_routing enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Ensure that AWS Redshift cluster has 'enhancedVpcRouting' enabled. The rule is non-compliant if 'enhancedVpcRouting' is not enabled or if the configuration.enhancedVpcRouting field is 'false'.

Question 8

Is kms_key_arn enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Ensure that AWS Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption. The rule is compliant if encryption is enabled and the cluster is encrypted with the key provided in the kmsKeyArn parameter. The rule is non-compliant if the cluster is not encrypted or encrypted with another key.

Question 9

Is publicly_accessible enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Manage access to resources in the AWS Cloud by ensuring that AWS Redshift clusters are not public.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 AC-16(b)	AC-16(b)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled AU-9(3)	AU-9(3)
Redshift clusters should have audit logging enabledredshift_cluster_audit_logging_enabled AC-2(4)	AC-2(4)
Redshift clusters should have automatic snapshots enabledredshift_cluster_automatic_snapshots_min_7_days CP-1(2)	CP-1(2)
Redshift clusters should have automatic upgrades to major versions enabledredshift_cluster_automatic_upgrade_major_versions_enabled CM-2(b)	CM-2(b)
Redshift cluster encryption in transit should be enabledredshift_cluster_encryption_in_transit_enabled None	None
Redshift clusters should have enhanced VPC routing enabledredshift_cluster_enhanced_vpc_routing_enabled None	None
Redshift clusters should have KMS encryption enabledredshift_cluster_kms_enabled None	None
Redshift clusters should prohibit public accessredshift_cluster_prohibit_public_access AC-2(6)	AC-2(6)
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports SC-7	SC-7

Controls