Redshift clusters should be encrypted at rest

How to fix it

• Interrupts service: The cluster stays read-only, with status resizing, while Redshift migrates its data to encrypted storage, so pause loads and writes until it finishes.

In the console

Redshift → Clusters → the cluster → Properties → Database configurations → Edit → Edit encryption

Edit encryption

An AWS KMS key, the AWS owned key or a customer managed key; either passes this check

Configure cross-region snapshot

Off before the encryption change, if it is on

With the AWS CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --encrypted --kms-key-id <kms-key-arn> --region <region>

With Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier = var.cluster_identifier
  node_type          = var.node_type
  encrypted          = true
}