Amazon Redshift clusters should prohibit public access

How to fix it

• Can break clients: Clients outside the VPC, such as BI tools and on-premises loaders, lose the elastic IP at once unless they connect through a VPN, Direct Connect, VPC peering or a Redshift-managed VPC endpoint.
• Affects another check: Turning this off does not clear Redshift.15 on the same cluster, and narrowing its security group rules does not clear this one.

In the console

Redshift → Clusters → the cluster → Actions → Publicly accessible (also shown at Properties → Network and security settings)

Publicly accessible

Off

With the AWS CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --no-publicly-accessible --region <region>

With Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier  = var.cluster_identifier
  node_type           = var.node_type
  publicly_accessible = false
}