Redshift cluster subnet groups should have subnets from multiple Availability Zones

How to fix it

• Overwrites existing settings: The CLI call and Terraform's subnet_ids replace the group's whole subnet list, so include the subnets already in the group alongside the new ones.
• Can break clients: Compute nodes can move to any subnet in the group during a resize, pause and resume or failover, so a subnet with different network ACL or route table rules can cut the cluster off.
• Affects another check: Two Availability Zones pass this check, but Multi-AZ (Redshift.18) needs a subnet group covering three, so add a third if a cluster using this group needs it.

In the console

Redshift → Provisioned clusters dashboard → Configurations → Subnet groups → the subnet group → Actions → Modify

Subnets

Subnets in two or more Availability Zones, kept alongside the subnets already in the group

With the AWS CLI

aws redshift modify-cluster-subnet-group --cluster-subnet-group-name <subnet-group-name> --subnet-ids <subnet-id-1> <subnet-id-2> <subnet-id-3> --region <region>

With Terraform

resource "aws_redshift_subnet_group" "this" {
  name       = var.subnet_group_name
  subnet_ids = var.subnet_ids
}