All checks
High
Redshift security groups should allow ingress on the cluster port only from restricted origins
Flags Redshift clusters whose attached security groups allow ingress from 0.0.0.0/0 or ::/0 to the cluster port over any protocol, which invites unauthorized access. A port range containing it or an All traffic rule counts, as does a managed prefix list holding either CIDR, or a shared one this account can no longer see.
- service
- Redshift
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: Clients reaching the cluster over the open rule stop connecting once it narrows or goes, as do other resources sharing the group, so add rules for their sources first.
- Affects another check: Narrowing these rules does not clear Redshift.1 on a publicly accessible cluster, and turning public access off does not clear this one.
In the console
EC2 → Security Groups → the group attached to the cluster (Redshift → Clusters → the cluster → Properties → Network and security settings) → Inbound rules
- Source
- The CIDR ranges or security groups that must reach the cluster, not Anywhere-IPv4 or Anywhere-IPv6; or delete the rule
- VPC security groups
- A group of the cluster's own, if the open group is shared with resources that still need that rule
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id> --region <region>See which of your accounts this check is failing on.
Book a live scan