Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys

How to fix it

Encrypt the namespace with a KMS key you own instead of the default AWS owned key, so you hold the key policy, the rotation schedule and the audit trail. The key's policy has to allow Redshift Serverless to use it. Rekeying takes around fifteen minutes per 8TB and blocks other actions on the namespace meanwhile, and it is one way: moving back to an AWS key needs a new namespace.

In the console

Redshift Serverless → Namespace configuration → the namespace → Security and encryption → Edit → Customize encryption settings

With the AWS CLI

aws redshift-serverless update-namespace --namespace-name <namespace-name> --kms-key-id <kms-key-arn> --region <region>

With Terraform

resource "aws_redshiftserverless_namespace" "this" {
  namespace_name = var.namespace_name
  kms_key_id     = var.kms_key_arn
}