Amazon Redshift Serverless workgroups should use enhanced VPC routing

How to fix it

Have enhancedVpcRouting set to true on the workgroup, so its COPY and UNLOAD traffic to data repositories is forced through your VPC and can be governed by security groups, network ACLs and endpoint policies and recorded in VPC flow logs. Build the network path before turning it on, because once it is on, traffic with nowhere to go simply fails and COPY and UNLOAD start erroring: an Amazon S3 gateway VPC endpoint for buckets in the workgroup's own Region, a NAT gateway for buckets in another Region or for other AWS services, and interface VPC endpoints for IAM Identity Center if the workgroup authenticates through it, where the symptom is a failed sign-in rather than a failed query. Enhanced VPC routing itself is not charged, but the path it forces traffic onto is: a NAT gateway bills per hour and per gigabyte processed, and an UNLOAD to a bucket in another Region is billed as cross-Region data transfer. UpdateWorkgroup accepts one parameter per request, so this change goes in a call of its own. The check reads the workgroup's own flag only, and a workgroup whose configuration could not be read produces no finding here rather than a passing one.

In the console

Redshift Serverless → Workgroup configuration → the workgroup → Data access → Network and security → Edit → Enhanced VPC routing

With the AWS CLI

aws redshift-serverless update-workgroup --workgroup-name <workgroup-name> --enhanced-vpc-routing --region <region>

With Terraform

resource "aws_redshiftserverless_workgroup" "this" {
  namespace_name       = var.namespace_name
  workgroup_name       = var.workgroup_name
  enhanced_vpc_routing = true
}