Redshift Serverless workgroups should prohibit public access

How to fix it

Have publiclyAccessible set to false on the Redshift Serverless workgroup the finding names by ARN, so it is reachable only from inside the VPC. Public access is what gave the workgroup its elastic IP address, so turning it off withdraws that address: every client connecting over it stops reaching the workgroup unless it can arrive inside the VPC instead, through a VPN, Direct Connect, VPC peering or a Redshift-managed VPC endpoint. Check what connects from outside the VPC before making the change. UpdateWorkgroup accepts one parameter per request, so this goes in a call of its own rather than alongside a capacity or subnet change. A workgroup whose collected configuration carries no publiclyAccessible field is treated as public and fails, because GetWorkgroup always returns that field and its absence means the reading is wrong; a workgroup that could not be read at all keeps whatever verdict the last successful scan recorded, rather than flipping on a permissions problem with the scanning role.

In the console

Redshift Serverless → Workgroup configuration → the workgroup → Data access → Network and security → Edit → Publicly accessible

With the AWS CLI

aws redshift-serverless update-workgroup --workgroup-name <workgroup-name> --no-publicly-accessible --region <region>

With Terraform

resource "aws_redshiftserverless_workgroup" "this" {
  namespace_name      = var.namespace_name
  workgroup_name      = var.workgroup_name
  publicly_accessible = false
}